daemon: stop closing adopted serial and input fds twice

.github/FUNDING.yml

@@ -0,0 +1,15 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+polar: # Replace with a single Polar username
+buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
+thanks_dev: # Replace with a single thanks.dev username
+custom: ['https://afdian.com/a/DroidVM']

.github/workflows/build.yml

@@ -5,6 +5,7 @@ on:
     branches: [ "**" ]
   pull_request:
     branches: [ "**" ]
+  workflow_dispatch:
 
 concurrency:
   group: build-${{ github.ref }}
@@ -13,6 +14,8 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      DROIDVM_PREBUILT_COMPRESSION_LEVEL: "9"
 
     steps:
       - name: Checkout repository
@@ -76,13 +79,15 @@ jobs:
           echo "name=${ver}" >> "$GITHUB_OUTPUT"
 
       - name: Upload debug APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: DroidVM-${{ steps.version.outputs.name }}-debug
           path: app/build/outputs/apk/debug/*.apk
+          archive: false
 
       - name: Upload release APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: DroidVM-${{ steps.version.outputs.name }}-release
           path: app/build/outputs/apk/release/*.apk
+          archive: false

.github/workflows/checks.yml

@@ -0,0 +1,41 @@
+name: Checks
+
+on:
+  push:
+    branches: [ "**" ]
+  pull_request:
+    branches: [ "**" ]
+  workflow_dispatch:
+
+concurrency:
+  group: checks-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        # No submodules: these checks only look at this repo's own sources.
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
+      - name: No non-ASCII in code/config
+        run: python3 scripts/ci/check_ascii.py
+
+      - name: Translations complete across all locales
+        run: python3 scripts/ci/check_translations.py
+
+      - name: Use fmt() instead of string concatenation
+        run: python3 scripts/ci/check_string_concat.py
+
+      - name: Icons are vector drawables
+        run: python3 scripts/ci/check_vector_icons.py
+
+      - name: No signature over the parameter limit
+        run: python3 scripts/ci/check_arity.py

