From 8735fe4177717dc44443180cf1d594e8a0000ecc Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Thu, 11 Jun 2026 13:43:15 +0200 Subject: [PATCH] vpn service sync --- .cursor/rules/bottomline-reminder.mdc | 14 + .gitignore | 1 + app/build.gradle | 10 +- app/src/main/AndroidManifest.xml | 23 +- .../androidcast/IVpnOperationCallback.aidl | 7 + .../com/foxx/androidcast/IVpnService.aidl | 19 ++ .../foxx/androidcast/IVpnStateCallback.aidl | 6 + app/src/main/assets/licenses/combined.html | 4 +- .../androidcast/AndroidCastApplication.java | 5 +- .../foxx/androidcast/crash/CrashReporter.java | 69 +++-- .../crash/CrashRuntimeContext.java | 7 + .../remoteaccess/RemoteAccessCoordinator.java | 3 +- .../remoteaccess/RemoteAccessService.java | 26 +- .../RemoteAccessTunnelHelper.java | 4 +- .../remoteaccess/WireGuardTunnelBridge.java | 64 ----- .../vpn/AndroidCastVpnService.java | 180 +++++++++++++ .../RemoteAccessVpnService.java | 12 +- .../androidcast/vpn/VpnCrashSimulator.java | 40 +++ .../androidcast/vpn/VpnServiceClient.java | 241 ++++++++++++++++++ .../com/foxx/androidcast/vpn/VpnState.java | 11 + .../androidcast/vpn/WireGuardVpnEngine.java | 58 +++++ .../crash/CrashReporterProcessTest.java | 17 ++ .../WireGuardConfigParseTest.java | 34 +++ .../foxx/androidcast/vpn/VpnStateTest.java | 15 ++ docs/BUILD_DEPLOY.md | 11 + docs/REMOTE_ACCESS_IMPL.md | 22 +- docs/drafts/20100611_1_net_obfuscation.txt | 6 + .../20100611_1_net_topology_glossary.txt | 12 + .../20100611_2_av_conversion_and_non_rt.txt | 17 ++ .../backend/THIRD_PARTY_LICENSES.md | 2 +- gradle.properties | 2 + gradle/wrapper/gradle-wrapper.jar | Bin 43504 -> 0 bytes gradle/wrapper/gradle-wrapper.properties | 7 - ndk/README.md | 7 +- rebuild.sh | 8 +- scripts/build-native-codecs.sh | 8 +- scripts/ci-build-and-publish-ota.sh | 17 +- scripts/ci-build.sh | 9 +- scripts/init-third-party-submodules.sh | 110 ++++++++ scripts/init-wireguard-submodule.sh | 35 +-- scripts/simulate-vpn-crashes.sh | 196 ++++++++++++++ settings.gradle | 13 +- third-party/README.md | 14 +- 43 files changed, 1185 insertions(+), 181 deletions(-) create mode 100644 .cursor/rules/bottomline-reminder.mdc create mode 100644 app/src/main/aidl/com/foxx/androidcast/IVpnOperationCallback.aidl create mode 100644 app/src/main/aidl/com/foxx/androidcast/IVpnService.aidl create mode 100644 app/src/main/aidl/com/foxx/androidcast/IVpnStateCallback.aidl delete mode 100644 app/src/main/java/com/foxx/androidcast/remoteaccess/WireGuardTunnelBridge.java create mode 100644 app/src/main/java/com/foxx/androidcast/vpn/AndroidCastVpnService.java rename app/src/main/java/com/foxx/androidcast/{remoteaccess => vpn}/RemoteAccessVpnService.java (94%) create mode 100644 app/src/main/java/com/foxx/androidcast/vpn/VpnCrashSimulator.java create mode 100644 app/src/main/java/com/foxx/androidcast/vpn/VpnServiceClient.java create mode 100644 app/src/main/java/com/foxx/androidcast/vpn/VpnState.java create mode 100644 app/src/main/java/com/foxx/androidcast/vpn/WireGuardVpnEngine.java create mode 100644 app/src/test/java/com/foxx/androidcast/crash/CrashReporterProcessTest.java create mode 100644 app/src/test/java/com/foxx/androidcast/remoteaccess/WireGuardConfigParseTest.java create mode 100644 app/src/test/java/com/foxx/androidcast/vpn/VpnStateTest.java create mode 100644 docs/drafts/20100611_1_net_obfuscation.txt create mode 100644 docs/drafts/20100611_1_net_topology_glossary.txt create mode 100644 docs/drafts/20100611_2_av_conversion_and_non_rt.txt delete mode 100644 gradle/wrapper/gradle-wrapper.jar delete mode 100644 gradle/wrapper/gradle-wrapper.properties create mode 100755 scripts/init-third-party-submodules.sh create mode 100755 scripts/simulate-vpn-crashes.sh diff --git a/.cursor/rules/bottomline-reminder.mdc b/.cursor/rules/bottomline-reminder.mdc new file mode 100644 index 0000000..7b31976 --- /dev/null +++ b/.cursor/rules/bottomline-reminder.mdc @@ -0,0 +1,14 @@ +--- +description: Re-read bottomline_reminder.txt when owner requests implement/create/document work +alwaysApply: true +--- + +# Bottomline reminder (owner tasks) + +When the **project owner** asks you to **implement**, **create**, or **document** something: + +1. **Re-read** [bottomline_reminder.txt](bottomline_reminder.txt) at the start of that work (docs templates, alpha must-haves, UI themes/fonts, licenses, tests, buildability, task graph, submodules, atomic commits on `next`, infra safety, help_request PDFs). +2. Apply its bullets for the session unless the owner explicitly overrides. +3. Keep [third-party/](third-party/) submodules consistent (`.gitmodules`, mobile + BE licenses, Gitea mirrors, init scripts). + +Do not skip this read step when switching from Q&A to implementation. diff --git a/.gitignore b/.gitignore index 2abaf1e..59396d6 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ *.iml .gradle/ +gradle/ /local.properties /.idea/ /build/ diff --git a/app/build.gradle b/app/build.gradle index b689be9..62faccc 100644 --- a/app/build.gradle +++ b/app/build.gradle @@ -110,6 +110,12 @@ android { buildConfig true } + packaging { + resources { + excludes += '/META-INF/versions/9/OSGI-INF/MANIFEST.MF' + } + } + testOptions { unitTests { includeAndroidResources = true @@ -133,7 +139,5 @@ dependencies { implementation 'com.github.mwiede:jsch:0.2.21' - if (project.findProject(':tunnel') != null) { - implementation project(':tunnel') - } + implementation project(':tunnel') } diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml index 80d94ad..6fd2132 100644 --- a/app/src/main/AndroidManifest.xml +++ b/app/src/main/AndroidManifest.xml @@ -1,5 +1,6 @@ - + @@ -133,9 +134,16 @@ android:exported="false" android:foregroundServiceType="connectedDevice" /> + + + @@ -143,6 +151,17 @@ + + + + + + diff --git a/app/src/main/aidl/com/foxx/androidcast/IVpnOperationCallback.aidl b/app/src/main/aidl/com/foxx/androidcast/IVpnOperationCallback.aidl new file mode 100644 index 0000000..f386ade --- /dev/null +++ b/app/src/main/aidl/com/foxx/androidcast/IVpnOperationCallback.aidl @@ -0,0 +1,7 @@ +package com.foxx.androidcast; + +/** One-shot result for apply / tearDown. */ +interface IVpnOperationCallback { + oneway void onSuccess(); + oneway void onFailure(String reason); +} diff --git a/app/src/main/aidl/com/foxx/androidcast/IVpnService.aidl b/app/src/main/aidl/com/foxx/androidcast/IVpnService.aidl new file mode 100644 index 0000000..fa2e1b4 --- /dev/null +++ b/app/src/main/aidl/com/foxx/androidcast/IVpnService.aidl @@ -0,0 +1,19 @@ +package com.foxx.androidcast; + +import com.foxx.androidcast.IVpnOperationCallback; +import com.foxx.androidcast.IVpnStateCallback; + +/** + * Standalone VPN control plane (process com.foxx.androidcast:vpn). + * WireGuard userspace + TUN fallback run only in the VPN process. + */ +interface IVpnService { + void registerStateCallback(IVpnStateCallback callback); + void unregisterStateCallback(IVpnStateCallback callback); + int getState(); + boolean isVpnPermissionGranted(); + void applyWireGuardConfig(String wgQuickConfig, IVpnOperationCallback callback); + void tearDown(IVpnOperationCallback callback); + /** Debug/lab only — records a synthetic crash from the VPN process (no process kill). */ + void simulateCrashForTest(int sequence, IVpnOperationCallback callback); +} diff --git a/app/src/main/aidl/com/foxx/androidcast/IVpnStateCallback.aidl b/app/src/main/aidl/com/foxx/androidcast/IVpnStateCallback.aidl new file mode 100644 index 0000000..5db1bdf --- /dev/null +++ b/app/src/main/aidl/com/foxx/androidcast/IVpnStateCallback.aidl @@ -0,0 +1,6 @@ +package com.foxx.androidcast; + +/** Async VPN state updates from the :vpn process. */ +interface IVpnStateCallback { + oneway void onStateChanged(int state, String detail); +} diff --git a/app/src/main/assets/licenses/combined.html b/app/src/main/assets/licenses/combined.html index 86b2271..f9d8c6e 100644 --- a/app/src/main/assets/licenses/combined.html +++ b/app/src/main/assets/licenses/combined.html @@ -32,5 +32,5 @@
  • Speex — Revised BSD license (Xiph.org Foundation). See third-party/speex/COPYING.
    • -

    WireGuard tunnel module (optional Gradle module)

    -

    When third-party/wireguard-android is initialized and the :tunnel module is included, the app may link the WireGuard Android tunnel library (Apache License 2.0; see upstream wireguard-android). Remote access still uses Android VpnService (system VPN permission).

    +

    WireGuard tunnel module (third-party/wireguard-android)

    +

    The app links the WireGuard Android tunnel library from git submodule third-party/wireguard-android (Apache License 2.0; see upstream COPYING and https://git.zx2c4.com/wireguard-android). WireGuard lab mode uses Android VpnService (system VPN permission) via GoBackend.

    diff --git a/app/src/main/java/com/foxx/androidcast/AndroidCastApplication.java b/app/src/main/java/com/foxx/androidcast/AndroidCastApplication.java index 91e4045..f6c03eb 100644 --- a/app/src/main/java/com/foxx/androidcast/AndroidCastApplication.java +++ b/app/src/main/java/com/foxx/androidcast/AndroidCastApplication.java @@ -32,10 +32,13 @@ public class AndroidCastApplication extends Application { @Override public void onCreate() { super.onCreate(); + CrashReporter.install(this); + if (!CrashReporter.isMainProcess(this, CrashReporter.currentProcessName())) { + return; + } CodecPriorityCatalog.init(this); CastLocaleHelper.applyStoredLocale(this); CastThemeHelper.applyNightMode(this); - CrashReporter.install(this); ReceiverAvRuntime.reload(this); CastTransportFactory.init(this); WiredDisplayMonitor.getInstance(this).ensureRegistered(); diff --git a/app/src/main/java/com/foxx/androidcast/crash/CrashReporter.java b/app/src/main/java/com/foxx/androidcast/crash/CrashReporter.java index afc8087..02f0114 100644 --- a/app/src/main/java/com/foxx/androidcast/crash/CrashReporter.java +++ b/app/src/main/java/com/foxx/androidcast/crash/CrashReporter.java @@ -1,16 +1,5 @@ package com.foxx.androidcast.crash; -/********************************************************************* - * CrashReporter.java - * Created at: Wed 20 May 2026 14:31:55 +0200 - * Updated at: Wed 20 May 2026 15:17:13 +0200 by Anton Afanasyeu - * Commit: 5d8e82d2e60a21fff3138d2a394ee4e8b4c6dcb8 - * class CrashReporter - * Contributors: - * - Anton Afanasyeu (2 commits, 89 lines) - * - Cursor Agent (project assistant) - * Digest: SHA256 5254fee83476d4a80db718169cbc13b61b18697148a8625baab8df0833b1d78f -**********************************************************************/ import android.app.Application; import android.content.Context; import android.util.Log; @@ -21,19 +10,29 @@ import org.json.JSONObject; import java.io.File; -/** Main-process entry: write pending crash JSON and wake the watcher process. */ +/** + * Crash capture for main and monitored isolated processes ({@code :vpn}, {@code :netselftest}). + * Persists JSON to shared app storage and wakes {@link CrashWatcherService}. + */ public final class CrashReporter { private static final String TAG = "CrashReporter"; private CrashReporter() {} + /** Install handlers appropriate for the current process. */ public static void install(Context context) { Context app = context.getApplicationContext(); - if (!isMainProcess(app)) { - return; + String proc = currentProcessName(); + if (isMainProcess(app, proc)) { + installMainProcess(app); + } else if (isMonitoredIsolatedProcess(proc)) { + installIsolatedProcess(app); } - if (app instanceof android.app.Application) { - CrashRuntimeContext.init((android.app.Application) app); + } + + private static void installMainProcess(Context app) { + if (app instanceof Application) { + CrashRuntimeContext.init((Application) app); } CrashNativeBridge.init(app); final Thread.UncaughtExceptionHandler previous = @@ -55,6 +54,25 @@ public final class CrashReporter { CrashWatcherService.scheduleUploadSweep(app); } + private static void installIsolatedProcess(Context app) { + CrashNativeBridge.init(app); + final Thread.UncaughtExceptionHandler previous = + Thread.getDefaultUncaughtExceptionHandler(); + Thread.setDefaultUncaughtExceptionHandler((thread, throwable) -> { + try { + recordJavaCrash(app, thread, throwable); + } catch (Throwable t) { + Log.e(TAG, "isolated recordJavaCrash failed", t); + } + if (previous != null) { + previous.uncaughtException(thread, throwable); + } else { + System.exit(10); + } + }); + Log.i(TAG, "crash capture enabled in " + currentProcessName()); + } + public static void recordJavaCrash(Context context, Thread thread, Throwable throwable) { if (!CrashSettingsStore.load(context).enabled) { return; @@ -95,7 +113,22 @@ public final class CrashReporter { CrashWatcherService.requestImmediateSweep(context, true); } - private static boolean isMainProcess(Context context) { - return context.getPackageName().equals(Application.getProcessName()); + public static boolean isMainProcess(Context context, String procName) { + return context.getPackageName().equals(procName); + } + + public static boolean isMonitoredIsolatedProcess(String procName) { + if (procName == null || procName.isEmpty()) { + return false; + } + return procName.endsWith(":vpn") || procName.endsWith(":netselftest"); + } + + public static String currentProcessName() { + try { + return Application.getProcessName(); + } catch (Exception e) { + return ""; + } } } diff --git a/app/src/main/java/com/foxx/androidcast/crash/CrashRuntimeContext.java b/app/src/main/java/com/foxx/androidcast/crash/CrashRuntimeContext.java index 1f23f83..f27f183 100644 --- a/app/src/main/java/com/foxx/androidcast/crash/CrashRuntimeContext.java +++ b/app/src/main/java/com/foxx/androidcast/crash/CrashRuntimeContext.java @@ -88,6 +88,13 @@ public final class CrashRuntimeContext { } public static String scenarioLabel() { + String proc = CrashReporter.currentProcessName(); + if (proc != null && proc.endsWith(":vpn")) { + return "vpn_service"; + } + if (proc != null && proc.endsWith(":netselftest")) { + return "net_selftest"; + } if (SessionStatsContext.get() != null || isCastSessionActive()) { return "cast_session"; } diff --git a/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessCoordinator.java b/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessCoordinator.java index acb4139..feb40cb 100644 --- a/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessCoordinator.java +++ b/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessCoordinator.java @@ -4,6 +4,7 @@ import android.content.Context; import android.util.Log; import com.foxx.androidcast.AppPreferences; +import com.foxx.androidcast.vpn.VpnServiceClient; /** Start/stop remote access foreground polling + VPN based on developer mode. */ public final class RemoteAccessCoordinator { @@ -17,7 +18,7 @@ public final class RemoteAccessCoordinator { Log.i(TAG, "disabling remote access"); RemoteAccessService.sendDisableOnce(app); RemoteAccessService.stop(app); - RemoteAccessVpnService.stop(app); + VpnServiceClient.get(app).tearDown(); AppPreferences.clearDevRemoteAccessSession(app); return; } diff --git a/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessService.java b/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessService.java index 0d13f85..bc287e3 100644 --- a/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessService.java +++ b/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessService.java @@ -19,6 +19,7 @@ import com.foxx.androidcast.AppPreferences; import com.foxx.androidcast.DeveloperSettingsActivity; import com.foxx.androidcast.DeviceInfo; import com.foxx.androidcast.R; +import com.foxx.androidcast.vpn.VpnServiceClient; import org.json.JSONArray; import org.json.JSONObject; @@ -185,20 +186,29 @@ public final class RemoteAccessService extends Service { if (creds == null) { return; } - boolean ok = false; if ("wireguard".equals(tunnel)) { String wgConfig = WireGuardConfigBuilder.fromConnectCredentials(creds); - if (!wgConfig.isEmpty()) { - ok = WireGuardTunnelBridge.applyConfig(this, wgConfig); + if (wgConfig.isEmpty()) { + return; } + final String sid = sessionId; + VpnServiceClient.get(this).applyWireGuardConfig(wgConfig, new VpnServiceClient.OperationListener() { + @Override + public void onSuccess() { + updateNotificationConnected(sid, tunnel); + } + + @Override + public void onFailure(String reason) { + Log.w(TAG, "wireguard connect failed: " + reason); + } + }); } else if ("ssh_reverse".equals(tunnel)) { - ok = ReverseSshTunnelBridge.applyConfig(this, creds); + if (ReverseSshTunnelBridge.applyConfig(this, creds)) { + updateNotificationConnected(sessionId, tunnel); + } } else { Log.w(TAG, "unsupported tunnel in connect: " + tunnel); - return; - } - if (ok) { - updateNotificationConnected(sessionId, tunnel); } } diff --git a/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessTunnelHelper.java b/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessTunnelHelper.java index 220258e..1ff9d6c 100644 --- a/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessTunnelHelper.java +++ b/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessTunnelHelper.java @@ -2,12 +2,14 @@ package com.foxx.androidcast.remoteaccess; import android.content.Context; +import com.foxx.androidcast.vpn.VpnServiceClient; + /** Tear down all remote-access transports (WireGuard + RSSH). */ public final class RemoteAccessTunnelHelper { private RemoteAccessTunnelHelper() {} public static void tearDownAll(Context context) { - WireGuardTunnelBridge.tearDown(context); + VpnServiceClient.get(context).tearDown(); ReverseSshTunnelBridge.tearDown(context); } } diff --git a/app/src/main/java/com/foxx/androidcast/remoteaccess/WireGuardTunnelBridge.java b/app/src/main/java/com/foxx/androidcast/remoteaccess/WireGuardTunnelBridge.java deleted file mode 100644 index fe07e77..0000000 --- a/app/src/main/java/com/foxx/androidcast/remoteaccess/WireGuardTunnelBridge.java +++ /dev/null @@ -1,64 +0,0 @@ -package com.foxx.androidcast.remoteaccess; - -import android.content.Context; -import android.util.Log; - -/** - * Optional integration with wireguard-android tunnel module (third-party/wireguard-android). - * Falls back to {@link RemoteAccessVpnService} TUN setup when module is absent. - */ -public final class WireGuardTunnelBridge { - private static final String TAG = "WGTunnelBridge"; - - private WireGuardTunnelBridge() {} - - public static boolean applyConfig(Context context, String wgQuickConfig) { - if (wgQuickConfig == null || wgQuickConfig.trim().isEmpty()) { - return false; - } - try { - Class configClass = Class.forName("com.wireguard.config.Config"); - Object config = configClass.getMethod("parse", String.class).invoke(null, wgQuickConfig); - Class goBackendClass = Class.forName("com.wireguard.android.backend.GoBackend"); - Object backend = goBackendClass.getConstructor(Context.class).newInstance(context); - Class tunnelClass = Class.forName("com.wireguard.android.backend.Tunnel"); - Object tunnel = proxyTunnel(tunnelClass); - Class stateClass = Class.forName("com.wireguard.android.backend.Tunnel$State"); - Object up = enumConstant(stateClass, "UP"); - goBackendClass.getMethod("setState", tunnelClass, stateClass, configClass) - .invoke(backend, tunnel, up, config); - Log.i(TAG, "wireguard tunnel UP via GoBackend"); - return true; - } catch (Throwable t) { - Log.i(TAG, "GoBackend unavailable, using VpnService fallback: " + t.getClass().getSimpleName()); - return RemoteAccessVpnService.startWithConfig(context, wgQuickConfig); - } - } - - public static void tearDown(Context context) { - RemoteAccessVpnService.stop(context); - try { - Class goBackendClass = Class.forName("com.wireguard.android.backend.GoBackend"); - Object backend = goBackendClass.getConstructor(Context.class).newInstance(context); - Class tunnelClass = Class.forName("com.wireguard.android.backend.Tunnel"); - Object tunnel = proxyTunnel(tunnelClass); - Class stateClass = Class.forName("com.wireguard.android.backend.Tunnel$State"); - Object down = enumConstant(stateClass, "DOWN"); - goBackendClass.getMethod("setState", tunnelClass, stateClass, Class.forName("com.wireguard.config.Config")) - .invoke(backend, tunnel, down, null); - } catch (Throwable ignored) { - } - } - - private static Object proxyTunnel(Class tunnelClass) { - return java.lang.reflect.Proxy.newProxyInstance( - tunnelClass.getClassLoader(), - new Class[]{tunnelClass}, - (proxy, method, args) -> "getName".equals(method.getName()) ? "androidcast-ra" : null); - } - - @SuppressWarnings({"unchecked", "rawtypes"}) - private static Object enumConstant(Class stateClass, String name) { - return Enum.valueOf((Class) stateClass, name); - } -} diff --git a/app/src/main/java/com/foxx/androidcast/vpn/AndroidCastVpnService.java b/app/src/main/java/com/foxx/androidcast/vpn/AndroidCastVpnService.java new file mode 100644 index 0000000..fe377dc --- /dev/null +++ b/app/src/main/java/com/foxx/androidcast/vpn/AndroidCastVpnService.java @@ -0,0 +1,180 @@ +package com.foxx.androidcast.vpn; + +import android.app.Service; +import android.content.Intent; +import android.net.VpnService; +import android.os.Handler; +import android.os.HandlerThread; +import android.os.IBinder; +import android.os.RemoteCallbackList; +import android.os.RemoteException; +import android.util.Log; + +import com.foxx.androidcast.IVpnOperationCallback; +import com.foxx.androidcast.IVpnService; +import com.foxx.androidcast.IVpnStateCallback; + +/** + * Standalone VPN process ({@code com.foxx.androidcast:vpn}) — AIDL control plane for WireGuard. + */ +public final class AndroidCastVpnService extends Service { + private static final String TAG = "AndroidCastVpn"; + /** Debug/lab: record synthetic VPN-process crash (see scripts/simulate-vpn-crashes.sh). */ + public static final String ACTION_SIMULATE_CRASH = "com.foxx.androidcast.vpn.SIMULATE_CRASH"; + public static final String EXTRA_SIM_SEQ = "sim_seq"; + + private final RemoteCallbackList stateCallbacks = new RemoteCallbackList<>(); + private final Object stateLock = new Object(); + private volatile int state = VpnState.DOWN; + private volatile String stateDetail = ""; + + private HandlerThread workerThread; + private Handler worker; + + private final IVpnService.Stub binder = new IVpnService.Stub() { + @Override + public void registerStateCallback(IVpnStateCallback callback) { + if (callback != null) { + stateCallbacks.register(callback); + } + } + + @Override + public void unregisterStateCallback(IVpnStateCallback callback) { + if (callback != null) { + stateCallbacks.unregister(callback); + } + } + + @Override + public int getState() { + return state; + } + + @Override + public boolean isVpnPermissionGranted() { + return VpnService.prepare(AndroidCastVpnService.this) == null; + } + + @Override + public void applyWireGuardConfig(String wgQuickConfig, IVpnOperationCallback callback) { + ensureWorker(); + setState(VpnState.CONNECTING, "applying wireguard config"); + worker.post(() -> { + boolean ok = WireGuardVpnEngine.apply(getApplicationContext(), wgQuickConfig); + if (ok) { + setState(VpnState.UP, "wireguard tunnel up"); + notifyOperation(callback, true, null); + } else { + setState(VpnState.ERROR, "wireguard apply failed"); + notifyOperation(callback, false, "apply failed or VPN permission missing"); + } + }); + } + + @Override + public void tearDown(IVpnOperationCallback callback) { + ensureWorker(); + worker.post(() -> { + WireGuardVpnEngine.tearDown(getApplicationContext()); + setState(VpnState.DOWN, "tunnel down"); + notifyOperation(callback, true, null); + }); + } + + @Override + public void simulateCrashForTest(int sequence, IVpnOperationCallback callback) { + ensureWorker(); + worker.post(() -> { + boolean ok = VpnCrashSimulator.recordSimulatedCrash(getApplicationContext(), sequence); + if (ok) { + notifyOperation(callback, true, null); + } else { + notifyOperation(callback, false, "simulate only in debug builds"); + } + }); + } + }; + + @Override + public void onCreate() { + super.onCreate(); + Log.i(TAG, "VPN process service created"); + } + + @Override + public IBinder onBind(Intent intent) { + return binder; + } + + @Override + public int onStartCommand(Intent intent, int flags, int startId) { + if (intent != null && ACTION_SIMULATE_CRASH.equals(intent.getAction())) { + int seq = intent.getIntExtra(EXTRA_SIM_SEQ, 0); + ensureWorker(); + worker.post(() -> { + VpnCrashSimulator.recordSimulatedCrash(getApplicationContext(), seq); + stopSelf(startId); + }); + return START_NOT_STICKY; + } + return START_STICKY; + } + + @Override + public void onDestroy() { + if (workerThread != null) { + workerThread.quitSafely(); + workerThread = null; + worker = null; + } + WireGuardVpnEngine.tearDown(getApplicationContext()); + super.onDestroy(); + } + + private