Release Magisk v30.1

[skip ci]

.github/actions/setup/action.yml

@@ -70,7 +70,7 @@ runs:
           .gradle/caches
           .gradle/wrapper
           !.gradle/caches/build-cache-*
-        key: gradle-cache-${{ hashFiles('gradle/**') }}
+        key: gradle-cache-${{ hashFiles('app/gradle/**') }}
         restore-keys: gradle-cache-
 
     - name: Restore Gradle dependencies

.github/workflows/build.yml

@@ -110,7 +110,7 @@ jobs:
         timeout-minutes: 10
         env:
           AVD_TEST_LOG: 1
-        run: scripts/avd_test.sh ${{ matrix.version }} ${{ matrix.type }}
+        run: scripts/avd.sh test ${{ matrix.version }} ${{ matrix.type }}
 
       - name: Upload logs on error
         if: ${{ failure() }}
@@ -152,7 +152,7 @@ jobs:
         env:
           FORCE_32_BIT: 1
           AVD_TEST_LOG: 1
-        run: scripts/avd_test.sh ${{ matrix.version }}
+        run: scripts/avd.sh test ${{ matrix.version }}
 
       - name: Upload logs on error
         if: ${{ failure() }}

.gitmodules

@@ -10,9 +10,6 @@
 [submodule "libcxx"]
 	path = native/src/external/libcxx
 	url = https://github.com/topjohnwu/libcxx.git
-[submodule "zopfli"]
-	path = native/src/external/zopfli
-	url = https://github.com/google/zopfli.git
 [submodule "cxx-rs"]
 	path = native/src/external/cxx-rs
 	url = https://github.com/topjohnwu/cxx.git

README.MD

@@ -16,13 +16,7 @@ Some highlight features:
 
 ## Downloads
 
-[Github](https://github.com/topjohnwu/Magisk/) is the only source where you can get official Magisk information and downloads.
-
-Click the icon below to download Magisk apk.
-
-[![](https://img.shields.io/badge/Magisk-v28.1-blue)](https://github.com/topjohnwu/Magisk/releases/tag/v28.1)
-[![](https://img.shields.io/badge/Magisk%20Beta-v29.0-blue)](https://github.com/topjohnwu/Magisk/releases/tag/v29.0)
-[![](https://img.shields.io/badge/Magisk-Canary-red)](https://github.com/topjohnwu/Magisk/releases/tag/canary-29001)
+[Github](https://github.com/topjohnwu/Magisk/releases) is the only source where you can get official Magisk information and downloads.
 
 ## Useful Links
 

app/apk/src/main/java/com/topjohnwu/magisk/databinding/DataBindingAdapters.kt

@@ -24,6 +24,7 @@ import androidx.core.widget.ImageViewCompat
 import androidx.databinding.BindingAdapter
 import androidx.databinding.InverseBindingAdapter
 import androidx.databinding.InverseBindingListener
+import androidx.databinding.InverseMethod
 import androidx.interpolator.view.animation.FastOutSlowInInterpolator
 import androidx.recyclerview.widget.DividerItemDecoration
 import androidx.recyclerview.widget.GridLayoutManager
@@ -33,9 +34,11 @@ import androidx.recyclerview.widget.StaggeredGridLayoutManager
 import com.google.android.material.button.MaterialButton
 import com.google.android.material.card.MaterialCardView
 import com.google.android.material.chip.Chip
+import com.google.android.material.slider.Slider
 import com.google.android.material.textfield.TextInputLayout
 import com.topjohnwu.magisk.R
 import com.topjohnwu.magisk.core.di.ServiceLocator
+import com.topjohnwu.magisk.core.model.su.SuPolicy
 import com.topjohnwu.magisk.utils.TextHolder
 import com.topjohnwu.superuser.internal.UiThreadHandler
 import com.topjohnwu.widget.IndeterminateCheckBox
@@ -306,3 +309,38 @@ fun TextView.setText(text: TextHolder) {
 fun Spinner.setAdapter(items: Array<Any>, layoutRes: Int) {
     adapter = ArrayAdapter(context, layoutRes, items)
 }
+
+@BindingAdapter("labelFormatter")
+fun Slider.setLabelFormatter(formatter: (Float) -> Int) {
+    setLabelFormatter { value -> resources.getString(formatter(value)) }
+}
+
+@InverseBindingAdapter(attribute = "android:value")
+fun Slider.getValueBinding() = value
+
+@BindingAdapter("android:valueAttrChanged")
+fun Slider.setListener(attrChange: InverseBindingListener) {
+    addOnSliderTouchListener(object : Slider.OnSliderTouchListener {
+        override fun onStartTrackingTouch(slider: Slider) = Unit
+        override fun onStopTrackingTouch(slider: Slider) = attrChange.onChange()
+    })
+}
+
+@InverseMethod("sliderValueToPolicy")
+fun policyToSliderValue(policy: Int): Float {
+    return when (policy) {
+        SuPolicy.DENY -> 1f
+        SuPolicy.RESTRICT -> 2f
+        SuPolicy.ALLOW -> 3f
+        else -> 1f
+    }
+}
+
+fun sliderValueToPolicy(value: Float): Int {
+    return when (value) {
+        1f -> SuPolicy.DENY
+        2f -> SuPolicy.RESTRICT
+        3f -> SuPolicy.ALLOW
+        else -> SuPolicy.DENY
+    }
+}