.github/workflows/dev-release.yml

@@ -0,0 +1,127 @@
+name: Dev release
+
+# Every push to the default branch (re)publishes a rolling pre-release on a
+# dedicated `dev` tag. The tag is a moving label -- it is deleted and recreated
+# at the current commit each run, so it never pins a specific version. A GitHub
+# Release must be attached to a tag, hence the dummy `dev` tag.
+# (release.yml still cuts real, versioned releases on real tag pushes.)
+on:
+  push:
+    branches: [ master ]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: dev-release
+  cancel-in-progress: true
+
+jobs:
+  dev-release:
+    runs-on: ubuntu-latest
+    env:
+      DROIDVM_PREBUILT_COMPRESSION_LEVEL: "9"
+      HAS_SIGN_KEY: ${{ secrets.APP_SIGN_KEY_JKS != '' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+        with:
+          packages: build-tools;36.0.0
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+
+      # With a signing key: build and sign a real release APK (current
+      # behaviour). Without one: ship the debug APK -- signed with the
+      # auto-generated debug keystore -- instead of an unsigned release.
+      - name: Build release APK
+        if: ${{ env.HAS_SIGN_KEY == 'true' }}
+        run: ./gradlew assembleRelease
+
+      - name: Sign release APK
+        if: ${{ env.HAS_SIGN_KEY == 'true' }}
+        env:
+          APP_SIGN_KEY_JKS: ${{ secrets.APP_SIGN_KEY_JKS }}
+          APP_SIGN_KEY_PASS: ${{ secrets.APP_SIGN_KEY_PASS }}
+        run: |
+          BUILD_TOOLS="${ANDROID_HOME}/build-tools/36.0.0"
+          echo "$APP_SIGN_KEY_JKS" | base64 -d > /tmp/keystore.jks
+          UNSIGNED=$(find app/build/outputs/apk/release -name '*.apk' | head -1)
+          ALIGNED="${UNSIGNED%.apk}-aligned.apk"
+          "${BUILD_TOOLS}/zipalign" -f -v 4 "$UNSIGNED" "$ALIGNED"
+          "${BUILD_TOOLS}/apksigner" sign \
+            --ks /tmp/keystore.jks \
+            --ks-pass "pass:${APP_SIGN_KEY_PASS}" \
+            --key-pass "pass:${APP_SIGN_KEY_PASS}" \
+            --out "$UNSIGNED" \
+            "$ALIGNED"
+          rm -f "$ALIGNED" /tmp/keystore.jks
+
+      - name: Build debug APK (no signing key)
+        if: ${{ env.HAS_SIGN_KEY != 'true' }}
+        run: ./gradlew assembleDebug
+
+      # Derive a version string from the latest real tag, e.g. `0.0.6.r63.52993d4`
+      # (matches release.yml). The moving `dev` tag is excluded so it never
+      # shadows the real version tag in `git describe`.
+      - name: Get version info
+        id: version
+        run: |
+          set -euo pipefail
+          if desc="$(git describe --long --tags --exclude dev 2>/dev/null)"; then
+            desc="$(echo "$desc" | sed 's/^[vV]//')"
+            if echo "$desc" | grep -qE '\-0\-g[0-9a-f]+$'; then
+              ver="$(echo "$desc" | sed 's/-0-g[0-9a-f]*$//')"
+            else
+              ver="$(echo "$desc" | sed 's/-\([0-9]*\)-g/.r\1./')"
+            fi
+          else
+            ver="$(git rev-parse --short HEAD)"
+          fi
+          echo "name=${ver}" >> "$GITHUB_OUTPUT"
+
+      - name: Stage APK
+        run: |
+          set -euo pipefail
+          mkdir -p release
+          apk="release/DroidVM-${{ steps.version.outputs.name }}-dev.apk"
+          if [ "${HAS_SIGN_KEY}" = "true" ]; then
+            cp app/build/outputs/apk/release/*.apk "$apk"
+          else
+            cp app/build/outputs/apk/debug/*.apk "$apk"
+          fi
+
+      - name: Publish rolling dev pre-release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VER: ${{ steps.version.outputs.name }}
+        run: |
+          set -euo pipefail
+
+          # Drop the previous dev release + tag, then recreate at this commit so
+          # `dev` always points at latest master (a moving, version-less tag).
+          gh release delete dev --yes --cleanup-tag 2>/dev/null || true
+          git push origin :refs/tags/dev 2>/dev/null || true
+
+          gh release create dev "release/DroidVM-${VER}-dev.apk" \
+            --prerelease \
+            --target "${GITHUB_SHA}" \
+            --title "DroidVM dev (${VER})" \
+            --notes "Rolling development build from ${GITHUB_SHA} (${VER}). Not a stable release."

.github/workflows/release.yml

@@ -3,13 +3,17 @@ name: Release
 on:
   push:
     tags: [ "**" ]
+  workflow_dispatch:
 
 permissions:
   contents: write
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    env:
+      DROIDVM_PREBUILT_COMPRESSION_LEVEL: "9"
+      HAS_SIGN_KEY: ${{ secrets.APP_SIGN_KEY_JKS != '' }}
 
     steps:
       - name: Checkout repository
@@ -35,10 +39,15 @@ jobs:
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
 
+      # With a signing key: build and sign a real release APK (current
+      # behaviour). Without one: ship the debug APK -- signed with the
+      # auto-generated debug keystore -- instead of an unsigned release.
       - name: Build release APK
+        if: ${{ env.HAS_SIGN_KEY == 'true' }}
         run: ./gradlew assembleRelease
 
       - name: Sign release APK
+        if: ${{ env.HAS_SIGN_KEY == 'true' }}
         env:
           APP_SIGN_KEY_JKS: ${{ secrets.APP_SIGN_KEY_JKS }}
           APP_SIGN_KEY_PASS: ${{ secrets.APP_SIGN_KEY_PASS }}
@@ -56,6 +65,10 @@ jobs:
             "$ALIGNED"
           rm -f "$ALIGNED" /tmp/keystore.jks
 
+      - name: Build debug APK (no signing key)
+        if: ${{ env.HAS_SIGN_KEY != 'true' }}
+        run: ./gradlew assembleDebug
+
       - name: Get version info
         id: version
         run: |
@@ -69,13 +82,18 @@ jobs:
 
