Trust the WARD certificate authority on Android

PUBLIC_RELEASE_CHECKLIST.md

@@ -2,7 +2,6 @@
 
 Complete these items while the repository is still private:
 
-- [ ] Choose a license for the original code and add it as `LICENSE`.
 - [ ] Rotate the bearer token that was previously embedded in the application and
       deployment configuration.
 - [x] Rewrite Git history to remove the old bearer token and application PIN,

README.md

@@ -46,6 +46,8 @@ the development computer's LAN address, such as `http://192.168.1.20:8080`.
 Enter the same API token when connecting. The app stores its connection settings
 in its private application data and excludes them from Android backups. Cleartext
 HTTP is permitted only in debug builds; use HTTPS for non-local deployments.
+The release app trusts Android's system roots and the bundled public WARD root
+CA used by the project's private PKI.
 
 Tap a grid tile to open the vertical player. Long-press to select videos for a
 manual collection. The pager prepares neighboring pages to reduce startup latency.
@@ -93,10 +95,3 @@ release; the workflow derives the user-visible version from the tag.
 Treat the bearer token as a password. The server provides a single shared token,
 not per-user accounts or authorization scopes, and should not be exposed directly
 to the internet without HTTPS and appropriate network controls.
-
-## Licensing
-
-Third-party licenses and attributions are recorded in
-[`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md). No license has yet been granted
-for the repository's original code; choose and add one before announcing the
-project as open source.

android/app/src/main/AndroidManifest.xml

@@ -4,6 +4,7 @@
     <application
         android:allowBackup="false"
         android:label="Short Form Video"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:supportsRtl="true"
         android:theme="@style/Theme.ShortFormVideo"
         android:usesCleartextTraffic="${usesCleartextTraffic}">

android/app/src/main/res/raw/ward_root_ca.crt

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICdDCCAfmgAwIBAgIRAKfU9Zw+Js/brHgEQsGh6kMwCgYIKoZIzj0EAwMweTEL
+MAkGA1UEBhMCVVMxETAPBgNVBAgTCE1pc3NvdXJpMREwDwYDVQQHEwhDb2x1bWJp
+YTENMAsGA1UEChMEV0FSRDEcMBoGA1UECxMTS2VlcGVyIG9mIHRoZSBTZWFsczEX
+MBUGA1UEAxMOV0FSRCBIaWdoIFNlYWwwHhcNMjYwNzE0MTkwNzE1WhcNNDYwNzE0
+MTkwNzE1WjB5MQswCQYDVQQGEwJVUzERMA8GA1UECBMITWlzc291cmkxETAPBgNV
+BAcTCENvbHVtYmlhMQ0wCwYDVQQKEwRXQVJEMRwwGgYDVQQLExNLZWVwZXIgb2Yg
+dGhlIFNlYWxzMRcwFQYDVQQDEw5XQVJEIEhpZ2ggU2VhbDB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABIAy+1J1e+aAhuIwoeDhVMffxfVSPz9SF2oeYAIVo20Oy7lLf2e1
+Bxl4v2jI70gE6RvEQZIun9hCCdndaYlQBfNeTsq2WyATaswqwPoXzy8F+k0A0L3I
+WNB5Q3+ziXbb7aNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
+AQEwHQYDVR0OBBYEFBT8E6uVkuXG2FDBlO1Aj7oSXmWoMAoGCCqGSM49BAMDA2kA
+MGYCMQC1buh+feqK1d0bxtx1kRIIpSvmcwmDzHQfy+/nM7rtRpAYfvY6qfif4YAR
+6QWU42gCMQDGjjSuDynEUJGUROnvgqzbVPr+QkbiQMHFZ9qkFHDYtxFq6otl/+Xa
+0oqfuT+Sqz8=
+-----END CERTIFICATE-----

android/app/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config>
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="@raw/ward_root_ca" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>