void ensureWorker() { + if (worker != null) { + return; + } + workerThread = new HandlerThread("androidcast-vpn-worker"); + workerThread.start(); + worker = new Handler(workerThread.getLooper()); + } + + private void setState(int newState, String detail) { + synchronized (stateLock) { + state = newState; + stateDetail = detail != null ? detail : ""; + } + broadcastState(newState, stateDetail); + } + + private void broadcastState(int newState, String detail) { + int n = stateCallbacks.beginBroadcast(); + try { + for (int i = 0; i < n; i++) { + try { + stateCallbacks.getBroadcastItem(i).onStateChanged(newState, detail); + } catch (RemoteException ignored) { + } + } + } finally { + stateCallbacks.finishBroadcast(); + } + } + + private static void notifyOperation(IVpnOperationCallback callback, boolean ok, String reason) { + if (callback == null) { + return; + } + try { + if (ok) { + callback.onSuccess(); + } else { + callback.onFailure(reason != null ? reason : "error"); + } + } catch (RemoteException e) { + Log.w(TAG, "operation callback died: " + e.getMessage()); + } + } +} diff --git a/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessVpnService.java b/app/src/main/java/com/foxx/androidcast/vpn/RemoteAccessVpnService.java similarity index 94% rename from app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessVpnService.java rename to app/src/main/java/com/foxx/androidcast/vpn/RemoteAccessVpnService.java index 4192593..1e7af54 100644 --- a/app/src/main/java/com/foxx/androidcast/remoteaccess/RemoteAccessVpnService.java +++ b/app/src/main/java/com/foxx/androidcast/vpn/RemoteAccessVpnService.java @@ -1,4 +1,4 @@ -package com.foxx.androidcast.remoteaccess; +package com.foxx.androidcast.vpn; import android.app.Notification; import android.app.NotificationChannel; @@ -18,14 +18,15 @@ import com.foxx.androidcast.DeveloperSettingsActivity; import com.foxx.androidcast.R; import java.net.InetAddress; +import java.util.ArrayList; import java.util.regex.Matcher; import java.util.regex.Pattern; -/** Holds WireGuard TUN when tunnel module is not linked; also prepares interface for userspace WG. */ +/** TUN fallback when GoBackend cannot start — runs in :vpn process only. */ public final class RemoteAccessVpnService extends VpnService { private static final String TAG = "RemoteAccessVPN"; - public static final String ACTION_UP = "com.foxx.androidcast.remoteaccess.VPN_UP"; - public static final String ACTION_DOWN = "com.foxx.androidcast.remoteaccess.VPN_DOWN"; + public static final String ACTION_UP = "com.foxx.androidcast.vpn.VPN_UP"; + public static final String ACTION_DOWN = "com.foxx.androidcast.vpn.VPN_DOWN"; public static final String EXTRA_WG_CONFIG = "wg_config"; private static final int NOTIF_ID = 0x7a01; @@ -108,7 +109,6 @@ public final class RemoteAccessVpnService extends VpnService { return m.find() ? m.group(1).trim() : null; } - /** Routes from AllowedIPs= lines (split tunnel — typically server wg /32). */ private static String[] parseAllowedRoutes(String wgConfig) { if (wgConfig == null) { return new String[0]; @@ -118,7 +118,7 @@ public final class RemoteAccessVpnService extends VpnService { return new String[0]; } String[] parts = m.group(1).trim().split("\\s*,\\s*"); - java.util.ArrayList out = new java.util.ArrayList<>(); + ArrayList out = new ArrayList<>(); for (String p : parts) { if (!p.isEmpty()) { out.add(p.trim()); diff --git a/app/src/main/java/com/foxx/androidcast/vpn/VpnCrashSimulator.java b/app/src/main/java/com/foxx/androidcast/vpn/VpnCrashSimulator.java new file mode 100644 index 0000000..529ca00 --- /dev/null +++ b/app/src/main/java/com/foxx/androidcast/vpn/VpnCrashSimulator.java @@ -0,0 +1,40 @@ +package com.foxx.androidcast.vpn; + +import android.content.Context; + +import com.foxx.androidcast.BuildConfig; +import com.foxx.androidcast.crash.CrashReporter; +import com.foxx.androidcast.crash.CrashWatcherService; + +/** + * Records synthetic Java crashes from the VPN process for lab validation (debug builds only). + * Does not kill the process — exercises persist + watcher upload path. + */ +public final class VpnCrashSimulator { + private VpnCrashSimulator() {} + + public static boolean recordSimulatedCrash(Context context, int sequence) { + if (!BuildConfig.DEBUG) { + return false; + } + RuntimeException ex = new RuntimeException( + "VpnCrashSimulation seq=" + sequence + " proc=" + CrashReporter.currentProcessName()); + ex.setStackTrace(buildStack(sequence)); + CrashReporter.recordJavaCrash(context, Thread.currentThread(), ex); + CrashWatcherService.requestImmediateSweep(context.getApplicationContext(), true); + return true; + } + + private static StackTraceElement[] buildStack(int sequence) { + return new StackTraceElement[]{ + new StackTraceElement("com.foxx.androidcast.vpn.WireGuardVpnEngine", "apply", + "WireGuardVpnEngine.java", 40 + (sequence % 5)), + new StackTraceElement("com.foxx.androidcast.vpn.AndroidCastVpnService$1", "applyWireGuardConfig", + "AndroidCastVpnService.java", 60), + new StackTraceElement("com.foxx.androidcast.vpn.AndroidCastVpnService", "onStartCommand", + "AndroidCastVpnService.java", 95 + (sequence % 3)), + new StackTraceElement("android.app.ActivityThread", "handleServiceArgs", + "ActivityThread.java", 5001), + }; + } +} diff --git a/app/src/main/java/com/foxx/androidcast/vpn/VpnServiceClient.java b/app/src/main/java/com/foxx/androidcast/vpn/VpnServiceClient.java new file mode 100644 index 0000000..b00802d --- /dev/null +++ b/app/src/main/java/com/foxx/androidcast/vpn/VpnServiceClient.java @@ -0,0 +1,241 @@ +package com.foxx.androidcast.vpn; + +import android.content.ComponentName; +import android.content.Context; +import android.content.Intent; +import android.content.ServiceConnection; +import android.os.Handler; +import android.os.IBinder; +import android.os.Looper; +import android.os.RemoteException; +import android.util.Log; + +import com.foxx.androidcast.IVpnOperationCallback; +import com.foxx.androidcast.IVpnService; +import com.foxx.androidcast.IVpnStateCallback; + +import java.util.ArrayList; +import java.util.List; +import java.util.concurrent.CountDownLatch; +import java.util.concurrent.TimeUnit; +import java.util.concurrent.atomic.AtomicBoolean; + +/** + * Main-process client for {@link AndroidCastVpnService} ({@code com.foxx.androidcast:vpn}). + */ +public final class VpnServiceClient { + private static final String TAG = "VpnServiceClient"; + private static final long BIND_TIMEOUT_MS = 8_000L; + + private static volatile VpnServiceClient instance; + + private final Context appContext; + private final Handler main = new Handler(Looper.getMainLooper()); + private final Object bindLock = new Object(); + private final List pending = new ArrayList<>(); + + private IVpnService service; + private boolean binding; + private CountDownLatch bindLatch; + + public interface StateListener { + void onStateChanged(int state, String detail); + } + + public interface OperationListener { + void onSuccess(); + + void onFailure(String reason); + } + + private VpnServiceClient(Context context) { + appContext = context.getApplicationContext(); + } + + public static VpnServiceClient get(Context context) { + if (instance == null) { + synchronized (VpnServiceClient.class) { + if (instance == null) { + instance = new VpnServiceClient(context); + } + } + } + return instance; + } + + private final ServiceConnection connection = new ServiceConnection() { + @Override + public void onServiceConnected(ComponentName name, IBinder binder) { + synchronized (bindLock) { + service = IVpnService.Stub.asInterface(binder); + binding = false; + if (bindLatch != null) { + bindLatch.countDown(); + } + } + flushPending(); + } + + @Override + public void onServiceDisconnected(ComponentName name) { + synchronized (bindLock) { + service = null; + binding = false; + } + } + }; + + public boolean isVpnPermissionGranted() { + if (!ensureBoundSync()) { + return false; + } + try { + return service.isVpnPermissionGranted(); + } catch (RemoteException e) { + Log.w(TAG, "isVpnPermissionGranted: " + e.getMessage()); + return false; + } + } + + public int getState() { + if (!ensureBoundSync()) { + return VpnState.DOWN; + } + try { + return service.getState(); + } catch (RemoteException e) { + return VpnState.DOWN; + } + } + + public void registerStateListener(StateListener listener) { + runWithService(s -> { + IVpnStateCallback cb = new IVpnStateCallback.Stub() { + @Override + public void onStateChanged(int state, String detail) { + main.post(() -> listener.onStateChanged(state, detail)); + } + }; + s.registerStateCallback(cb); + }); + } + + public void applyWireGuardConfig(String wgQuickConfig, OperationListener listener) { + runWithService(s -> { + try { + s.applyWireGuardConfig(wgQuickConfig, wrapOperation(listener)); + } catch (RemoteException e) { + deliverOperation(listener, false, e.getMessage()); + } + }); + } + + public void tearDown(OperationListener listener) { + runWithService(s -> { + try { + s.tearDown(wrapOperation(listener)); + } catch (RemoteException e) { + deliverOperation(listener, false, e.getMessage()); + } + }); + } + + public void tearDown() { + tearDown(null); + } + + private IVpnOperationCallback wrapOperation(OperationListener listener) { + return new IVpnOperationCallback.Stub() { + @Override + public void onSuccess() { + deliverOperation(listener, true, null); + } + + @Override + public void onFailure(String reason) { + deliverOperation(listener, false, reason); + } + }; + } + + private void deliverOperation(OperationListener listener, boolean ok, String reason) { + if (listener == null) { + return; + } + main.post(() -> { + if (ok) { + listener.onSuccess(); + } else { + listener.onFailure(reason != null ? reason : "error"); + } + }); + } + + private interface ServiceTask { + void run(IVpnService s) throws RemoteException; + } + + private void runWithService(ServiceTask task) { + IVpnService s = service; + if (s != null) { + try { + task.run(s); + } catch (RemoteException e) { + Log.w(TAG, "remote call failed: " + e.getMessage()); + } + return; + } + synchronized (bindLock) { + pending.add(() -> runWithService(task)); + } + ensureBoundAsync(); + } + + private void flushPending() { + List copy; + synchronized (bindLock) { + copy = new ArrayList<>(pending); + pending.clear(); + } + for (Runnable r : copy) { + r.run(); + } + } + + private void ensureBoundAsync() { + synchronized (bindLock) { + if (service != null || binding) { + return; + } + binding = true; + Intent i = new Intent(appContext, AndroidCastVpnService.class); + appContext.startService(i); + appContext.bindService(i, connection, Context.BIND_AUTO_CREATE); + } + } + + private boolean ensureBoundSync() { + if (service != null) { + return true; + } + synchronized (bindLock) { + if (service != null) { + return true; + } + bindLatch = new CountDownLatch(1); + ensureBoundAsync(); + try { + if (!bindLatch.await(BIND_TIMEOUT_MS, TimeUnit.MILLISECONDS)) { + Log.w(TAG, "VPN service bind timeout"); + return false; + } + } catch (InterruptedException e) { + Thread.currentThread().interrupt(); + return false; + } finally { + bindLatch = null; + } + } + return service != null; + } +} diff --git a/app/src/main/java/com/foxx/androidcast/vpn/VpnState.java b/app/src/main/java/com/foxx/androidcast/vpn/VpnState.java new file mode 100644 index 0000000..e14cb10 --- /dev/null +++ b/app/src/main/java/com/foxx/androidcast/vpn/VpnState.java @@ -0,0 +1,11 @@ +package com.foxx.androidcast.vpn; + +/** VPN state codes shared across AIDL ({@link com.foxx.androidcast.IVpnService}). */ +public final class VpnState { + public static final int DOWN = 0; + public static final int CONNECTING = 1; + public static final int UP = 2; + public static final int ERROR = 3; + + private VpnState() {} +} diff --git a/app/src/main/java/com/foxx/androidcast/vpn/WireGuardVpnEngine.java b/app/src/main/java/com/foxx/androidcast/vpn/WireGuardVpnEngine.java new file mode 100644 index 0000000..4c2099e --- /dev/null +++ b/app/src/main/java/com/foxx/androidcast/vpn/WireGuardVpnEngine.java @@ -0,0 +1,58 @@ +package com.foxx.androidcast.vpn; + +import android.content.Context; +import android.util.Log; + +import com.wireguard.android.backend.GoBackend; +import com.wireguard.android.backend.Tunnel; +import