app/apk/src/main/java/com/topjohnwu/magisk/dialog/ManagerInstallDialog.kt

@@ -3,7 +3,6 @@ package com.topjohnwu.magisk.dialog
 import com.topjohnwu.magisk.core.AppContext
 import com.topjohnwu.magisk.core.Info
 import com.topjohnwu.magisk.core.R
-import com.topjohnwu.magisk.core.di.ServiceLocator
 import com.topjohnwu.magisk.core.download.DownloadEngine
 import com.topjohnwu.magisk.core.download.Subject
 import com.topjohnwu.magisk.view.MagiskDialog
@@ -11,15 +10,10 @@ import java.io.File
 
 class ManagerInstallDialog : MarkDownDialog() {
 
-    private val svc get() = ServiceLocator.networkService
-
     override suspend fun getMarkdownText(): String {
-        val text = svc.fetchString(Info.remote.magisk.note)
+        val text = Info.update.note
         // Cache the changelog
-        AppContext.cacheDir.listFiles { _, name -> name.endsWith(".md") }.orEmpty().forEach {
-            it.delete()
-        }
-        File(AppContext.cacheDir, "${Info.remote.magisk.versionCode}.md").writeText(text)
+        File(AppContext.cacheDir, "${Info.update.versionCode}.md").writeText(text)
         return text
     }
 

app/apk/src/main/java/com/topjohnwu/magisk/ui/home/HomeViewModel.kt

@@ -91,16 +91,15 @@ class HomeViewModel(
 
     override suspend fun doLoadWork() {
         appState = State.LOADING
-        Info.getRemote(svc)?.apply {
+        Info.fetchUpdate(svc)?.apply {
             appState = when {
-                BuildConfig.APP_VERSION_CODE < magisk.versionCode -> State.OUTDATED
+                BuildConfig.APP_VERSION_CODE < versionCode -> State.OUTDATED
                 else -> State.UP_TO_DATE
             }
 
             val isDebug = Config.updateChannel == Config.Value.DEBUG_CHANNEL
             managerRemoteVersion =
-                ("${magisk.version} (${magisk.versionCode})" +
-                    if (isDebug) " (D)" else "").asText()
+                ("$version (${versionCode})" + if (isDebug) " (D)" else "").asText()
         } ?: run {
             appState = State.INVALID
             managerRemoteVersion = CoreR.string.not_available.asText()

app/apk/src/main/java/com/topjohnwu/magisk/ui/install/InstallViewModel.kt

@@ -14,9 +14,8 @@ import com.topjohnwu.magisk.BR
 import com.topjohnwu.magisk.R
 import com.topjohnwu.magisk.arch.BaseViewModel
 import com.topjohnwu.magisk.core.AppContext
-import com.topjohnwu.magisk.core.BuildConfig
+import com.topjohnwu.magisk.core.BuildConfig.APP_VERSION_CODE
 import com.topjohnwu.magisk.core.Config
-import com.topjohnwu.magisk.core.Const
 import com.topjohnwu.magisk.core.Info
 import com.topjohnwu.magisk.core.base.ContentResultCallback
 import com.topjohnwu.magisk.core.ktx.toast
@@ -70,17 +69,16 @@ class InstallViewModel(svc: NetworkService, markwon: Markwon) : BaseViewModel()
     init {
         viewModelScope.launch(Dispatchers.IO) {
             try {
-                val file = File(AppContext.cacheDir, "${BuildConfig.APP_VERSION_CODE}.md")
-                val text = when {
-                    file.exists() -> file.readText()
-                    Const.Url.CHANGELOG_URL.isEmpty() -> ""
+                val noteFile = File(AppContext.cacheDir, "${APP_VERSION_CODE}.md")
+                val noteText = when {
+                    noteFile.exists() -> noteFile.readText()
                     else -> {
-                        val str = svc.fetchString(Const.Url.CHANGELOG_URL)
-                        file.writeText(str)
-                        str
+                        val note = svc.fetchUpdate(APP_VERSION_CODE).note
+                        noteFile.writeText(note)
+                        note
                     }
                 }
-                val spanned = markwon.toMarkdown(text)
+                val spanned = markwon.toMarkdown(noteText)
                 withContext(Dispatchers.Main) {
                     notes = spanned
                 }
@@ -100,13 +98,15 @@ class InstallViewModel(svc: NetworkService, markwon: Markwon) : BaseViewModel()
     }
 
     override fun onSaveState(state: Bundle) {
-        state.putParcelable(INSTALL_STATE_KEY, InstallState(
-            methodId,
-            step,
-            Config.keepVerity,
-            Config.keepEnc,
-            Config.recovery
-        ))
+        state.putParcelable(
+            INSTALL_STATE_KEY, InstallState(
+                methodId,
+                step,
+                Config.keepVerity,
+                Config.keepEnc,
+                Config.recovery
+            )
+        )
     }
 