       - name: Rename APK
         run: |
+          set -euo pipefail
           mkdir -p release
-          cp app/build/outputs/apk/release/*.apk "release/DroidVM-v${{ steps.version.outputs.name }}.apk"
+          if [ "${HAS_SIGN_KEY}" = "true" ]; then
+            cp app/build/outputs/apk/release/*.apk "release/DroidVM-v${{ steps.version.outputs.name }}.apk"
+          else
+            cp app/build/outputs/apk/debug/*.apk "release/DroidVM-v${{ steps.version.outputs.name }}-debug.apk"
+          fi
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           name: DroidVM v${{ steps.version.outputs.name }}
           draft: false
           prerelease: ${{ contains(github.ref_name, '-') }}
-          files: release/DroidVM-v${{ steps.version.outputs.name }}.apk
+          files: release/*.apk

.gitignore

@@ -3,9 +3,32 @@
 /local.properties
 /.idea
 /.vscode
+/DroidVM-Prebuilt-Root
+/DroidVM-Prebuilt-Root_
 .DS_Store
 /build
 /captures
 .externalNativeBuild
 .cxx
 local.properties
+
+# Legacy native-util source locations -- the daemons + lbx are now built by the
+# DroidVM-Prebuilt-Root pipeline, not staged into the app tree.
+/app/src/thirdparty
+/app/src/main/rust
+
+# Stale daemon binaries from the old build.sh staging (now delivered via the
+# prebuilt tar.xz); ignore leftovers so they are never packaged or committed.
+/app/src/main/assets/bin/*/bridgedhcp
+/app/src/main/assets/bin/*/gvswitch
+/app/src/main/assets/bin/*/lbx
+/app/src/main/assets/bin/*/netbox
+/app/src/main/assets/bin/*/pbridge
+
+# Terminal font: build.sh fetches the ~2.3MB Maple Mono NL NF TTF on first
+# build; only the OFL license text under app/src/main/assets/fonts is committed.
+/app/src/main/assets/fonts/*.ttf
+
+# Python bytecode from the scripts/ci checks.
+__pycache__/
+*.pyc

ADDITIONAL-PERMISSIONS

@@ -0,0 +1,61 @@
+Additional permissions under GNU GPL version 3, section 7
+=========================================================
+
+These additional permissions apply to the parts of this work copyrighted by
+the Droid-VM organization and by contributors to this project. They do not
+apply to material copyrighted by others -- in particular, material inherited
+from the upstream project this repository is derived from, which remains under
+its own terms and is not affected by anything below.
+
+
+1. Upstream contribution
+------------------------
+
+You may modify this material and distribute the result under the license terms
+that an Upstream Project requires of contributions to it, for the sole purpose
+of having that material included in the Upstream Project's official repository.
+
+This permission takes effect only for material that the Upstream Project
+accepts and publishes. Proposing material to an Upstream Project -- opening a
+merge request, posting a patch, or any other act of submission -- does not by
+itself place that material under any license other than the GNU GPL. Material
+that is not accepted remains under the GNU GPL alone.
+
+Once an Upstream Project has published material under its own license, that
+license governs the copy the Upstream Project published. Nothing in this
+document restricts what anyone may do with that copy.
+
+This permission does not authorise distribution under any other license for any
+other purpose. In particular, it does not authorise distributing this material
+under a permissive license to the public at large, to a fork, or to a
+redistributor, whether or not an Upstream Project was also asked to take it.
+
+
+2. Upstream Projects
+--------------------
+
+"Upstream Project" means one of the following, and no others:
+
+
+
+An Upstream Project's "official repository" is the repository named above, or a
+repository that project's own maintainers designate as its successor. A fork,
+a mirror, a vendored copy, and a redistribution are not official repositories.
+
+
+3. Notes
+--------
+
+Under GPL version 3 section 7, a recipient may remove these additional
+permissions from a copy they convey. Doing so does not affect the terms on
+which the permissions are offered here, and does not withdraw them from anyone
+who received them.
+
+Adding permissions on top of the GNU GPL does not restrict any freedom the GPL
+grants. Every recipient keeps the full GPL grant regardless of whether they use
+anything in this document.
+
+Contributions to this project are made under this project's license, which
+includes these additional permissions. A contributor therefore does not need to
+sign a separate agreement for their contribution to be eligible for upstream
+submission under section 1. See CONTRIBUTING.md.