com.wireguard.config.Config; + +import java.io.ByteArrayInputStream; +import java.nio.charset.StandardCharsets; + +/** WireGuard tunnel control inside the :vpn process only. */ +final class WireGuardVpnEngine { + private static final String TAG = "WireGuardVpnEngine"; + private static final Tunnel ANDROID_CAST_TUNNEL = new Tunnel() { + @Override + public String getName() { + return "androidcast-ra"; + } + + @Override + public void onStateChange(State newState) { + Log.d(TAG, "tunnel state " + newState); + } + }; + + private WireGuardVpnEngine() {} + + static boolean apply(Context context, String wgQuickConfig) { + if (wgQuickConfig == null || wgQuickConfig.trim().isEmpty()) { + return false; + } + try { + Config config; + try (ByteArrayInputStream in = new ByteArrayInputStream( + wgQuickConfig.getBytes(StandardCharsets.UTF_8))) { + config = Config.parse(in); + } + GoBackend backend = new GoBackend(context); + backend.setState(ANDROID_CAST_TUNNEL, Tunnel.State.UP, config); + Log.i(TAG, "wireguard UP via GoBackend"); + return true; + } catch (Throwable t) { + Log.w(TAG, "GoBackend failed, TUN fallback: " + t.getMessage()); + return RemoteAccessVpnService.startWithConfig(context, wgQuickConfig); + } + } + + static void tearDown(Context context) { + RemoteAccessVpnService.stop(context); + try { + GoBackend backend = new GoBackend(context); + backend.setState(ANDROID_CAST_TUNNEL, Tunnel.State.DOWN, null); + } catch (Throwable ignored) { + } + } +} diff --git a/app/src/test/java/com/foxx/androidcast/crash/CrashReporterProcessTest.java b/app/src/test/java/com/foxx/androidcast/crash/CrashReporterProcessTest.java new file mode 100644 index 0000000..94ea63b --- /dev/null +++ b/app/src/test/java/com/foxx/androidcast/crash/CrashReporterProcessTest.java @@ -0,0 +1,17 @@ +package com.foxx.androidcast.crash; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +import org.junit.Test; + +public class CrashReporterProcessTest { + + @Test + public void isMonitoredIsolatedProcess_vpnAndNetselftest() { + assertTrue(CrashReporter.isMonitoredIsolatedProcess("com.foxx.androidcast:vpn")); + assertTrue(CrashReporter.isMonitoredIsolatedProcess("com.foxx.androidcast:netselftest")); + assertFalse(CrashReporter.isMonitoredIsolatedProcess("com.foxx.androidcast")); + assertFalse(CrashReporter.isMonitoredIsolatedProcess("com.foxx.androidcast:crashwatcher")); + } +} diff --git a/app/src/test/java/com/foxx/androidcast/remoteaccess/WireGuardConfigParseTest.java b/app/src/test/java/com/foxx/androidcast/remoteaccess/WireGuardConfigParseTest.java new file mode 100644 index 0000000..d5b3d4a --- /dev/null +++ b/app/src/test/java/com/foxx/androidcast/remoteaccess/WireGuardConfigParseTest.java @@ -0,0 +1,34 @@ +package com.foxx.androidcast.remoteaccess; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; + +import com.wireguard.config.Config; + +import org.json.JSONObject; +import org.junit.Test; + +import java.io.ByteArrayInputStream; +import java.nio.charset.StandardCharsets; + +/** Ensures BE credential → wg-quick text parses with wireguard-android Config. */ +public class WireGuardConfigParseTest { + + @Test + public void builderOutput_parsesWithWireGuardConfig() throws Exception { + JSONObject creds = new JSONObject(); + creds.put("interface_private_key", "YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="); + creds.put("interface_address", "10.66.66.2/32"); + creds.put("peer_public_key", "YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="); + creds.put("peer_endpoint", "ra.apps.f0xx.org:51820"); + creds.put("peer_allowed_ips", "10.66.66.1/32"); + + String quick = WireGuardConfigBuilder.fromConnectCredentials(creds); + assertFalse(quick.isEmpty()); + + try (ByteArrayInputStream in = new ByteArrayInputStream(quick.getBytes(StandardCharsets.UTF_8))) { + Config config = Config.parse(in); + assertEquals("10.66.66.2/32", config.getInterface().getAddresses().iterator().next().toString()); + } + } +} diff --git a/app/src/test/java/com/foxx/androidcast/vpn/VpnStateTest.java b/app/src/test/java/com/foxx/androidcast/vpn/VpnStateTest.java new file mode 100644 index 0000000..1111045 --- /dev/null +++ b/app/src/test/java/com/foxx/androidcast/vpn/VpnStateTest.java @@ -0,0 +1,15 @@ +package com.foxx.androidcast.vpn; + +import static org.junit.Assert.assertTrue; + +import org.junit.Test; + +public class VpnStateTest { + + @Test + public void stateCodes_areDistinct() { + assertTrue(VpnState.DOWN < VpnState.CONNECTING); + assertTrue(VpnState.CONNECTING < VpnState.UP); + assertTrue(VpnState.UP < VpnState.ERROR); + } +} diff --git a/docs/BUILD_DEPLOY.md b/docs/BUILD_DEPLOY.md index 1536bcc..2fb2ffb 100644 --- a/docs/BUILD_DEPLOY.md +++ b/docs/BUILD_DEPLOY.md @@ -55,6 +55,17 @@ cd orchestration Direct debug ports: crashes `:8082`, builder `:8083`. +## Local developer rebuild + +`./rebuild.sh` (repo root): + +1. `scripts/init-third-party-submodules.sh` — libvpx, opus, speex, **wireguard-android** (+ nested wireguard-tools / elf-cleaner) +2. `scripts/build-native-codecs.sh` per ABI +3. `./gradlew :tunnel:assembleDebug :app:assembleDebug` — WireGuard userspace (`libwg-go.so`) from `third-party/wireguard-android` +4. Unit tests, adb install (when devices configured) + +No runtime fetch from zx2c4/GitHub during Gradle: sources come from checked-out `third-party/` submodules only. + ## Trigger a build 1. Open Builder → sign in (default dev user from crash schema seed). diff --git a/docs/REMOTE_ACCESS_IMPL.md b/docs/REMOTE_ACCESS_IMPL.md index 04630f5..61a2243 100644 --- a/docs/REMOTE_ACCESS_IMPL.md +++ b/docs/REMOTE_ACCESS_IMPL.md @@ -25,7 +25,7 @@ See the full proposal: [20260602_REVERSE_SSH_proposals_summary.md](20260602_REVE - **WireGuard:** foreground service; jittered poll **1–7 min** → `heartbeat.php` with `type: ra` - Heartbeat URL derived from crash upload URL (`…/api/heartbeat.php`) - Session credentials persisted until `expires_at`; expiry tears down tunnel locally -- Optional full userspace WG via `third-party/wireguard-android` (`:tunnel`); otherwise `RemoteAccessVpnService` TUN fallback +- Userspace WG via `third-party/wireguard-android` (`:tunnel` / `GoBackend`) in isolated process **`com.foxx.androidcast:vpn`**; main app controls via AIDL (`IVpnService` / `VpnServiceClient`); TUN fallback only if GoBackend fails ### Android VPN consent (WireGuard) @@ -148,14 +148,28 @@ Internet UDP :51820 → FE DNAT → BE wg0 :51820 Hostname `ra.apps.f0xx.org` (or similar) should resolve to the FE public IP. Devices use `wg_endpoint` from config/connect payload. +## VPN process (AIDL) + +| Component | Process | Role | +|-----------|---------|------| +| `VpnServiceClient` | main (`com.foxx.androidcast`) | Binds to `IVpnService`; async apply/tearDown + state callbacks | +| `AndroidCastVpnService` | `:vpn` | AIDL stub; worker thread for tunnel ops | +| `WireGuardVpnEngine` | `:vpn` | `GoBackend` + TUN fallback | +| `RemoteAccessVpnService` | `:vpn` | `VpnService` TUN when GoBackend fails | +| `GoBackend$VpnService` | `:vpn` | WireGuard tunnel library VPN entry (manifest merge) | + +Developer settings still uses `VpnService.prepare(Activity)` for the one-time consent dialog (same app UID). + +**Crash capture:** `CrashReporter.install()` registers uncaught handlers in `:vpn` (scenario `vpn_service`, process `com.foxx.androidcast:vpn`). Reports persist to shared app storage and upload via `:crashwatcher`. Lab: `scripts/simulate-vpn-crashes.sh` (debug APK + `MODE=device`, or `MODE=upload` for BE ingest validation). + ## WireGuard third-party (Android) ```bash -bash scripts/init-wireguard-submodule.sh -./gradlew :app:assembleDebug # includes :tunnel when submodule present +bash scripts/init-third-party-submodules.sh # or ./rebuild.sh (includes init + :tunnel build) +./gradlew :tunnel:assembleDebug :app:assembleDebug ``` -Without the submodule, `WireGuardTunnelBridge` uses `RemoteAccessVpnService` (TUN only — sufficient for lab; prefer `:tunnel` for production tunnels). +Gradle fails fast if the submodule is missing. VPN runs in `:vpn` (`AndroidCastVpnService` + AIDL); `WireGuardVpnEngine` uses `GoBackend` with TUN fallback in the same process. ## Tests diff --git a/docs/drafts/20100611_1_net_obfuscation.txt b/docs/drafts/20100611_1_net_obfuscation.txt new file mode 100644 index 0000000..ab00fa0 --- /dev/null +++ b/docs/drafts/20100611_1_net_obfuscation.txt @@ -0,0 +1,6 @@ +Network traffic obfuscation + +Definitions: +- E2E - E2E encryption +- P2P - P2P encryption +- POLY - Polymorphic ciphers, persistent and temporary keys diff --git a/docs/drafts/20100611_1_net_topology_glossary.txt b/docs/drafts/20100611_1_net_topology_glossary.txt new file mode 100644 index 0000000..28d7f98 --- /dev/null +++ b/docs/drafts/20100611_1_net_topology_glossary.txt @@ -0,0 +1,12 @@ +network topology glossary (to be used as a code names within the product): + +1. SIRENE - P2P-alike topology +2. SPIDER - MCU-alike topology +3. SPIDERWEB - SFU-alike topology +4. MINE - mesh-alike topology + +5. SLY - E2E/VPN/hidden/any +6. BLUEMOON - Bluetooth-transported any available (mesh, P2P) +7. SLOTH - passive + +and the combinations of them: SIRENE SLOTH - slow-to-respond passive P2P networking; SPIDER SLY - hidden non-transparent network activity using MCU-alike topology; MINE BLUEMOON, etc. diff --git a/docs/drafts/20100611_2_av_conversion_and_non_rt.txt b/docs/drafts/20100611_2_av_conversion_and_non_rt.txt new file mode 100644 index 0000000..70d5311 --- /dev/null +++ b/docs/drafts/20100611_2_av_conversion_and_non_rt.txt @@ -0,0 +1,17 @@ +Audio/Video RT and non-RT +linked drafts: + - Network obfuscation + - Transport layers + - Network topology + - Paid services + - End-user services + +The service (standalone or the current one, depends on max. capacity, bandwidth, storage trade-offs, CPU load) should provide: + +1. RT AV +- RT streaming and casting using well-known codecs and transports, including store recordings services for offline / non-RT usage + +2. non-RT AV +- non-RT on-demand conversion routines with additional services, like: +** reproducible (playable) streams +** ability to download/delete streams diff --git a/examples/crash_reporter/backend/THIRD_PARTY_LICENSES.md b/examples/crash_reporter/backend/THIRD_PARTY_LICENSES.md index 660d175..9628cbe 100644 --- a/examples/crash_reporter/backend/THIRD_PARTY_LICENSES.md +++ b/examples/crash_reporter/backend/THIRD_PARTY_LICENSES.md @@ -26,7 +26,7 @@ These are **server-side**; not bundled in the mobile APK. | **wireguard-tools** (`wg`, `wg-quick`) | GPLv2 (userspace) | BE dynamic peer provisioning (`WireGuardPeerProvisioner.php`) | | Linux **WireGuard** kernel module | GPLv2 | UDP tunnel termination on BE | -Mobile WireGuard mode uses outbound tunnel from device; see mobile app licenses for optional `wireguard-android` (Apache-2.0). +Mobile WireGuard mode uses outbound tunnel from device; app embeds `wireguard-android` tunnel (`third-party/wireguard-android`, Apache-2.0) — see app `licenses/combined.html`. ## Planned: reverse SSH (RSSH) diff --git a/gradle.properties b/gradle.properties index a99232b..96923bf 100644 --- a/gradle.properties +++ b/gradle.properties @@ -1,4 +1,6 @@ org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8 +# wireguard-android tunnel (third-party/wireguard-android); consumed by gradle/wireguard-tunnel/ +wireguardPackageName=com.wireguard.android android.useAndroidX=true android.nonTransitiveRClass=true # Gradle 8.9 must run on JDK 17–21 (Gentoo default JDK 25 fails with class file version 69). diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar deleted file mode 100644 index 2c3521197d7c4586c843d1d3e9090525f1898cde..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 43504 zcma&N1CXTcmMvW9vTb(Rwr$&4wr$(C?dmSu>@vG-+vuvg^_??!{yS%8zW-#zn-LkA z5&1^$^{lnmUON?}LBF8_K|(?T0Ra(xUH{($5eN!MR#ZihR#HxkUPe+_R8Cn`RRs(P z_^*#_XlXmGv7!4;*Y%p4nw?{bNp@UZHv1?Um8r6)Fei3p@ClJn0ECfg1hkeuUU@Or zDaPa;U3fE=3L}DooL;8f;P0ipPt0Z~9P0)lbStMS)ag54=uL9ia-Lm3nh|@(Y?B`; zx_#arJIpXH!U{fbCbI^17}6Ri*H<>OLR%c|^mh8+)*h~K8Z!9)DPf zR2h?lbDZQ`p9P;&DQ4F0sur@TMa!Y}S8irn(%d-gi0*WxxCSk*A?3lGh=gcYN?FGl z7D=Js!i~0=u3rox^eO3i@$0=n{K1lPNU zwmfjRVmLOCRfe=seV&P*1Iq=^i`502keY8Uy-WNPwVNNtJFx?IwAyRPZo2Wo1+S(xF37LJZ~%i)kpFQ3Fw=mXfd@>%+)RpYQLnr}B~~zoof(JVm^^&f zxKV^+3D3$A1G;qh4gPVjhrC8e(VYUHv#dy^)(RoUFM?o%W-EHxufuWf(l*@-l+7vt z=l`qmR56K~F|v<^Pd*p~1_y^P0P^aPC##d8+HqX4IR1gu+7w#~TBFphJxF)T$2WEa zxa?H&6=Qe7d(#tha?_1uQys2KtHQ{)Qco)qwGjrdNL7thd^G5i8Os)CHqc>iOidS} z%nFEDdm=GXBw=yXe1W-ShHHFb?Cc70+$W~z_+}nAoHFYI1MV1wZegw*0y^tC*s%3h zhD3tN8b=Gv&rj}!SUM6|ajSPp*58KR7MPpI{oAJCtY~JECm)*m_x>AZEu>DFgUcby z1Qaw8lU4jZpQ_$;*7RME+gq1KySGG#Wql>aL~k9tLrSO()LWn*q&YxHEuzmwd1?aAtI zBJ>P=&$=l1efe1CDU;`Fd+_;&wI07?V0aAIgc(!{a z0Jg6Y=inXc3^n!U0Atk`iCFIQooHqcWhO(qrieUOW8X(x?(RD}iYDLMjSwffH2~tB z)oDgNBLB^AJBM1M^c5HdRx6fBfka`(LD-qrlh5jqH~);#nw|iyp)()xVYak3;Ybik z0j`(+69aK*B>)e_p%=wu8XC&9e{AO4c~O1U`5X9}?0mrd*m$_EUek{R?DNSh(=br# z#Q61gBzEpmy`$pA*6!87 zSDD+=@fTY7<4A?GLqpA?Pb2z$pbCc4B4zL{BeZ?F-8`s$?>*lXXtn*NC61>|*w7J* z$?!iB{6R-0=KFmyp1nnEmLsA-H0a6l+1uaH^g%c(p{iT&YFrbQ$&PRb8Up#X3@Zsk zD^^&LK~111%cqlP%!_gFNa^dTYT?rhkGl}5=fL{a`UViaXWI$k-UcHJwmaH1s=S$4 z%4)PdWJX;hh5UoK?6aWoyLxX&NhNRqKam7tcOkLh{%j3K^4Mgx1@i|Pi&}<^5>hs5 zm8?uOS>%)NzT(%PjVPGa?X%`N2TQCKbeH2l;cTnHiHppPSJ<7y-yEIiC!P*ikl&!B z%+?>VttCOQM@ShFguHVjxX^?mHX^hSaO_;pnyh^v9EumqSZTi+#f&_Vaija0Q-e*| z7ulQj6Fs*bbmsWp{`auM04gGwsYYdNNZcg|ph0OgD>7O}Asn7^Z=eI>`$2*v78;sj-}oMoEj&@)9+ycEOo92xSyY344^ z11Hb8^kdOvbf^GNAK++bYioknrpdN>+u8R?JxG=!2Kd9r=YWCOJYXYuM0cOq^FhEd zBg2puKy__7VT3-r*dG4c62Wgxi52EMCQ`bKgf*#*ou(D4-ZN$+mg&7$u!! z-^+Z%;-3IDwqZ|K=ah85OLwkO zKxNBh+4QHh)u9D?MFtpbl)us}9+V!D%w9jfAMYEb>%$A;u)rrI zuBudh;5PN}_6J_}l55P3l_)&RMlH{m!)ai-i$g)&*M`eN$XQMw{v^r@-125^RRCF0 z^2>|DxhQw(mtNEI2Kj(;KblC7x=JlK$@78`O~>V!`|1Lm-^JR$-5pUANAnb(5}B}JGjBsliK4& zk6y(;$e&h)lh2)L=bvZKbvh@>vLlreBdH8No2>$#%_Wp1U0N7Ank!6$dFSi#xzh|( zRi{Uw%-4W!{IXZ)fWx@XX6;&(m_F%c6~X8hx=BN1&q}*( zoaNjWabE{oUPb!Bt$eyd#$5j9rItB-h*5JiNi(v^e|XKAj*8(k<5-2$&ZBR5fF|JA z9&m4fbzNQnAU}r8ab>fFV%J0z5awe#UZ|bz?Ur)U9bCIKWEzi2%A+5CLqh?}K4JHi z4vtM;+uPsVz{Lfr;78W78gC;z*yTch~4YkLr&m-7%-xc ztw6Mh2d>_iO*$Rd8(-Cr1_V8EO1f*^@wRoSozS) zy1UoC@pruAaC8Z_7~_w4Q6n*&B0AjOmMWa;sIav&gu z|J5&|{=a@vR!~k-OjKEgPFCzcJ>#A1uL&7xTDn;{XBdeM}V=l3B8fE1--DHjSaxoSjNKEM9|U9#m2<3>n{Iuo`r3UZp;>GkT2YBNAh|b z^jTq-hJp(ebZh#Lk8hVBP%qXwv-@vbvoREX$TqRGTgEi$%_F9tZES@z8Bx}$#5eeG zk^UsLBH{bc2VBW)*EdS({yw=?qmevwi?BL6*=12k9zM5gJv1>y#ML4!)iiPzVaH9% zgSImetD@dam~e>{LvVh!phhzpW+iFvWpGT#CVE5TQ40n%F|p(sP5mXxna+Ev7PDwA zamaV4m*^~*xV+&p;W749xhb_X=$|LD;FHuB&JL5?*Y2-oIT(wYY2;73<^#46S~Gx| z^cez%V7x$81}UWqS13Gz80379Rj;6~WdiXWOSsdmzY39L;Hg3MH43o*y8ibNBBH`(av4|u;YPq%{R;IuYow<+GEsf@R?=@tT@!}?#>zIIn0CoyV!hq3mw zHj>OOjfJM3F{RG#6ujzo?y32m^tgSXf@v=J$ELdJ+=5j|=F-~hP$G&}tDZsZE?5rX ztGj`!S>)CFmdkccxM9eGIcGnS2AfK#gXwj%esuIBNJQP1WV~b~+D7PJTmWGTSDrR` zEAu4B8l>NPuhsk5a`rReSya2nfV1EK01+G!x8aBdTs3Io$u5!6n6KX%uv@DxAp3F@{4UYg4SWJtQ-W~0MDb|j-$lwVn znAm*Pl!?Ps&3wO=R115RWKb*JKoexo*)uhhHBncEDMSVa_PyA>k{Zm2(wMQ(5NM3# z)jkza|GoWEQo4^s*wE(gHz?Xsg4`}HUAcs42cM1-qq_=+=!Gk^y710j=66(cSWqUe zklbm8+zB_syQv5A2rj!Vbw8;|$@C!vfNmNV!yJIWDQ>{+2x zKjuFX`~~HKG~^6h5FntRpnnHt=D&rq0>IJ9#F0eM)Y-)GpRjiN7gkA8wvnG#K=q{q z9dBn8_~wm4J<3J_vl|9H{7q6u2A!cW{bp#r*-f{gOV^e=8S{nc1DxMHFwuM$;aVI^ zz6A*}m8N-&x8;aunp1w7_vtB*pa+OYBw=TMc6QK=mbA-|Cf* zvyh8D4LRJImooUaSb7t*fVfih<97Gf@VE0|z>NcBwBQze);Rh!k3K_sfunToZY;f2 z^HmC4KjHRVg+eKYj;PRN^|E0>Gj_zagfRbrki68I^#~6-HaHg3BUW%+clM1xQEdPYt_g<2K+z!$>*$9nQ>; zf9Bei{?zY^-e{q_*|W#2rJG`2fy@{%6u0i_VEWTq$*(ZN37|8lFFFt)nCG({r!q#9 z5VK_kkSJ3?zOH)OezMT{!YkCuSSn!K#-Rhl$uUM(bq*jY? zi1xbMVthJ`E>d>(f3)~fozjg^@eheMF6<)I`oeJYx4*+M&%c9VArn(OM-wp%M<-`x z7sLP1&3^%Nld9Dhm@$3f2}87!quhI@nwd@3~fZl_3LYW-B?Ia>ui`ELg z&Qfe!7m6ze=mZ`Ia9$z|ARSw|IdMpooY4YiPN8K z4B(ts3p%2i(Td=tgEHX z0UQ_>URBtG+-?0E;E7Ld^dyZ;jjw0}XZ(}-QzC6+NN=40oDb2^v!L1g9xRvE#@IBR zO!b-2N7wVfLV;mhEaXQ9XAU+>=XVA6f&T4Z-@AX!leJ8obP^P^wP0aICND?~w&NykJ#54x3_@r7IDMdRNy4Hh;h*!u(Ol(#0bJdwEo$5437-UBjQ+j=Ic>Q2z` zJNDf0yO6@mr6y1#n3)s(W|$iE_i8r@Gd@!DWDqZ7J&~gAm1#~maIGJ1sls^gxL9LLG_NhU!pTGty!TbhzQnu)I*S^54U6Yu%ZeCg`R>Q zhBv$n5j0v%O_j{QYWG!R9W?5_b&67KB$t}&e2LdMvd(PxN6Ir!H4>PNlerpBL>Zvyy!yw z-SOo8caEpDt(}|gKPBd$qND5#a5nju^O>V&;f890?yEOfkSG^HQVmEbM3Ugzu+UtH zC(INPDdraBN?P%kE;*Ae%Wto&sgw(crfZ#Qy(<4nk;S|hD3j{IQRI6Yq|f^basLY; z-HB&Je%Gg}Jt@={_C{L$!RM;$$|iD6vu#3w?v?*;&()uB|I-XqEKqZPS!reW9JkLewLb!70T7n`i!gNtb1%vN- zySZj{8-1>6E%H&=V}LM#xmt`J3XQoaD|@XygXjdZ1+P77-=;=eYpoEQ01B@L*a(uW zrZeZz?HJsw_4g0vhUgkg@VF8<-X$B8pOqCuWAl28uB|@r`19DTUQQsb^pfqB6QtiT z*`_UZ`fT}vtUY#%sq2{rchyfu*pCg;uec2$-$N_xgjZcoumE5vSI{+s@iLWoz^Mf; zuI8kDP{!XY6OP~q5}%1&L}CtfH^N<3o4L@J@zg1-mt{9L`s^z$Vgb|mr{@WiwAqKg zp#t-lhrU>F8o0s1q_9y`gQNf~Vb!F%70f}$>i7o4ho$`uciNf=xgJ>&!gSt0g;M>*x4-`U)ysFW&Vs^Vk6m%?iuWU+o&m(2Jm26Y(3%TL; zA7T)BP{WS!&xmxNw%J=$MPfn(9*^*TV;$JwRy8Zl*yUZi8jWYF>==j~&S|Xinsb%c z2?B+kpet*muEW7@AzjBA^wAJBY8i|#C{WtO_or&Nj2{=6JTTX05}|H>N2B|Wf!*3_ z7hW*j6p3TvpghEc6-wufFiY!%-GvOx*bZrhZu+7?iSrZL5q9}igiF^*R3%DE4aCHZ zqu>xS8LkW+Auv%z-<1Xs92u23R$nk@Pk}MU5!gT|c7vGlEA%G^2th&Q*zfg%-D^=f z&J_}jskj|Q;73NP4<4k*Y%pXPU2Thoqr+5uH1yEYM|VtBPW6lXaetokD0u z9qVek6Q&wk)tFbQ8(^HGf3Wp16gKmr>G;#G(HRBx?F`9AIRboK+;OfHaLJ(P>IP0w zyTbTkx_THEOs%Q&aPrxbZrJlio+hCC_HK<4%f3ZoSAyG7Dn`=X=&h@m*|UYO-4Hq0 z-Bq&+Ie!S##4A6OGoC~>ZW`Y5J)*ouaFl_e9GA*VSL!O_@xGiBw!AF}1{tB)z(w%c zS1Hmrb9OC8>0a_$BzeiN?rkPLc9%&;1CZW*4}CDDNr2gcl_3z+WC15&H1Zc2{o~i) z)LLW=WQ{?ricmC`G1GfJ0Yp4Dy~Ba;j6ZV4r{8xRs`13{dD!xXmr^Aga|C=iSmor% z8hi|pTXH)5Yf&v~exp3o+sY4B^^b*eYkkCYl*T{*=-0HniSA_1F53eCb{x~1k3*`W zr~};p1A`k{1DV9=UPnLDgz{aJH=-LQo<5%+Em!DNN252xwIf*wF_zS^!(XSm(9eoj z=*dXG&n0>)_)N5oc6v!>-bd(2ragD8O=M|wGW z!xJQS<)u70m&6OmrF0WSsr@I%T*c#Qo#Ha4d3COcX+9}hM5!7JIGF>7<~C(Ear^Sn zm^ZFkV6~Ula6+8S?oOROOA6$C&q&dp`>oR-2Ym3(HT@O7Sd5c~+kjrmM)YmgPH*tL zX+znN>`tv;5eOfX?h{AuX^LK~V#gPCu=)Tigtq9&?7Xh$qN|%A$?V*v=&-2F$zTUv z`C#WyIrChS5|Kgm_GeudCFf;)!WH7FI60j^0o#65o6`w*S7R@)88n$1nrgU(oU0M9 zx+EuMkC>(4j1;m6NoGqEkpJYJ?vc|B zOlwT3t&UgL!pX_P*6g36`ZXQ; z9~Cv}ANFnJGp(;ZhS(@FT;3e)0)Kp;h^x;$*xZn*k0U6-&FwI=uOGaODdrsp-!K$Ac32^c{+FhI-HkYd5v=`PGsg%6I`4d9Jy)uW0y%) zm&j^9WBAp*P8#kGJUhB!L?a%h$hJgQrx!6KCB_TRo%9{t0J7KW8!o1B!NC)VGLM5! zpZy5Jc{`r{1e(jd%jsG7k%I+m#CGS*BPA65ZVW~fLYw0dA-H_}O zrkGFL&P1PG9p2(%QiEWm6x;U-U&I#;Em$nx-_I^wtgw3xUPVVu zqSuKnx&dIT-XT+T10p;yjo1Y)z(x1fb8Dzfn8e yu?e%!_ptzGB|8GrCfu%p?(_ zQccdaaVK$5bz;*rnyK{_SQYM>;aES6Qs^lj9lEs6_J+%nIiuQC*fN;z8md>r_~Mfl zU%p5Dt_YT>gQqfr@`cR!$NWr~+`CZb%dn;WtzrAOI>P_JtsB76PYe*<%H(y>qx-`Kq!X_; z<{RpAqYhE=L1r*M)gNF3B8r(<%8mo*SR2hu zccLRZwGARt)Hlo1euqTyM>^!HK*!Q2P;4UYrysje@;(<|$&%vQekbn|0Ruu_Io(w4#%p6ld2Yp7tlA`Y$cciThP zKzNGIMPXX%&Ud0uQh!uQZz|FB`4KGD?3!ND?wQt6!n*f4EmCoJUh&b?;B{|lxs#F- z31~HQ`SF4x$&v00@(P+j1pAaj5!s`)b2RDBp*PB=2IB>oBF!*6vwr7Dp%zpAx*dPr zb@Zjq^XjN?O4QcZ*O+8>)|HlrR>oD*?WQl5ri3R#2?*W6iJ>>kH%KnnME&TT@ZzrHS$Q%LC?n|e>V+D+8D zYc4)QddFz7I8#}y#Wj6>4P%34dZH~OUDb?uP%-E zwjXM(?Sg~1!|wI(RVuxbu)-rH+O=igSho_pDCw(c6b=P zKk4ATlB?bj9+HHlh<_!&z0rx13K3ZrAR8W)!@Y}o`?a*JJsD+twZIv`W)@Y?Amu_u zz``@-e2X}27$i(2=9rvIu5uTUOVhzwu%mNazS|lZb&PT;XE2|B&W1>=B58#*!~D&) zfVmJGg8UdP*fx(>Cj^?yS^zH#o-$Q-*$SnK(ZVFkw+er=>N^7!)FtP3y~Xxnu^nzY zikgB>Nj0%;WOltWIob|}%lo?_C7<``a5hEkx&1ku$|)i>Rh6@3h*`slY=9U}(Ql_< zaNG*J8vb&@zpdhAvv`?{=zDedJ23TD&Zg__snRAH4eh~^oawdYi6A3w8<Ozh@Kw)#bdktM^GVb zrG08?0bG?|NG+w^&JvD*7LAbjED{_Zkc`3H!My>0u5Q}m!+6VokMLXxl`Mkd=g&Xx z-a>m*#G3SLlhbKB!)tnzfWOBV;u;ftU}S!NdD5+YtOjLg?X}dl>7m^gOpihrf1;PY zvll&>dIuUGs{Qnd- zwIR3oIrct8Va^Tm0t#(bJD7c$Z7DO9*7NnRZorrSm`b`cxz>OIC;jSE3DO8`hX955ui`s%||YQtt2 z5DNA&pG-V+4oI2s*x^>-$6J?p=I>C|9wZF8z;VjR??Icg?1w2v5Me+FgAeGGa8(3S z4vg*$>zC-WIVZtJ7}o9{D-7d>zCe|z#<9>CFve-OPAYsneTb^JH!Enaza#j}^mXy1 z+ULn^10+rWLF6j2>Ya@@Kq?26>AqK{A_| zQKb*~F1>sE*=d?A?W7N2j?L09_7n+HGi{VY;MoTGr_)G9)ot$p!-UY5zZ2Xtbm=t z@dpPSGwgH=QtIcEulQNI>S-#ifbnO5EWkI;$A|pxJd885oM+ zGZ0_0gDvG8q2xebj+fbCHYfAXuZStH2j~|d^sBAzo46(K8n59+T6rzBwK)^rfPT+B zyIFw)9YC-V^rhtK`!3jrhmW-sTmM+tPH+;nwjL#-SjQPUZ53L@A>y*rt(#M(qsiB2 zx6B)dI}6Wlsw%bJ8h|(lhkJVogQZA&n{?Vgs6gNSXzuZpEyu*xySy8ro07QZ7Vk1!3tJphN_5V7qOiyK8p z#@jcDD8nmtYi1^l8ml;AF<#IPK?!pqf9D4moYk>d99Im}Jtwj6c#+A;f)CQ*f-hZ< z=p_T86jog%!p)D&5g9taSwYi&eP z#JuEK%+NULWus;0w32-SYFku#i}d~+{Pkho&^{;RxzP&0!RCm3-9K6`>KZpnzS6?L z^H^V*s!8<>x8bomvD%rh>Zp3>Db%kyin;qtl+jAv8Oo~1g~mqGAC&Qi_wy|xEt2iz zWAJEfTV%cl2Cs<1L&DLRVVH05EDq`pH7Oh7sR`NNkL%wi}8n>IXcO40hp+J+sC!W?!krJf!GJNE8uj zg-y~Ns-<~D?yqbzVRB}G>0A^f0!^N7l=$m0OdZuqAOQqLc zX?AEGr1Ht+inZ-Qiwnl@Z0qukd__a!C*CKuGdy5#nD7VUBM^6OCpxCa2A(X;e0&V4 zM&WR8+wErQ7UIc6LY~Q9x%Sn*Tn>>P`^t&idaOEnOd(Ufw#>NoR^1QdhJ8s`h^|R_ zXX`c5*O~Xdvh%q;7L!_!ohf$NfEBmCde|#uVZvEo>OfEq%+Ns7&_f$OR9xsihRpBb z+cjk8LyDm@U{YN>+r46?nn{7Gh(;WhFw6GAxtcKD+YWV?uge>;+q#Xx4!GpRkVZYu zzsF}1)7$?%s9g9CH=Zs+B%M_)+~*j3L0&Q9u7!|+T`^O{xE6qvAP?XWv9_MrZKdo& z%IyU)$Q95AB4!#hT!_dA>4e@zjOBD*Y=XjtMm)V|+IXzjuM;(l+8aA5#Kaz_$rR6! zj>#&^DidYD$nUY(D$mH`9eb|dtV0b{S>H6FBfq>t5`;OxA4Nn{J(+XihF(stSche7$es&~N$epi&PDM_N`As;*9D^L==2Q7Z2zD+CiU(|+-kL*VG+&9!Yb3LgPy?A zm7Z&^qRG_JIxK7-FBzZI3Q<;{`DIxtc48k> zc|0dmX;Z=W$+)qE)~`yn6MdoJ4co;%!`ddy+FV538Y)j(vg}5*k(WK)KWZ3WaOG!8 z!syGn=s{H$odtpqFrT#JGM*utN7B((abXnpDM6w56nhw}OY}0TiTG1#f*VFZr+^-g zbP10`$LPq_;PvrA1XXlyx2uM^mrjTzX}w{yuLo-cOClE8MMk47T25G8M!9Z5ypOSV zAJUBGEg5L2fY)ZGJb^E34R2zJ?}Vf>{~gB!8=5Z) z9y$>5c)=;o0HeHHSuE4U)#vG&KF|I%-cF6f$~pdYJWk_dD}iOA>iA$O$+4%@>JU08 zS`ep)$XLPJ+n0_i@PkF#ri6T8?ZeAot$6JIYHm&P6EB=BiaNY|aA$W0I+nz*zkz_z zkEru!tj!QUffq%)8y0y`T&`fuus-1p>=^hnBiBqD^hXrPs`PY9tU3m0np~rISY09> z`P3s=-kt_cYcxWd{de@}TwSqg*xVhp;E9zCsnXo6z z?f&Sv^U7n4`xr=mXle94HzOdN!2kB~4=%)u&N!+2;z6UYKUDqi-s6AZ!haB;@&B`? z_TRX0%@suz^TRdCb?!vNJYPY8L_}&07uySH9%W^Tc&1pia6y1q#?*Drf}GjGbPjBS zbOPcUY#*$3sL2x4v_i*Y=N7E$mR}J%|GUI(>WEr+28+V z%v5{#e!UF*6~G&%;l*q*$V?&r$Pp^sE^i-0$+RH3ERUUdQ0>rAq2(2QAbG}$y{de( z>{qD~GGuOk559Y@%$?N^1ApVL_a704>8OD%8Y%8B;FCt%AoPu8*D1 zLB5X>b}Syz81pn;xnB}%0FnwazlWfUV)Z-~rZg6~b z6!9J$EcE&sEbzcy?CI~=boWA&eeIa%z(7SE^qgVLz??1Vbc1*aRvc%Mri)AJaAG!p z$X!_9Ds;Zz)f+;%s&dRcJt2==P{^j3bf0M=nJd&xwUGlUFn?H=2W(*2I2Gdu zv!gYCwM10aeus)`RIZSrCK=&oKaO_Ry~D1B5!y0R=%!i2*KfXGYX&gNv_u+n9wiR5 z*e$Zjju&ODRW3phN925%S(jL+bCHv6rZtc?!*`1TyYXT6%Ju=|X;6D@lq$8T zW{Y|e39ioPez(pBH%k)HzFITXHvnD6hw^lIoUMA;qAJ^CU?top1fo@s7xT13Fvn1H z6JWa-6+FJF#x>~+A;D~;VDs26>^oH0EI`IYT2iagy23?nyJ==i{g4%HrAf1-*v zK1)~@&(KkwR7TL}L(A@C_S0G;-GMDy=MJn2$FP5s<%wC)4jC5PXoxrQBFZ_k0P{{s@sz+gX`-!=T8rcB(=7vW}^K6oLWMmp(rwDh}b zwaGGd>yEy6fHv%jM$yJXo5oMAQ>c9j`**}F?MCry;T@47@r?&sKHgVe$MCqk#Z_3S z1GZI~nOEN*P~+UaFGnj{{Jo@16`(qVNtbU>O0Hf57-P>x8Jikp=`s8xWs^dAJ9lCQ z)GFm+=OV%AMVqVATtN@|vp61VVAHRn87}%PC^RAzJ%JngmZTasWBAWsoAqBU+8L8u z4A&Pe?fmTm0?mK-BL9t+{y7o(7jm+RpOhL9KnY#E&qu^}B6=K_dB}*VlSEiC9fn)+V=J;OnN)Ta5v66ic1rG+dGAJ1 z1%Zb_+!$=tQ~lxQrzv3x#CPb?CekEkA}0MYSgx$Jdd}q8+R=ma$|&1a#)TQ=l$1tQ z=tL9&_^vJ)Pk}EDO-va`UCT1m#Uty1{v^A3P~83_#v^ozH}6*9mIjIr;t3Uv%@VeW zGL6(CwCUp)Jq%G0bIG%?{_*Y#5IHf*5M@wPo6A{$Um++Co$wLC=J1aoG93&T7Ho}P z=mGEPP7GbvoG!uD$k(H3A$Z))+i{Hy?QHdk>3xSBXR0j!11O^mEe9RHmw!pvzv?Ua~2_l2Yh~_!s1qS`|0~0)YsbHSz8!mG)WiJE| z2f($6TQtt6L_f~ApQYQKSb=`053LgrQq7G@98#igV>y#i==-nEjQ!XNu9 z~;mE+gtj4IDDNQJ~JVk5Ux6&LCSFL!y=>79kE9=V}J7tD==Ga+IW zX)r7>VZ9dY=V&}DR))xUoV!u(Z|%3ciQi_2jl}3=$Agc(`RPb z8kEBpvY>1FGQ9W$n>Cq=DIpski};nE)`p3IUw1Oz0|wxll^)4dq3;CCY@RyJgFgc# zKouFh!`?Xuo{IMz^xi-h=StCis_M7yq$u) z?XHvw*HP0VgR+KR6wI)jEMX|ssqYvSf*_3W8zVTQzD?3>H!#>InzpSO)@SC8q*ii- z%%h}_#0{4JG;Jm`4zg};BPTGkYamx$Xo#O~lBirRY)q=5M45n{GCfV7h9qwyu1NxOMoP4)jjZMxmT|IQQh0U7C$EbnMN<3)Kk?fFHYq$d|ICu>KbY_hO zTZM+uKHe(cIZfEqyzyYSUBZa8;Fcut-GN!HSA9ius`ltNebF46ZX_BbZNU}}ZOm{M2&nANL9@0qvih15(|`S~z}m&h!u4x~(%MAO$jHRWNfuxWF#B)E&g3ghSQ9|> z(MFaLQj)NE0lowyjvg8z0#m6FIuKE9lDO~Glg}nSb7`~^&#(Lw{}GVOS>U)m8bF}x zVjbXljBm34Cs-yM6TVusr+3kYFjr28STT3g056y3cH5Tmge~ASxBj z%|yb>$eF;WgrcOZf569sDZOVwoo%8>XO>XQOX1OyN9I-SQgrm;U;+#3OI(zrWyow3 zk==|{lt2xrQ%FIXOTejR>;wv(Pb8u8}BUpx?yd(Abh6? zsoO3VYWkeLnF43&@*#MQ9-i-d0t*xN-UEyNKeyNMHw|A(k(_6QKO=nKMCxD(W(Yop zsRQ)QeL4X3Lxp^L%wzi2-WVSsf61dqliPUM7srDB?Wm6Lzn0&{*}|IsKQW;02(Y&| zaTKv|`U(pSzuvR6Rduu$wzK_W-Y-7>7s?G$)U}&uK;<>vU}^^ns@Z!p+9?St1s)dG zK%y6xkPyyS1$~&6v{kl?Md6gwM|>mt6Upm>oa8RLD^8T{0?HC!Z>;(Bob7el(DV6x zi`I)$&E&ngwFS@bi4^xFLAn`=fzTC;aimE^!cMI2n@Vo%Ae-ne`RF((&5y6xsjjAZ zVguVoQ?Z9uk$2ON;ersE%PU*xGO@T*;j1BO5#TuZKEf(mB7|g7pcEA=nYJ{s3vlbg zd4-DUlD{*6o%Gc^N!Nptgay>j6E5;3psI+C3Q!1ZIbeCubW%w4pq9)MSDyB{HLm|k zxv-{$$A*pS@csolri$Ge<4VZ}e~78JOL-EVyrbxKra^d{?|NnPp86!q>t<&IP07?Z z^>~IK^k#OEKgRH+LjllZXk7iA>2cfH6+(e&9ku5poo~6y{GC5>(bRK7hwjiurqAiZ zg*DmtgY}v83IjE&AbiWgMyFbaRUPZ{lYiz$U^&Zt2YjG<%m((&_JUbZcfJ22(>bi5 z!J?<7AySj0JZ&<-qXX;mcV!f~>G=sB0KnjWca4}vrtunD^1TrpfeS^4dvFr!65knK zZh`d;*VOkPs4*-9kL>$GP0`(M!j~B;#x?Ba~&s6CopvO86oM?-? zOw#dIRc;6A6T?B`Qp%^<U5 z19x(ywSH$_N+Io!6;e?`tWaM$`=Db!gzx|lQ${DG!zb1Zl&|{kX0y6xvO1o z220r<-oaS^^R2pEyY;=Qllqpmue|5yI~D|iI!IGt@iod{Opz@*ml^w2bNs)p`M(Io z|E;;m*Xpjd9l)4G#KaWfV(t8YUn@A;nK^#xgv=LtnArX|vWQVuw3}B${h+frU2>9^ z!l6)!Uo4`5k`<<;E(ido7M6lKTgWezNLq>U*=uz&s=cc$1%>VrAeOoUtA|T6gO4>UNqsdK=NF*8|~*sl&wI=x9-EGiq*aqV!(VVXA57 zw9*o6Ir8Lj1npUXvlevtn(_+^X5rzdR>#(}4YcB9O50q97%rW2me5_L=%ffYPUSRc z!vv?Kv>dH994Qi>U(a<0KF6NH5b16enCp+mw^Hb3Xs1^tThFpz!3QuN#}KBbww`(h z7GO)1olDqy6?T$()R7y%NYx*B0k_2IBiZ14&8|JPFxeMF{vW>HF-ViB*%t0;Thq2} z+qP}n=Cp0wwr%5S+qN<7?r+``=l(h0z2`^8j;g2~Q4u?{cIL{JYY%l|iw&YH4FL(8 z1-*E#ANDHi+1f%lMJbRfq*`nG)*#?EJEVoDH5XdfqwR-C{zmbQoh?E zhW!|TvYv~>R*OAnyZf@gC+=%}6N90yU@E;0b_OV#xL9B?GX(D&7BkujjFC@HVKFci zb_>I5e!yuHA1LC`xm&;wnn|3ht3h7|rDaOsh0ePhcg_^Wh8Bq|AGe`4t5Gk(9^F;M z8mFr{uCm{)Uq0Xa$Fw6+da`C4%)M_#jaX$xj;}&Lzc8wTc%r!Y#1akd|6FMf(a4I6 z`cQqS_{rm0iLnhMG~CfDZc96G3O=Tihnv8g;*w?)C4N4LE0m#H1?-P=4{KeC+o}8b zZX)x#(zEysFm$v9W8-4lkW%VJIjM~iQIVW)A*RCO{Oe_L;rQ3BmF*bhWa}!=wcu@# zaRWW{&7~V-e_$s)j!lJsa-J?z;54!;KnU3vuhp~(9KRU2GKYfPj{qA?;#}H5f$Wv-_ zGrTb(EAnpR0*pKft3a}6$npzzq{}ApC&=C&9KoM3Ge@24D^8ZWJDiXq@r{hP=-02& z@Qrn-cbr2YFc$7XR0j7{jAyR;4LLBf_XNSrmd{dV3;ae;fsEjds*2DZ&@#e)Qcc}w zLgkfW=9Kz|eeM$E`-+=jQSt}*kAwbMBn7AZSAjkHUn4n||NBq*|2QPcKaceA6m)g5 z_}3?DX>90X|35eI7?n+>f9+hl5b>#q`2+`FXbOu9Q94UX-GWH;d*dpmSFd~7WM#H2 zvKNxjOtC)U_tx*0(J)eAI8xAD8SvhZ+VRUA?)| zeJjvg9)vi`Qx;;1QP!c_6hJp1=J=*%!>ug}%O!CoSh-D_6LK0JyiY}rOaqSeja&jb#P|DR7 z_JannlfrFeaE$irfrRIiN|huXmQhQUN6VG*6`bzN4Z3!*G?FjN8!`ZTn6Wn4n=Ync z_|Sq=pO7+~{W2}599SfKz@umgRYj6LR9u0*BaHqdEw^i)dKo5HomT9zzB$I6w$r?6 zs2gu*wNOAMK`+5yPBIxSOJpL$@SN&iUaM zQ3%$EQt%zQBNd`+rl9R~utRDAH%7XP@2Z1s=)ks77I(>#FuwydE5>LzFx)8ye4ClM zb*e2i*E$Te%hTKh7`&rQXz;gvm4Dam(r-!FBEcw*b$U%Wo9DIPOwlC5Ywm3WRCM4{ zF42rnEbBzUP>o>MA){;KANhAW7=FKR=DKK&S1AqSxyP;k z;fp_GVuV}y6YqAd)5p=tJ~0KtaeRQv^nvO?*hZEK-qA;vuIo!}Xgec4QGW2ipf2HK z&G&ppF*1aC`C!FR9(j4&r|SHy74IiDky~3Ab)z@9r&vF+Bapx<{u~gb2?*J zSl{6YcZ$&m*X)X?|8<2S}WDrWN3yhyY7wlf*q`n^z3LT4T$@$y``b{m953kfBBPpQ7hT;zs(Nme`Qw@{_pUO0OG zfugi3N?l|jn-Du3Qn{Aa2#6w&qT+oof=YM!Zq~Xi`vlg<;^)Jreeb^x6_4HL-j}sU z1U^^;-WetwPLKMsdx4QZ$haq3)rA#ATpEh{NXto-tOXjCwO~nJ(Z9F%plZ{z(ZW!e zF>nv&4ViOTs58M+f+sGimF^9cB*9b(gAizwyu5|--SLmBOP-uftqVnVBd$f7YrkJ8!jm*QQEQC zEQ+@T*AA1kV@SPF6H5sT%^$$6!e5;#N((^=OA5t}bqIdqf`PiMMFEDhnV#AQWSfLp zX=|ZEsbLt8Sk&wegQU0&kMC|cuY`&@<#r{t2*sq2$%epiTVpJxWm#OPC^wo_4p++U zU|%XFYs+ZCS4JHSRaVET)jV?lbYAd4ouXx0Ka6*wIFBRgvBgmg$kTNQEvs0=2s^sU z_909)3`Ut!m}}@sv<63E@aQx}-!qVdOjSOnAXTh~MKvr$0nr(1Fj-3uS{U6-T9NG1Y(Ua)Nc}Mi< zOBQz^&^v*$BqmTIO^;r@kpaq3n!BI?L{#bw)pdFV&M?D0HKqC*YBxa;QD_4(RlawI z5wBK;7T^4dT7zt%%P<*-M~m?Et;S^tdNgQSn?4$mFvIHHL!`-@K~_Ar4vBnhy{xuy zigp!>UAwPyl!@~(bkOY;un&B~Evy@5#Y&cEmzGm+)L~4o4~|g0uu&9bh8N0`&{B2b zDj2>biRE1`iw}lv!rl$Smn(4Ob>j<{4dT^TfLe-`cm#S!w_9f;U)@aXWSU4}90LuR zVcbw;`2|6ra88#Cjf#u62xq?J)}I)_y{`@hzES(@mX~}cPWI8}SRoH-H;o~`>JWU$ zhLudK3ug%iS=xjv9tnmOdTXcq_?&o30O;(+VmC&p+%+pd_`V}RY4ibQMNE&N5O+hb3bQ8bxk^33Fu4DB2*~t1909gqoutQHx^plq~;@g$d_+rzS0`2;}2UR2h#?p35B=B*f0BZS4ysiWC!kw?4B-dM%m6_BfRbey1Wh? zT1!@>-y=U}^fxH0A`u1)Mz90G6-<4aW^a@l_9L6Y;cd$3<#xIrhup)XLkFi$W&Ohu z8_j~-VeVXDf9b&6aGelt$g*BzEHgzh)KDgII_Y zb$fcY8?XI6-GEGTZVWW%O;njZld)29a_&1QvNYJ@OpFrUH{er@mnh*}326TYAK7_Z zA={KnK_o3QLk|%m@bx3U#^tCChLxjPxMesOc5D4G+&mvp@Clicz^=kQlWp1|+z|V7 zkU#7l61m@^#`1`{+m2L{sZC#j?#>0)2z4}}kqGhB{NX%~+3{5jOyij!e$5-OAs zDvq+>I2(XsY9%NNhNvKiF<%!6t^7&k{L7~FLdkP9!h%=2Kt$bUt(Zwp*&xq_+nco5 zK#5RCM_@b4WBK*~$CsWj!N!3sF>ijS=~$}_iw@vbKaSp5Jfg89?peR@51M5}xwcHW z(@1TK_kq$c4lmyb=aX3-JORe+JmuNkPP=bM*B?};c=_;h2gT-nt#qbriPkpaqoF@q z<)!80iKvTu`T-B3VT%qKO^lfPQ#m5Ei6Y%Fs@%Pt!8yX&C#tL$=|Ma8i?*^9;}Fk> zyzdQQC5YTBO&gx6kB~yhUUT&%q3a3o+zueh>5D7tdByYVcMz@>j!C@Iyg{N1)veYl`SPshuH6Rk=O6pvVrI71rI5*%uU3u81DpD%qmXsbKWMFR@2m4vO_^l6MMbO9a()DcWmYT&?0B_ zuY~tDiQ6*X7;9B*5pj?;xy_B}*{G}LjW*qU&%*QAyt30@-@O&NQTARZ+%VScr>`s^KX;M!p; z?8)|}P}L_CbOn!u(A{c5?g{s31Kn#7i)U@+_KNU-ZyVD$H7rtOjSht8%N(ST-)%r` z63;Hyp^KIm-?D;E-EnpAAWgz2#z{fawTx_;MR7)O6X~*jm*VUkam7>ueT^@+Gb3-Y zN3@wZls8ibbpaoR2xH=$b3x1Ng5Tai=LT2@_P&4JuBQ!r#Py3ew!ZVH4~T!^TcdyC ze#^@k4a(nNe~G+y zI~yXK@1HHWU4pj{gWT6v@$c(x){cLq*KlFeKy?f$_u##)hDu0X_mwL6uKei~oPd9( zRaF_k&w(J3J8b_`F~?0(Ei_pH}U^c&r$uSYawB8Ybs-JZ|&;vKLWX! z|HFZ%-uBDaP*hMcQKf*|j5!b%H40SPD*#{A`kj|~esk@1?q}-O7WyAm3mD@-vHzw( zTSOlO(K9>GW;@?@xSwpk%X3Ui4_Psm;c*HF~RW+q+C#RO_VT5(x!5B#On-W`T|u z>>=t)W{=B-8wWZejxMaBC9sHzBZGv5uz_uu281kxHg2cll_sZBC&1AKD`CYh2vKeW zm#|MMdC}6A&^DX=>_(etx8f}9o}`(G?Y``M?D+aTPJbZqONmSs>y>WSbvs>7PE~cb zjO+1Y)PMi*!=06^$%< z*{b^66BIl{7zKvz^jut7ylDQBt)ba_F*$UkDgJ2gSNfHB6+`OEiz@xs$Tcrl>X4?o zu9~~b&Xl0?w(7lJXu8-9Yh6V|A3f?)1|~+u-q&6#YV`U2i?XIqUw*lc-QTXwuf@8d zSjMe1BhBKY`Mo{$s%Ce~Hv(^B{K%w{yndEtvyYjjbvFY^rn2>C1Lbi!3RV7F>&;zlSDSk}R>{twI}V zA~NK%T!z=^!qbw(OEgsmSj?#?GR&A$0&K>^(?^4iphc3rN_(xXA%joi)k~DmRLEXl zaWmwMolK%@YiyI|HvX{X$*Ei7y+zJ%m{b}$?N7_SN&p+FpeT%4Z_2`0CP=}Y3D-*@ zL|4W4ja#8*%SfkZzn5sfVknpJv&>glRk^oUqykedE8yCgIwCV)fC1iVwMr4hc#KcV!|M-r_N|nQWw@`j+0(Ywct~kLXQ)Qyncmi{Q4`Ur7A{Ep)n`zCtm8D zVX`kxa8Syc`g$6$($Qc-(_|LtQKWZXDrTir5s*pSVmGhk#dKJzCYT?vqA9}N9DGv> zw}N$byrt?Mk*ZZbN5&zb>pv;rU}EH@Rp54)vhZ=330bLvrKPEPu!WqR%yeM3LB!(E zw|J05Y!tajnZ9Ml*-aX&5T8YtuWDq@on)_*FMhz-?m|>RT0~e3OHllrEMthVY(KwQ zu>ijTc4>Xz-q1(g!ESjaZ+C+Zk5FgmF)rFX29_RmU!`7Pw+0}>8xK^=pOxtUDV)ok zw-=p=OvEH&VO3wToRdI!hPHc`qX+_{T_mj!NxcA&xOgkEuvz`-Aa`ZlNv>qnD0`YT1T3USO0ec!%{KE~UOGPJX%I5_rZDGx@|w zVIMsRPP+}^Xxa&{x!q{hY1wat8jDO7YP0(8xHWeEdrd79lUjB8%)v{X1pQu|1dr*y9M&a(J`038}4>lK&K zIM~6wnX{XA?pFHz{hOmEq{oYBnB@56twXqEcFrFqvCy)sH9B{pQ`G50o{W^t&onwY z-l{ur4#8ylPV5YRLD%%j^d0&_WI>0nmfZ8! zaZ&vo@7D`!=?215+Vk181*U@^{U>VyoXh2F&ZNzZx5tDDtlLc)gi2=|o=GC`uaH;< zFuuF?Q9Q`>S#c(~2p|s49RA`3242`2P+)F)t2N!CIrcl^0#gN@MLRDQ2W4S#MXZJO z8<(9P>MvW;rf2qZ$6sHxCVIr0B-gP?G{5jEDn%W#{T#2_&eIjvlVqm8J$*8A#n`5r zs6PuC!JuZJ@<8cFbbP{cRnIZs>B`?`rPWWL*A?1C3QqGEG?*&!*S0|DgB~`vo_xIo z&n_Sa(>6<$P7%Py{R<>n6Jy?3W|mYYoxe5h^b6C#+UoKJ(zl?^WcBn#|7wMI5=?S# zRgk8l-J`oM%GV&jFc)9&h#9mAyowg^v%Fc-7_^ou5$*YvELa!1q>4tHfX7&PCGqW* zu8In~5`Q5qQvMdToE$w+RP^_cIS2xJjghjCTp6Z(za_D<$S;0Xjt?mAE8~Ym{)zfb zV62v9|59XOvR}wEpm~Cnhyr`=JfC$*o15k?T`3s-ZqF6Gy;Gm+_6H$%oJPywWA^Wl zzn$L=N%{VT8DkQba0|2LqGR#O2Pw!b%LV4#Ojcx5`?Cm;+aLpkyZ=!r1z@E}V= z$2v6v%Ai)MMd`@IM&UD!%%(63VH8+m0Ebk<5Du#0=WeK(E<2~3@>8TceT$wy5F52n zRFtY>G9Gp~h#&R92{G{jLruZSNJ4)gNK+zg*$P zW@~Hf>_Do)tvfEAAMKE1nQ=8coTgog&S;wj(s?Xa0!r?UU5#2>18V#|tKvay1Ka53 zl$RxpMqrkv`Sv&#!_u8$8PMken`QL0_sD2)r&dZziefzSlAdKNKroVU;gRJE#o*}w zP_bO{F4g;|t!iroy^xf~(Q5qc8a3<+vBW%VIOQ1!??d;yEn1at1wpt}*n- z0iQtfu}Isw4ZfH~8p~#RQUKwf<$XeqUr-5?8TSqokdHL7tY|47R; z#d+4NS%Cqp>LQbvvAMIhcCX@|HozKXl)%*5o>P2ZegGuOerV&_MeA}|+o-3L!ZNJd z#1xB^(r!IfE~i>*5r{u;pIfCjhY^Oev$Y1MT16w8pJ0?9@&FH*`d;hS=c#F6fq z{mqsHd*xa;>Hg?j80MwZ%}anqc@&s&2v{vHQS68fueNi5Z(VD2eH>jmv4uvE|HEQm z^=b&?1R9?<@=kjtUfm*I!wPf5Xnma(4*DfPk}Es*H$%NGCIM1qt(LSvbl7&tV>e2$ zUqvZOTiwQyxDoxL(mn?n_x%Tre?L&!FYCOy0>o}#DTC3uSPnyGBv*}!*Yv5IV)Bg_t%V+UrTXfr!Q8+eX}ANR*YLzwme7Rl z@q_*fP7wP2AZ(3WG*)4Z(q@)~c{Je&7?w^?&Wy3)v0{TvNQRGle9mIG>$M2TtQ(Vf z3*PV@1mX)}beRTPjoG#&&IO#Mn(DLGp}mn)_0e=9kXDewC8Pk@yo<8@XZjFP-_zic z{mocvT9Eo)H4Oj$>1->^#DbbiJn^M4?v7XbK>co+v=7g$hE{#HoG6ZEat!s~I<^_s zlFee93KDSbJKlv_+GPfC6P8b>(;dlJ5r9&Pc4kC2uR(0{Kjf+SMeUktef``iXD}8` zGufkM9*Sx4>+5WcK#Vqm$g#5z1DUhc_#gLGe4_icSzN5GKr|J&eB)LS;jTXWA$?(k zy?*%U9Q#Y88(blIlxrtKp6^jksNF>-K1?8=pmYAPj?qq}yO5L>_s8CAv=LQMe3J6? zOfWD>Kx_5A4jRoIU}&aICTgdYMqC|45}St;@0~7>Af+uK3vps9D!9qD)1;Y6Fz>4^ zR1X$s{QNZl7l%}Zwo2wXP+Cj-K|^wqZW?)s1WUw_APZLhH55g{wNW3liInD)WHh${ zOz&K>sB*4inVY3m)3z8w!yUz+CKF%_-s2KVr7DpwTUuZjPS9k-em^;>H4*?*B0Bg7 zLy2nfU=ac5N}x1+Tlq^lkNmB~Dj+t&l#fO&%|7~2iw*N!*xBy+ZBQ>#g_;I*+J{W* z=@*15><)Bh9f>>dgQrEhkrr2FEJ;R2rH%`kda8sD-FY6e#7S-<)V*zQA>)Ps)L- zgUuu@5;Ych#jX_KZ+;qEJJbu{_Z9WSsLSo#XqLpCK$gFidk}gddW(9$v}iyGm_OoH ztn$pv81zROq686_7@avq2heXZnkRi4n(3{5jTDO?9iP%u8S4KEqGL?^uBeg(-ws#1 z9!!Y_2Q~D?gCL3MQZO!n$+Wy(Twr5AS3{F7ak2f)Bu0iG^k^x??0}b6l!>Vjp{e*F z8r*(Y?3ZDDoS1G?lz#J4`d9jAEc9YGq1LbpYoFl!W!(j8-33Ey)@yx+BVpDIVyvpZ zq5QgKy>P}LlV?Bgy@I)JvefCG)I69H1;q@{8E8Ytw^s-rC7m5>Q>ZO(`$`9@`49s2)q#{2eN0A?~qS8%wxh%P*99h*Sv` zW_z3<=iRZBQKaDsKw^TfN;6`mRck|6Yt&e$R~tMA0ix;qgw$n~fe=62aG2v0S`7mU zI}gR#W)f+Gn=e3mm*F^r^tcv&S`Rym`X`6K`i8g-a0!p|#69@Bl!*&)QJ9(E7ycxz z)5-m9v`~$N1zszFi^=m%vw}Y{ZyYub!-6^KIY@mwF|W+|t~bZ%@rifEZ-28I@s$C` z>E+k~R1JC-M>8iC_GR>V9f9+uL2wPRATL9bC(sxd;AMJ>v6c#PcG|Xx1N5^1>ISd0 z4%vf-SNOw+1%yQq1YP`>iqq>5Q590_pr?OxS|HbLjx=9~Y)QO37RihG%JrJ^=Nj>g zPTcO$6r{jdE_096b&L;Wm8vcxUVxF0mA%W`aZz4n6XtvOi($ zaL!{WUCh&{5ar=>u)!mit|&EkGY$|YG<_)ZD)I32uEIWwu`R-_ z`FVeKyrx3>8Ep#2~%VVrQ%u#exo!anPe`bc)-M=^IP1n1?L2UQ@# zpNjoq-0+XCfqXS!LwMgFvG$PkX}5^6yxW)6%`S8{r~BA2-c%-u5SE#%mQ~5JQ=o$c z%+qa0udVq9`|=2n=0k#M=yiEh_vp?(tB|{J{EhVLPM^S@f-O*Lgb390BvwK7{wfdMKqUc0uIXKj5>g^z z#2`5^)>T73Eci+=E4n&jl42E@VYF2*UDiWLUOgF#p9`E4&-A#MJLUa&^hB@g7KL+n zr_bz+kfCcLIlAevILckIq~RCwh6dc5@%yN@#f3lhHIx4fZ_yT~o0#3@h#!HCN(rHHC6#0$+1AMq?bY~(3nn{o5g8{*e_#4RhW)xPmK zTYBEntuYd)`?`bzDksI9*MG$=^w!iiIcWg1lD&kM1NF@qKha0fDVz^W7JCam^!AQFxY@7*`a3tfBwN0uK_~YBQ18@^i%=YB}K0Iq(Q3 z=7hNZ#!N@YErE7{T|{kjVFZ+f9Hn($zih;f&q^wO)PJSF`K)|LdT>!^JLf=zXG>>G z15TmM=X`1%Ynk&dvu$Vic!XyFC(c=qM33v&SIl|p+z6Ah9(XQ0CWE^N-LgE#WF6Z+ zb_v`7^Rz8%KKg_@B>5*s-q*TVwu~MCRiXvVx&_3#r1h&L+{rM&-H6 zrcgH@I>0eY8WBX#Qj}Vml+fpv?;EQXBbD0lx%L?E4)b-nvrmMQS^}p_CI3M24IK(f| zV?tWzkaJXH87MBz^HyVKT&oHB;A4DRhZy;fIC-TlvECK)nu4-3s7qJfF-ZZGt7+6C3xZt!ZX4`M{eN|q!y*d^B+cF5W- zc9C|FzL;$bAfh56fg&y0j!PF8mjBV!qA=z$=~r-orU-{0AcQUt4 zNYC=_9(MOWe$Br9_50i#0z!*a1>U6ZvH>JYS9U$kkrCt7!mEUJR$W#Jt5vT?U&LCD zd@)kn%y|rkV|CijnZ((B2=j_rB;`b}F9+E1T46sg_aOPp+&*W~44r9t3AI}z)yUFJ z+}z5E6|oq+oPC3Jli)EPh9)o^B4KUYkk~AU9!g`OvC`a!#Q>JmDiMLTx>96_iDD9h@nW%Je4%>URwYM%5YU1&Dcdulvv3IH3GSrA4$)QjlGwUt6 zsR6+PnyJ$1x{|R=ogzErr~U|X!+b+F8=6y?Yi`E$yjWXsdmxZa^hIqa)YV9ubUqOj&IGY}bk zH4*DEn({py@MG5LQCI;J#6+98GaZYGW-K-&C`(r5#?R0Z){DlY8ZZk}lIi$xG}Q@2 z0LJhzuus-7dLAEpG1Lf+KOxn&NSwO{wn_~e0=}dovX)T(|WRMTqacoW8;A>8tTDr+0yRa+U!LW z!H#Gnf^iCy$tTk3kBBC=r@xhskjf1}NOkEEM4*r+A4`yNAIjz`_JMUI#xTf$+{UA7 zpBO_aJkKz)iaKqRA{8a6AtpdUwtc#Y-hxtZnWz~i(sfjMk`lq|kGea=`62V6y)TMPZw8q}tFDDHrW_n(Z84ZxWvRrntcw;F|Mv4ff9iaM% z4IM{=*zw}vIpbg=9%w&v`sA+a3UV@Rpn<6`c&5h+8a7izP>E@7CSsCv*AAvd-izwU z!sGJQ?fpCbt+LK`6m2Z3&cKtgcElAl){*m0b^0U#n<7?`8ktdIe#ytZTvaZy728o6 z3GDmw=vhh*U#hCo0gb9s#V5(IILXkw>(6a?BFdIb0%3~Y*5FiMh&JWHd2n(|y@?F8 zL$%!)uFu&n+1(6)oW6Hx*?{d~y zBeR)N*Z{7*gMlhMOad#k4gf`37OzEJ&pH?h!Z4#mNNCfnDI@LbiU~&2Gd^q7ix8~Y6$a=B9bK(BaTEO0$Oh=VCkBPwt0 zf#QuB25&2!m7MWY5xV_~sf(0|Y*#Wf8+FQI(sl2wgdM5H7V{aH6|ntE+OcLsTC`u; zeyrlkJgzdIb5=n#SCH)+kjN)rYW7=rppN3Eb;q_^8Zi}6jtL@eZ2XO^w{mCwX(q!t ztM^`%`ndZ5c+2@?p>R*dDNeVk#v>rsn>vEo;cP2Ecp=@E>A#n0!jZACKZ1=D0`f|{ zZnF;Ocp;$j86m}Gt~N+Ch6CJo7+Wzv|nlsXBvm z?St-5Ke&6hbGAWoO!Z2Rd8ARJhOY|a1rm*sOif%Th`*=^jlgWo%e9`3sS51n*>+Mh(9C7g@*mE|r%h*3k6I_uo;C!N z7CVMIX4kbA#gPZf_0%m18+BVeS4?D;U$QC`TT;X zP#H}tMsa=zS6N7n#BA$Fy8#R7vOesiCLM@d1UO6Tsnwv^gb}Q9I}ZQLI?--C8ok&S z9Idy06+V(_aj?M78-*vYBu|AaJ9mlEJpFEIP}{tRwm?G{ag>6u(ReBKAAx zDR6qe!3G88NQP$i99DZ~CW9lzz}iGynvGA4!yL}_9t`l*SZbEL-%N{n$%JgpDHJRn zvh<{AqR7z@ylV`kXdk+uEu-WWAt^=A4n(J=A1e8DpeLzAd;Nl#qlmp#KcHU!8`YJY zvBZy@>WiBZpx*wQ8JzKw?@k}8l99Wo&H>__vCFL}>m~MTmGvae% zPTn9?iR=@7NJ)?e+n-4kx$V#qS4tLpVUX*Je0@`f5LICdxLnph&Vjbxd*|+PbzS(l zBqqMlUeNoo8wL&_HKnM^8{iDI3IdzJAt32UupSr6XXh9KH2LjWD)Pz+`cmps%eHeD zU%i1SbPuSddp6?th;;DfUlxYnjRpd~i7vQ4V`cD%4+a9*!{+#QRBr5^Q$5Ec?gpju zv@dk9;G>d7QNEdRy}fgeA?i=~KFeibDtYffy)^OP?Ro~-X!onDpm+uGpe&6)*f@xJ zE1I3Qh}`1<7aFB@TS#}ee={<#9%1wOL%cuvOd($y4MC2?`1Nin=pVLXPkknn*0kx> z!9XHW${hYEV;r6F#iz7W=fg|a@GY0UG5>>9>$3Bj5@!N{nWDD`;JOdz_ZaZVVIUgH zo+<=+n8VGL*U%M|J$A~#ll__<`y+jL>bv;TpC!&|d=q%E2B|5p=)b-Q+ZrFO%+D_u z4%rc8BmOAO6{n(i(802yZW93?U;K^ZZlo0Gvs7B+<%}R;$%O}pe*Gi;!xP-M73W`k zXLv473Ex_VPcM-M^JO|H>KD;!sEGJ|E}Qepen;yNG2 zXqgD5sjQUDI(XLM+^8ZX1s_(X+PeyQ$Q5RukRt|Kwr-FSnW!^9?OG64UYX1^bU9d8 zJ}8K&UEYG+Je^cThf8W*^RqG07nSCmp*o5Z;#F zS?jochDWX@p+%CZ%dOKUl}q{9)^U@}qkQtA3zBF)`I&zyIKgb{mv)KtZ}?_h{r#VZ z%C+hwv&nB?we0^H+H`OKGw-&8FaF;=ei!tAclS5Q?qH9J$nt+YxdKkbRFLnWvn7GH zezC6<{mK0dd763JlLFqy&Oe|7UXII;K&2pye~yG4jldY~N;M9&rX}m76NsP=R#FEw zt(9h+=m9^zfl=6pH*D;JP~OVgbJkXh(+2MO_^;%F{V@pc2nGn~=U)Qx|JEV-e=vXk zPxA2J<9~IH{}29#X~KW$(1reJv}lc4_1JF31gdev>!CddVhf_62nsr6%w)?IWxz}{ z(}~~@w>c07!r=FZANq4R!F2Qi2?QGavZ{)PCq~X}3x;4ylsd&m;dQe;0GFSn5 zZ*J<=Xg1fEGYYDZ0{Z4}Jh*xlXa}@412nlKSM#@wjMM z*0(k>Gfd1Mj)smUuX}EM6m)811%n5zzr}T?$ZzH~*3b`3q3gHSpA<3cbzTeRDi`SA zT{O)l3%bH(CN0EEF9ph1(Osw5y$SJolG&Db~uL!I3U{X`h(h%^KsL71`2B1Yn z7(xI+Fk?|xS_Y5)x?oqk$xmjG@_+JdErI(q95~UBTvOXTQaJs?lgrC6Wa@d0%O0cC zzvslIeWMo0|C0({iEWX{=5F)t4Z*`rh@-t0ZTMse3VaJ`5`1zeUK0~F^KRY zj2z-gr%sR<(u0@SNEp%Lj38AB2v-+cd<8pKdtRU&8t3eYH#h7qH%bvKup4cnnrN>l z!5fve)~Y5_U9US`uXDFoOtx2gI&Z!t&VPIoqiv>&H(&1;J9b}kZhcOX7EiW*Bujy#MaCl52%NO-l|@2$aRKvZ!YjwpXwC#nA(tJtd1p?jx&U|?&jcb!0MT6oBlWurVRyiSCX?sN3j}d zh3==XK$^*8#zr+U^wk(UkF}bta4bKVgr`elH^az{w(m}3%23;y7dsEnH*pp{HW$Uk zV9J^I9ea7vp_A}0F8qF{>|rj`CeHZ?lf%HImvEJF<@7cgc1Tw%vAUA47{Qe(sP^5M zT=z<~l%*ZjJvObcWtlN?0$b%NdAj&l`Cr|x((dFs-njsj9%IIqoN|Q?tYtJYlRNIu zY(LtC-F14)Og*_V@gjGH^tLV4uN?f^#=dscCFV~a`r8_o?$gj3HrSk=YK2k^UW)sJ z&=a&&JkMkWshp0sto$c6j8f$J!Bsn*MTjC`3cv@l@7cINa!}fNcu(0XF7ZCAYbX|WJIL$iGx8l zGFFQsw}x|i!jOZIaP{@sw0BrV5Z5u!TGe@JGTzvH$}55Gf<;rieZlz+6E1}z_o3m2 z(t;Cp^Geen7iSt)ZVtC`+tzuv^<6--M`^5JXBeeLXV)>2;f7=l%(-4?+<5~;@=Th{1#>rK3+rLn(44TAFS@u(}dunUSYu}~))W*fr` zkBL}3k_@a4pXJ#u*_N|e#1gTqxE&WPsfDa=`@LL?PRR()9^HxG?~^SNmeO#^-5tMw zeGEW&CuX(Uz#-wZOEt8MmF}hQc%14L)0=ebo`e$$G6nVrb)afh!>+Nfa5P;N zCCOQ^NRel#saUVt$Ds0rGd%gkKP2LsQRxq6)g*`-r(FGM!Q51c|9lk!ha8Um3ys1{ zWpT7XDWYshQ{_F!8D8@3hvXhQDw;GlkUOzni&T1>^uD){WH3wRONgjh$u4u7?+$(Y zqTXEF>1aPNZCXP0nJ;zs6_%6;+D&J_|ugcih**y(4ApT`RKAi5>SZe0Bz|+l7z>P14>0ljIH*LhK z@}2O#{?1RNa&!~sEPBvIkm-uIt^Pt#%JnsbJ`-T0%pb ze}d;dzJFu7oQ=i`VHNt%Sv@?7$*oO`Rt*bRNhXh{FArB`9#f%ksG%q?Z`_<19;dBW z5pIoIo-JIK9N$IE1)g8@+4}_`sE7;Lus&WNAJ^H&=4rGjeAJP%Dw!tn*koQ&PrNZw zY88=H7qpHz11f}oTD!0lWO>pMI;i4sauS`%_!zM!n@91sLH#rz1~iEAu#1b%LA zhB}7{1(8{1{V8+SEs=*f=FcRE^;`6Pxm$Hie~|aD~W1BYy#@Y$C?pxJh*cC!T@8C9{xx*T*8P zhbkRk3*6)Zbk%}u>^?ItOhxdmX$j9KyoxxN>NrYGKMkLF4*fLsL_PRjHNNHCyaUHN z7W8yEhf&ag07fc9FD>B{t0#Civsoy0hvVepDREX(NK1LbK0n*>UJp&1FygZMg7T^G z(02BS)g#qMOI{RJIh7}pGNS8WhSH@kG+4n=(8j<+gVfTur)s*hYus70AHUBS2bN6Zp_GOHYxsbg{-Rcet{@0gzE`t$M0_!ZIqSAIW53j+Ln7N~8J zLZ0DOUjp^j`MvX#hq5dFixo^1szoQ=FTqa|@m>9F@%>7OuF9&_C_MDco&-{wfLKNrDMEN4pRUS8-SD6@GP`>_7$;r>dJo>KbeXm>GfQS? zjFS+Y6^%pDCaI0?9(z^ELsAE1`WhbhNv5DJ$Y}~r;>FynHjmjmA{bfDbseZXsKUv`%Fekv)1@f%7ti;B5hhs}5db1dP+P0${1DgKtb(DvN}6H6;0*LP6blg*rpr;Z(7? zrve>M`x6ZI(wtQc4%lO?v5vr{0iTPl&JT!@k-7qUN8b$O9YuItu7zrQ*$?xJIN#~b z#@z|*5z&D7g5>!o(^v+3N?JnJns5O2W4EkF>re*q1uVjgT#6ROP5>Ho)XTJoHDNRC zuLC(Cd_ZM?FAFPoMw;3FM4Ln0=!+vgTYBx2TdXpM@EhDCorzTS6@2`swp4J^9C0)U zq?)H8)=D;i+H`EVYge>kPy8d*AxKl};iumYu^UeM+e_3>O+LY`D4?pD%;Vextj!(; zomJ(u+dR(0m>+-61HTV7!>03vqozyo@uY@Zh^KrW`w7^ENCYh86_P2VC|4}(ilMBe zwa&B|1a7%Qkd>d14}2*_yYr@8-N}^&?LfSwr)C~UUHr)ydENu=?ZHkvoLS~xTiBH= zD%A=OdoC+10l7@rXif~Z#^AvW+4M-(KQBj=Nhgts)>xmA--IJf1jSZF6>@Ns&nmv} zXRk`|`@P5_9W4O-SI|f^DCZ-n*yX@2gf6N)epc~lRWl7QgCyXdx|zr^gy>q`Vwn^y z&r3_zS}N=HmrVtTZhAQS`3$kBmVZDqr4+o(oNok?tqel9kn3;uUerFRti=k+&W{bb zT{ZtEf51Qf+|Jc*@(nyn#U+nr1SFpu4(I7<1a=)M_yPUAcKVF+(vK!|DTL2;P)yG~ zrI*7V)wN_92cM)j`PtAOFz_dO)jIfTeawh2{d@x0nd^#?pDkBTBzr0Oxgmvjt`U^$ zcTPl=iwuen=;7ExMVh7LLFSKUrTiPJpMB&*Ml32>wl} zYn(H0N4+>MCrm2BC4p{meYPafDEXd4yf$i%ylWpC|9%R4XZBUQiha(x%wgQ5iJ?K_wQBRfw z+pYuKoIameAWV7Ex4$PCd>bYD7)A9J`ri&bwTRN*w~7DR0EeLXW|I2()Zkl6vxiw? zFBX){0zT@w_4YUT4~@TXa;nPb^Tu$DJ=vluc~9)mZ}uHd#4*V_eS7)^eZ9oI%Wws_ z`;97^W|?_Z6xHSsE!3EKHPN<3IZ^jTJW=Il{rMmlnR#OuoE6dqOO1KOMpW84ZtDHNn)(pYvs=frO`$X}sY zKY0At$G85&2>B|-{*+B*aqQn&Mqjt*DVH2kdwEm5f}~Xwn9+tPt?EPwh8=8=VWA8rjt*bHEs1FJ92QohQ)Y z4sQH~AzB5!Pisyf?pVa0?L4gthx2;SKlrr?XRU`?Y>RJgUeJn!az#sNF7oDbzksrD zw8)f=f1t*UK&$}_ktf!yf4Rjt{56ffTA{A=9n})E7~iXaQkE+%GW4zqbmlYF(|hE@ z421q9`UQf$uA5yDLx67`=EnSTxdEaG!6C%9_obpb?;u-^QFX% zU1wQ}Li{PeT^fS;&Sk2#$ZM#Zpxrn7jsd<@qhfWy*H)cw9q!I9!fDOCw~4zg zbW`EHsTp9IQUCETUse)!ZmuRICx}0Oe1KVoqdK+u>67A8v`*X*!*_i5`_qTzYRkbYXg#4vT5~A{lK#bA}Oc4ePu5hr-@;i%Z!4Y;-(yR z(1rHYTc7i1h1aipP4DaIY3g2kF#MX{XW7g&zL!39ohO98=eo5nZtq+nz}2E$OZpxx z&OFaOM1O;?mxq+`%k>YS!-=H7BB&WhqSTUC{S!x*k9E zcB;u0I!h%3nEchQwu1GnNkaQxuWnW0D@Xq5j@5WE@E(WlgDU;FLsT*eV|Bh)aH0;~@^yygFj<=+Vu3p)LlF%1AA%y5z-Oh`2 z$RDKk_6r+f#I`8fQ%y#Wx%~de1qkWL2(q^~veLKwht-dIcpt(@lc>`~@mISRIPKPm zD!Za&aX@7dy*CT!&Z7JC1jP2@8+ro8SmlH>_gzRte%ojgiwfd?TR+%Ny0`sp`QRLy zl5TiQkFhIC!2aaJ&=Ua`c9UuOk9GkSFZ}!IGeMZ5MXrL zGtMj`m{(X9+l%=d|L zW2OY?8!_pyhvJ1@O!Chsf6}@3HmKq@)x;CFItPMpkSr@npO&8zMc_O?*|sqkuL^U? zV9+x3vbr|6;Ft0J^J>IH_xpa<{S5K?u-sQWC7FB9YFMwoCKK3WZ*gvO-wAApF`K%#7@1 z^sEj4*%hH`f0@sRDGI|#Dl20o$Z*gttP$q(_?#~2!H9(!d=)I93-3)?e%@$1^*F=t9t&OQ9!p84Z`+y<$yQ9wlamK~Hz2CRpS8dWJfBl@(M2qX!9d_F= zd|4A&U~8dX^M25wyC7$Swa22$G61V;fl{%Q4Lh!t_#=SP(sr_pvQ=wqOi`R)do~QX zk*_gsy75$xoi5XE&h7;-xVECk;DLoO0lJ3|6(Ba~ezi73_SYdCZPItS5MKaGE_1My zdQpx?h&RuoQ7I=UY{2Qf ziGQ-FpR%piffR_4X{74~>Q!=i`)J@T415!{8e`AXy`J#ZK)5WWm3oH?x1PVvcAqE@ zWI|DEUgxyN({@Y99vCJVwiGyx@9)y2jNg`R{$s2o;`4!^6nDX_pb~fTuzf>ZoPV@X zXKe1ehcZ+3dxCB+vikgKz8pvH?>ZzlOEObd{(-aWY;F0XIbuIjSA+!%TNy87a>BoX zsae$}Fcw&+)z@n{Fvzo;SkAw0U*}?unSO)^-+sbpNRjD8&qyfp%GNH;YKdHlz^)4( z;n%`#2Pw&DPA8tc)R9FW7EBR3?GDWhf@0(u3G4ijQV;{qp3B)`Fd}kMV}gB2U%4Sy z3x>YU&`V^PU$xWc4J!OG{Jglti@E3rdYo62K31iu!BU&pdo}S66Ctq{NB<88P92Y9 zTOqX$h6HH_8fKH(I>MEJZl1_2GB~xI+!|BLvN;CnQrjHuh?grzUO7h;1AbzLi|_O= z2S=(0tX#nBjN92gRsv;7`rDCATA!o(ZA}6)+;g;T#+1~HXGFD1@3D#|Ky9!E@)u=h z3@zg3Us0BCYmq(pB`^QTp|RB9!lX*{;7r|Z(^>J+av(0-oUmIdR78c4(q%hP#=R@W ze{;yy$T^8kXr(oC*#NQMZSQlgU)aa=BrZDwpLUk5tm&(AkNt&Gel`=ydcL*<@Ypx{ z2uOxl>2vSY2g3%Si&JU<9D5#{_z{9PzJh=miNH;STk^;5#%8iMRfPe#G~T>^U_zt? zgSE)`UQhb!G$at%yCf5MU)<&(L73(hY3*%qqPbX;`%QDHed3ZaWw^k)8Vjd#ePg@;I&pMe+A18k+S+bou|QX?8eQ`{P-0vrm=uR;Y(bHV>d>Gen4LHILqcm_ z3peDMRE3JMA8wWgPkSthI^K<|8aal38qvIcEgLjHAFB0P#IfqP2y}L>=8eBR}Fm^V*mw2Q4+o=exP@*#=Zs zIqHh@neG)Vy%v4cB1!L}w9J>IqAo}CsqbFPrUVc@;~Ld7t_2IIG=15mT7Itrjq#2~ zqX*&nwZP>vso$6W!#` z-YZ}jhBwQku-Qc>TIMpn%_z~`^u4v3Skyf)KA}V{`dr!Q;3xK1TuGYdl}$sKF^9X!*a-R*Oq1#tLq!W)gO}{q`1HM;oh1-k4FU@8W(qe>P05$+ z`ud2&;4IW4vq8#2yA{G>OH=G+pS_jctJ*BqD$j-MI#avR+<>m-`H1@{3VgKYn2_Ih z0`2_1qUMRuzgj_V^*;5Ax_0s{_3tYR>|$i#c!F7)#`oVGmsD*M2?%930cBSI4Mj>P zTm&JmUrvDXlB%zeA_7$&ogjGK3>SOlV$ct{4)P0k)Kua%*fx9?)_fkvz<(G=F`KCp zE`0j*=FzH$^Y@iUI}MM2Hf#Yr@oQdlJMB5xe0$aGNk%tgex;0)NEuVYtLEvOt{}ti zL`o$K9HnnUnl*;DTGTNiwr&ydfDp@3Y)g5$pcY9l1-9g;yn6SBr_S9MV8Xl+RWgwb zXL%kZLE4#4rUO(Pj484!=`jy74tQxD0Zg>99vvQ}R$7~GW)-0DVJR@$5}drsp3IQG zlrJL}M{+SdWbrO@+g2BY^a}0VdQtuoml`jJ2s6GsG5D@(^$5pMi3$27psEIOe^n=*Nj|Ug7VXN0OrwMrRq&@sR&vdnsRlI%*$vfmJ~)s z^?lstAT$Ked`b&UZ@A6I<(uCHGZ9pLqNhD_g-kj*Sa#0%(=8j}4zd;@!o;#vJ+Bsd z4&K4RIP>6It9Ir)ey?M6Gi6@JzKNg;=jM=$)gs2#u_WhvuTRwm1x2^*!e%l&j02xz zYInQgI$_V7Epzf3*BU~gos}|EurFj8l}hsI(!5yX!~ECL%cnYMS-e<`AKDL%(G)62 zPU;uF1(~(YbH2444JGh58coXT>(*CdEwaFuyvB|%CULgVQesH$ znB`vk3BMP<-QauWOZ0W6xB5y7?tE5cisG|V;bhY^8+*BH1T0ZLbn&gi12|a9Oa%;I zxvaxX_xe3@ng%;4C?zPHQ1v%dbhjA6Sl7w<*)Nr#F{Ahzj}%n9c&!g5HVrlvUO&R2C)_$x6M9 zahficAbeHL2%jILO>Pq&RPPxl;i{K5#O*Yt15AORTCvkjNfJ)LrN4K{sY7>tGuTQ@ z^?N*+xssG&sfp0c$^vV*H)U1O!fTHk8;Q7@42MT@z6UTd^&DKSxVcC-1OLjl7m63& zBb&goU!hes(GF^yc!107bkV6Pr%;A-WWd@DK2;&=zyiK*0i^0@f?fh2c)4&DRSjrI zk!W^=l^JKlPW9US{*yo?_XT@T2Bx+Cm^+r{*5LVcKVw*ll3+)lkebA-4)o z8f5xHWOx0!FDSs4nv@o@>mxTQrOeKzj@5uL`d>mXSp|#{FE54EE_!KtQNq>-G(&5) ztz?xkqPU16A-8@-quJ|SU^ClZ?bJ2kCJPB|6L>NTDYBprw$WcwCH{B z5qlJ6wK_9sT@Kl6G|Q&$gsl@WT>hE;nDAbH#%f1ZwuOkvWLj{qV$m3LF423&l!^iV zhym*>R>Yyens++~6F5+uZQTCz9t~PEW+e?w)XF2g!^^%6k?@Jcu;MG0FG9!T+Gx{Z zK;31y@(J{!-$k4E{5#Sv(2DGy3EZQY}G_*z*G&CZ_J?m&Fg4IBrvPx1w z1zAb3k}6nT?E)HNCi%}aR^?)%w-DcpBR*tD(r_c{QU6V&2vU-j0;{TVDN6los%YJZ z5C(*ZE#kv-BvlGLDf9>EO#RH_jtolA)iRJ>tSfJpF!#DO+tk% zBAKCwVZwO^p)(Rhk2en$XLfWjQQ`ix>K}Ru6-sn8Ih6k&$$y`zQ}}4dj~o@9gX9_= z#~EkchJqd5$**l}~~6mOl(q#GMIcFg&XCKO;$w>!K14 zko1egAORiG{r|8qj*FsN>?7d`han?*MD#xe^)sOqj;o;hgdaVnBH$BM{_73?znS+R z*G2VHM!Jw6#<FfJ-J%-9AuDW$@mc-Eyk~F{Jbvt` zn;(%DbBDnKIYr~|I>ZTvbH@cxUyw%bp*)OSs}lwO^HTJ2M#u5QsPF0?Jv*OVPfdKv z+t$Z5P!~jzZ~Y!d#iP?S{?M_g%Ua0Q)WawbIx+2uYpcf(7Im%W=rAu4dSceo7RZh# zN38=RmwOJQE$qbPXIuO^E`wSeJKCx3Q76irp~QS#19dusEVCWPrKhK9{7cbIMg9U} TZiJi*F`$tkWLn) diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties deleted file mode 100644 index 09523c0..0000000 --- a/gradle/wrapper/gradle-wrapper.properties +++ /dev/null @@ -1,7 +0,0 @@ -distributionBase=GRADLE_USER_HOME -distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-8.9-bin.zip -networkTimeout=10000 -validateDistributionUrl=true -zipStoreBase=GRADLE_USER_HOME -zipStorePath=wrapper/dists diff --git a/ndk/README.md b/ndk/README.md index 6af8bfa..fd6e86c 100644 --- a/ndk/README.md +++ b/ndk/README.md @@ -13,13 +13,10 @@ The app loads `libandroidcast_codecs.so` for availability probes and future soft ## Enable native codecs (developer) -1. Initialize submodules as needed: +1. Initialize all third-party submodules: ```bash - git submodule update --init third-party/libvpx - git submodule update --init third-party/opus - git submodule update --init third-party/speex - git submodule update --init third-party/wireguard-android + bash scripts/init-third-party-submodules.sh ``` 2. Build static libs per ABI (NDK auto-detected via `scripts/android-ndk.sh`): diff --git a/rebuild.sh b/rebuild.sh index d0da09c..7c8dce4 100755 --- a/rebuild.sh +++ b/rebuild.sh @@ -142,6 +142,9 @@ export ANDROIDCAST_ROOT="$ROOT" export ANDROID_NDK_HOME="$(androidcast_find_ndk_root "$ROOT")" export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME" echo "==> Using NDK: $ANDROID_NDK_HOME" + +echo "==> Initializing third-party git submodules (libvpx, opus, speex, wireguard-android)" +bash "$ROOT/scripts/init-third-party-submodules.sh" if androidcast_ccache_wanted 2>/dev/null; then echo "==> Native ccache: enabled (ANDROIDCAST_CCACHE=${ANDROIDCAST_CCACHE:-auto})" else @@ -158,15 +161,18 @@ for ARCH_ABI in ${ARCH_ABIS}; do LC_ALL=C ./scripts/build-native-codecs.sh "${ARCH_ABI}" done +WG_HEAD="$(git -C "$ROOT/third-party/wireguard-android" rev-parse --short HEAD 2>/dev/null || echo unknown)" +echo "==> Building wireguard-android (:tunnel) from third-party/wireguard-android @ $WG_HEAD" echo "==> Building debug APK (JAVA_HOME=$JAVA_HOME)" # Docker CI on a mounted repo leaves app/.cxx with /opt/android-sdk paths; that breaks local clean/build. rm -rf "$ROOT/app/.cxx" +rm -rf "$ROOT/gradle/wireguard-tunnel/.cxx" "$ROOT/gradle/wireguard-tunnel/build" 2>/dev/null || true if [[ -d "$ROOT/app/build" ]] && ! rm -rf "$ROOT/app/build" 2>/dev/null; then echo "WARN: app/build is not writable (often root-owned after Docker). Run: sudo rm -rf app/build" >&2 fi ./gradlew --stop ./gradlew clean -./gradlew --build-cache assembleDebug +./gradlew --build-cache :tunnel:assembleDebug :app:assembleDebug if [[ "$RUN_UNIT_TESTS" == "1" ]]; then echo "==> Running unit tests (./gradlew testDebugUnitTest)" diff --git a/scripts/build-native-codecs.sh b/scripts/build-native-codecs.sh index de4edfb..3c099bb 100755 --- a/scripts/build-native-codecs.sh +++ b/scripts/build-native-codecs.sh @@ -3,7 +3,7 @@ # CMake in ndk/ autolinks when those archives exist (ANDROIDCAST_HAVE_* = 1). # # Prerequisites: -# git submodule update --init third-party/libvpx +# bash scripts/init-third-party-submodules.sh # Android NDK (auto-detected via scripts/android-ndk.sh) # # Usage: @@ -22,7 +22,7 @@ BUILD_DIR="$OUT/libvpx-build" if [[ ! -d "$VPX_SRC_REAL" ]]; then echo "ERROR: $VPX_SRC_REAL missing. Run:" - echo " git submodule update --init third-party/libvpx" + echo " bash scripts/init-third-party-submodules.sh" exit 1 fi @@ -253,7 +253,7 @@ androidcast_ndk_configure_host() { build_opus_for_abi() { local opus_src="$ROOT/third-party/opus" if [[ ! -f "$opus_src/CMakeLists.txt" ]]; then - echo "Skip libopus: $opus_src missing (git submodule update --init third-party/opus)" + echo "Skip libopus: $opus_src missing (bash scripts/init-third-party-submodules.sh)" return 0 fi local opus_build="$BUILD_DIR/opus-cmake" @@ -284,7 +284,7 @@ build_opus_for_abi() { build_speex_for_abi() { local speex_src_real="$ROOT/third-party/speex" if [[ ! -d "$speex_src_real" ]]; then - echo "Skip libspeex: $speex_src_real missing (git submodule update --init third-party/speex)" + echo "Skip libspeex: $speex_src_real missing (bash scripts/init-third-party-submodules.sh)" return 0 fi local speex_src="$speex_src_real" diff --git a/scripts/ci-build-and-publish-ota.sh b/scripts/ci-build-and-publish-ota.sh index bbfb1d7..9d764e6 100755 --- a/scripts/ci-build-and-publish-ota.sh +++ b/scripts/ci-build-and-publish-ota.sh @@ -61,6 +61,9 @@ if [[ -n "${ANDROID_SDK_ROOT:-}" ]]; then printf 'sdk.dir=%s\n' "${ANDROID_SDK_ROOT//\\/\\\\}" > "$LOCAL_PROPS" fi +echo "==> Phase: third-party submodules (libvpx, opus, speex, wireguard-android)" +bash "$ROOT/scripts/init-third-party-submodules.sh" + if [[ "$RUN_NATIVE" == "1" && "$RUN_APK" == "1" ]]; then echo "==> Phase: native codecs" ABIS="${ANDROIDCAST_CI_ABIS:-armeabi-v7a arm64-v8a x86_64}" @@ -75,17 +78,21 @@ fi # Avoid host-specific CMake cache paths when running in Docker. rm -rf "$ROOT/app/.cxx" "$ROOT/app/build/.cxx" "$ROOT/app/build/intermediates/cxx" +rm -rf "$ROOT/gradle/wireguard-tunnel/.cxx" "$ROOT/gradle/wireguard-tunnel/build" 2>/dev/null || true + +WG_HEAD="$(git -C "$ROOT/third-party/wireguard-android" rev-parse --short HEAD 2>/dev/null || echo unknown)" +echo "==> Phase: wireguard-android (:tunnel) third-party/wireguard-android @ ${WG_HEAD}" if [[ "$RUN_APK" == "1" ]]; then - echo "==> Phase: gradle ${GRADLE_TASK}" + echo "==> Phase: gradle :tunnel + ${GRADLE_TASK}" if [[ "$RUN_UNIT_TESTS" == "1" ]]; then - ./gradlew --no-daemon "${GRADLE_JAVA_OPT[@]}" clean "${GRADLE_TASK}" testDebugUnitTest + ./gradlew --no-daemon "${GRADLE_JAVA_OPT[@]}" clean :tunnel:assembleDebug "${GRADLE_TASK}" testDebugUnitTest else - ./gradlew --no-daemon "${GRADLE_JAVA_OPT[@]}" clean "${GRADLE_TASK}" + ./gradlew --no-daemon "${GRADLE_JAVA_OPT[@]}" clean :tunnel:assembleDebug "${GRADLE_TASK}" fi else - echo "==> Phase: gradle tests-only" - ./gradlew --no-daemon "${GRADLE_JAVA_OPT[@]}" testDebugUnitTest + echo "==> Phase: gradle tests-only (:tunnel + testDebugUnitTest)" + ./gradlew --no-daemon "${GRADLE_JAVA_OPT[@]}" :tunnel:assembleDebug testDebugUnitTest fi APK="" diff --git a/scripts/ci-build.sh b/scripts/ci-build.sh index 7981f13..4f262be 100755 --- a/scripts/ci-build.sh +++ b/scripts/ci-build.sh @@ -14,9 +14,8 @@ source "$ROOT/scripts/android-ndk.sh" export ANDROID_NDK_HOME="$(androidcast_find_ndk_root "$ROOT")" export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME" -if [[ -f .gitmodules ]]; then - git submodule update --init --recursive -fi +echo "==> Initializing third-party git submodules" +bash "$ROOT/scripts/init-third-party-submodules.sh" ABIS="${ANDROIDCAST_CI_ABIS:-armeabi-v7a arm64-v8a x86_64}" echo "==> Building libvpx for: $ABIS" @@ -26,7 +25,7 @@ for abi in $ABIS; do ./scripts/build-native-codecs.sh "$abi" done -echo "==> Gradle assembleDebug + unit tests" -./gradlew --no-daemon clean assembleDebug testDebugUnitTest +echo "==> Gradle :tunnel + assembleDebug + unit tests" +./gradlew --no-daemon clean :tunnel:assembleDebug assembleDebug testDebugUnitTest echo "==> Done: $ROOT/app/build/outputs/apk/debug/app-debug.apk" diff --git a/scripts/init-third-party-submodules.sh b/scripts/init-third-party-submodules.sh new file mode 100755 index 0000000..54647f6 --- /dev/null +++ b/scripts/init-third-party-submodules.sh @@ -0,0 +1,110 @@ +#!/usr/bin/env bash +# Sync and initialize all third-party/ git submodules from .gitmodules (recursive nested). +# Used by rebuild.sh, ci-build.sh, and deploy paths — no network except submodule fetch/update. +set -euo pipefail + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$ROOT" + +ONLY_PATH="" +while [[ $# -gt 0 ]]; do + case "$1" in + --only) + ONLY_PATH="${2:-}" + shift 2 + ;; + -h|--help) + echo "Usage: $0 [--only third-party/wireguard-android]" + echo " Initializes every path in .gitmodules under third-party/ (recursive)." + exit 0 + ;; + *) + echo "error: unknown argument: $1" >&2 + exit 1 + ;; + esac +done + +if [[ ! -f .gitmodules ]]; then + echo "error: .gitmodules not found in $ROOT" >&2 + exit 1 +fi + +mapfile -t SUB_PATHS < <(git config -f .gitmodules --get-regexp '^submodule\..*\.path$' \ + | awk '{ print $2 }' | grep '^third-party/' | sort -u) + +if [[ ${#SUB_PATHS[@]} -eq 0 ]]; then + echo "error: no third-party paths in .gitmodules" >&2 + exit 1 +fi + +if [[ -n "$ONLY_PATH" ]]; then + SUB_PATHS=("$ONLY_PATH") +fi + +ensure_gitlink() { + local path="$1" + local name="$path" + if git cat-file -e "HEAD:${path}" 2>/dev/null \ + || git ls-files --stage "$path" | grep -q '^160000'; then + return 0 + fi + local url + url="$(git config -f .gitmodules --get "submodule.${name}.url" || true)" + if [[ -z "$url" ]]; then + echo "error: $path listed in .gitmodules but no gitlink in tree and no url" >&2 + return 1 + fi + local sha + sha="$(git ls-remote "$url" HEAD | awk 'NR==1 {print $1}')" + if [[ -z "$sha" ]]; then + echo "error: could not resolve HEAD for $url (needed to register missing gitlink)" >&2 + return 1 + fi + echo "WARN: registering missing gitlink for $path at $sha (commit this gitlink)" >&2 + git update-index --add --cacheinfo 160000,"$sha","$path" +} + +validate_path() { + local path="$1" + case "$path" in + third-party/wireguard-android) + [[ -d "$path/tunnel/src/main/java" ]] \ + && [[ -f "$path/tunnel/tools/wireguard-tools/src/config.c" ]] \ + && [[ -f "$path/tunnel/tools/elf-cleaner/elf-cleaner.cpp" || -f "$path/tunnel/tools/elf-cleaner/main.cpp" ]] + ;; + third-party/libvpx) + [[ -d "$path" ]] + ;; + third-party/opus|third-party/speex) + [[ -f "$path/configure" || -f "$path/CMakeLists.txt" || -d "$path/include" ]] + ;; + *) + [[ -d "$path" ]] + ;; + esac +} + +echo "==> third-party submodules: sync + update --init --recursive" +for path in "${SUB_PATHS[@]}"; do + if ! grep -q "$path" .gitmodules 2>/dev/null; then + echo "error: $path not in .gitmodules" >&2 + exit 1 + fi + ensure_gitlink "$path" + git submodule sync "$path" + git submodule update --init --recursive "$path" + if ! validate_path "$path"; then + echo "error: $path incomplete after submodule update (nested submodules missing?)" >&2 + exit 1 + fi + short="$(git -C "$path" rev-parse --short HEAD 2>/dev/null || echo '?')" + echo " $path @ $short" +done + +if [[ -d third-party/wireguard-android/tunnel ]]; then + wg_tools="$(git -C third-party/wireguard-android/tunnel/tools/wireguard-tools rev-parse --short HEAD 2>/dev/null || echo '?')" + echo " third-party/wireguard-android/tunnel/tools/wireguard-tools @ $wg_tools" +fi + +echo "==> third-party submodules ready" diff --git a/scripts/init-wireguard-submodule.sh b/scripts/init-wireguard-submodule.sh index 734b83a..6acabbb 100755 --- a/scripts/init-wireguard-submodule.sh +++ b/scripts/init-wireguard-submodule.sh @@ -1,36 +1,5 @@ #!/usr/bin/env bash -# Initialize wireguard-android submodule (third-party/wireguard-android in .gitmodules). +# Back-compat wrapper — wireguard-android is one of the third-party submodules. set -euo pipefail ROOT="$(cd "$(dirname "$0")/.." && pwd)" -cd "$ROOT" - -SUB_PATH="third-party/wireguard-android" -SUB_NAME="third-party/wireguard-android" - -if ! grep -q "$SUB_PATH" .gitmodules 2>/dev/null; then - echo "error: .gitmodules missing $SUB_PATH" >&2 - exit 1 -fi - -# .gitmodules without a gitlink in the tree breaks plain `git submodule update`. -if ! git cat-file -e "HEAD:$SUB_PATH" 2>/dev/null \ - && ! git ls-files --stage "$SUB_PATH" | grep -q '^160000'; then - url="$(git config -f .gitmodules --get "submodule.$SUB_NAME.url" || true)" - if [ -z "$url" ]; then - echo "error: no url for submodule.$SUB_NAME in .gitmodules" >&2 - exit 1 - fi - sha="$(git ls-remote "$url" HEAD | awk 'NR==1 {print $1}')" - if [ -z "$sha" ]; then - echo "error: could not resolve HEAD for $url" >&2 - exit 1 - fi - echo "registering missing gitlink for $SUB_PATH at $sha" - git update-index --add --cacheinfo 160000,"$sha","$SUB_PATH" - echo "warning: gitlink was missing from the tree — commit third-party/wireguard-android after init" >&2 -fi - -git submodule sync "$SUB_PATH" -git submodule update --init --recursive "$SUB_PATH" -echo "wireguard-android ready under $SUB_PATH" -echo "Gradle includes :tunnel when $SUB_PATH/tunnel exists." +exec "$ROOT/scripts/init-third-party-submodules.sh" --only third-party/wireguard-android diff --git a/scripts/simulate-vpn-crashes.sh b/scripts/simulate-vpn-crashes.sh new file mode 100755 index 0000000..742e29c --- /dev/null +++ b/scripts/simulate-vpn-crashes.sh @@ -0,0 +1,196 @@ +#!/usr/bin/env bash +# VPN crash simulation lab — device (adb) and/or BE upload verification. +# +# Modes: +# MODE=device — trigger VpnCrashSimulator in :vpn via adb (debug APK) +# MODE=upload — POST synthetic vpn-process crash JSON to BE upload API +# MODE=both — device then verify BE (default when adb device present) +# +# Env: +# COUNT=70 +# BASE=https://apps.f0xx.org/app/androidcast_project/crashes +# RUN_ID=YYYYMMDD_HHMMSS (batch tag for Issues search) +# PACKAGE=com.foxx.androidcast +set -euo pipefail + +ROOT="$(cd "$(dirname "$0")/.." && pwd)" +COUNT="${COUNT:-70}" +BASE="${BASE:-https://apps.f0xx.org/app/androidcast_project/crashes}" +UPLOAD_URL="$BASE/api/upload.php" +PACKAGE="${PACKAGE:-com.foxx.androidcast}" +RUN_ID="${RUN_ID:-$(date -u +%Y%m%d_%H%M%S)}" +MODE="${MODE:-auto}" +JAR="${JAR:-/tmp/ac_vpn_crash_cookies.txt}" +DELAY_MS="${DELAY_MS:-80}" +VERIFY_LOGIN="${VERIFY_LOGIN:-1}" + +log() { printf '[vpn-crash-sim] %s\n' "$*"; } + +has_device() { + adb devices 2>/dev/null | awk 'NR>1 && $2=="device" { found=1 } END { exit !found }' +} + +simulate_device() { + local n="$1" + local i seq + log "device: triggering $n VPN-process crash recordings via $PACKAGE" + for ((i = 1; i <= n; i++)); do + seq="$i" + adb shell am start-service \ + -n "$PACKAGE/com.foxx.androidcast.vpn.AndroidCastVpnService" \ + -a com.foxx.androidcast.vpn.SIMULATE_CRASH \ + --ei sim_seq "$seq" >/dev/null 2>&1 \ + || adb shell am startservice \ + -n "$PACKAGE/com.foxx.androidcast.vpn.AndroidCastVpnService" \ + -a com.foxx.androidcast.vpn.SIMULATE_CRASH \ + --ei sim_seq "$seq" >/dev/null 2>&1 \ + || true + if [[ "$DELAY_MS" -gt 0 ]]; then + sleep "$(awk "BEGIN { print $DELAY_MS / 1000 }")" + fi + if (( i % 10 == 0 )); then + log " device progress $i/$n" + fi + done + log "device: done — waiting for crash watcher upload sweep" + sleep 15 +} + +upload_one() { + local seq="$1" + local report_id="vpn_sim_${RUN_ID}_$(printf '%03d' "$seq")" + local ms + ms="$(date +%s)000" + local fp + fp="$(printf 'vpn_sim_%s_%03d' "$RUN_ID" "$seq" | sha256sum | awk '{print $1}')" + local body + body="$(cat </dev/null || echo 0)" + log "verify: BE reports matching q=$q → $cnt (expected up to $COUNT)" + if [[ "$cnt" -lt 1 ]]; then + log "verify: WARN — Issues API returned 0 (login cookie may be invalid in automation)" + log "verify: open $BASE/?view=reports&q=$q in browser when logged in" + return 1 + fi + echo "$json" | python3 -c " +import json,sys +d=json.load(sys.stdin) +for it in (d.get('items') or [])[:3]: + p=it.get('payload') or {} + j=p.get('java') or {} + print(' sample:', it.get('report_id'), 'process=', p.get('process'), 'frames=', len(j.get('stack_frames') or [])) +" 2>/dev/null || true +} + +if [[ "$MODE" == "auto" ]]; then + if has_device; then + MODE=both + else + MODE=upload + log "no adb device — using upload-only mode" + fi +fi + +case "$MODE" in + device) + simulate_device "$COUNT" + ;; + upload) + simulate_upload "$COUNT" + verify_be || true + ;; + both) + simulate_device "$COUNT" + QUERY="${QUERY:-VpnCrashSimulation}" verify_be || true + ;; + *) + echo "unknown MODE=$MODE (device|upload|both)" >&2 + exit 1 + ;; +esac + +log "complete run_id=$RUN_ID — Issues: $BASE/?view=reports&q=$RUN_ID" diff --git a/settings.gradle b/settings.gradle index 406f3e7..3b0b36f 100644 --- a/settings.gradle +++ b/settings.gradle @@ -21,8 +21,13 @@ include ':app' include ':session-studio' project(':session-studio').projectDir = file('desktop/session-studio') -def wgTunnelDir = file('third-party/wireguard-android/tunnel') -if (wgTunnelDir.exists()) { - include ':tunnel' - project(':tunnel').projectDir = wgTunnelDir +def wgTunnelSrc = file('third-party/wireguard-android/tunnel') +if (!wgTunnelSrc.isDirectory()) { + throw new GradleException( + 'Missing third-party/wireguard-android/tunnel — run:\n' + + ' git submodule update --init --recursive third-party/wireguard-android\n' + + ' bash scripts/init-wireguard-submodule.sh' + ) } +include ':tunnel' +project(':tunnel').projectDir = file('gradle/wireguard-tunnel') diff --git a/third-party/README.md b/third-party/README.md index efe2202..05e15f2 100644 --- a/third-party/README.md +++ b/third-party/README.md @@ -1,19 +1,21 @@ # Third-party vendored dependencies -## wireguard-android (git submodule) +## wireguard-android (required git submodule) -Listed in `.gitmodules` like libvpx/opus/speex. Initialize after clone: +Listed in `.gitmodules` like libvpx/opus/speex. **Required for Gradle** — `:tunnel` is always included. Initialize after clone: ```bash -git submodule update --init third-party/wireguard-android -# or: +bash scripts/init-third-party-submodules.sh +# wireguard only: bash scripts/init-wireguard-submodule.sh ``` -Build with the `:tunnel` module (auto-included when present): +`rebuild.sh` and `scripts/ci-build.sh` run the init script automatically. + +Build links the `:tunnel` module via `gradle/wireguard-tunnel/` (sources from this submodule): - Submodule path: `third-party/wireguard-android/` - Gradle module: `third-party/wireguard-android/tunnel` - License: MIT / Apache-2.0 (see upstream `COPYING`) -`WireGuardTunnelBridge` loads `com.wireguard.android.backend.GoBackend` via reflection when the module is on the classpath. +`WireGuardVpnEngine` (in `:vpn` process) links `GoBackend` from `:tunnel` (native `libwg-go.so` built from this tree); main app uses `VpnServiceClient` AIDL.