     override fun onRestoreState(state: Bundle) {
@@ -124,6 +124,7 @@ class InstallViewModel(svc: NetworkService, markwon: Markwon) : BaseViewModel()
         override fun onActivityLaunch() {
             AppContext.toast(CoreR.string.patch_file_msg, Toast.LENGTH_LONG)
         }
+
         override fun onActivityResult(result: Uri) {
             uri.value = result
         }

app/apk/src/main/java/com/topjohnwu/magisk/ui/settings/SettingsItems.kt

@@ -147,19 +147,11 @@ object UpdateChannel : BaseSettingsItem.Selector() {
         get() = Config.updateChannel
         set(value) {
             Config.updateChannel = value
-            Info.remote = Info.EMPTY_REMOTE
+            Info.resetUpdate()
         }
 
     override val title = CoreR.string.settings_update_channel_title.asText()
-
     override val entryRes = CoreR.array.update_channel
-    override fun entries(res: Resources): Array<String> {
-        return super.entries(res).let {
-            if (!Const.APP_IS_CANARY && !BuildConfig.DEBUG)
-                it.copyOfRange(0, Config.Value.CANARY_CHANNEL)
-            else it
-        }
-    }
 }
 
 object UpdateChannelUrl : BaseSettingsItem.Input() {
@@ -169,7 +161,7 @@ object UpdateChannelUrl : BaseSettingsItem.Input() {
         get() = Config.customChannelUrl
         set(value) {
             Config.customChannelUrl = value
-            Info.remote = Info.EMPTY_REMOTE
+            Info.resetUpdate()
             notifyPropertyChanged(BR.description)
         }
 
@@ -330,6 +322,12 @@ object Reauthenticate : BaseSettingsItem.Toggle() {
     override var value by Config::suReAuth
 
     override fun refresh() {
-        isEnabled = Build.VERSION.SDK_INT < Build.VERSION_CODES.O && Info.showSuperUser
+        isEnabled = Build.VERSION.SDK_INT < Build.VERSION_CODES.O
     }
 }
+
+object Restrict : BaseSettingsItem.Toggle() {
+    override val title = CoreR.string.settings_su_restrict_title.asText()
+    override val description = CoreR.string.settings_su_restrict_summary.asText()
+    override var value by Config::suRestrict
+}

app/apk/src/main/java/com/topjohnwu/magisk/ui/settings/SettingsViewModel.kt

@@ -83,6 +83,9 @@ class SettingsViewModel : BaseViewModel(), BaseSettingsItem.Handler {
                 // Can hide overlay windows on 12.0+
                 list.remove(Tapjack)
             }
+            if (Const.Version.atLeast_30_1()) {
+                list.add(Restrict)
+            }
         }
 
         return list

app/apk/src/main/java/com/topjohnwu/magisk/ui/superuser/PolicyRvItem.kt

@@ -4,11 +4,13 @@ import android.graphics.drawable.Drawable
 import androidx.databinding.Bindable
 import com.topjohnwu.magisk.BR
 import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.Config
 import com.topjohnwu.magisk.core.model.su.SuPolicy
 import com.topjohnwu.magisk.databinding.DiffItem
 import com.topjohnwu.magisk.databinding.ItemWrapper
 import com.topjohnwu.magisk.databinding.ObservableRvItem
 import com.topjohnwu.magisk.databinding.set
+import com.topjohnwu.magisk.core.R as CoreR
 
 class PolicyRvItem(
     private val viewModel: SuperuserViewModel,
@@ -33,14 +35,34 @@ class PolicyRvItem(
     var isExpanded = false
         set(value) = set(value, field, { field = it }, BR.expanded)
 
+    val showSlider = Config.suRestrict || item.policy == SuPolicy.RESTRICT
+
     @get:Bindable
     var isEnabled
-        get() = item.policy == SuPolicy.ALLOW
+        get() = item.policy >= SuPolicy.ALLOW
         set(value) = setImpl(value, isEnabled) {
             notifyPropertyChanged(BR.enabled)
-            viewModel.togglePolicy(this, value)
+            viewModel.updatePolicy(this, if (it) SuPolicy.ALLOW else SuPolicy.DENY)
         }
 
+    @get:Bindable
+    var sliderValue
+        get() = item.policy
+        set(value) = setImpl(value, sliderValue) {
+            notifyPropertyChanged(BR.sliderValue)
+            notifyPropertyChanged(BR.enabled)
+            viewModel.updatePolicy(this, it)
+        }
+
+    val sliderValueToPolicyString: (Float) -> Int = { value ->
+        when (value.toInt()) {
+            1 -> CoreR.string.deny
+            2 -> CoreR.string.restrict
+            3 -> CoreR.string.grant
+            else -> CoreR.string.deny
+        }
+    }
+
     @get:Bindable
     var shouldNotify
         get() = item.notification

app/apk/src/main/java/com/topjohnwu/magisk/ui/superuser/SuperuserViewModel.kt

@@ -156,15 +156,16 @@ class SuperuserViewModel(
         }
     }
 
-    fun togglePolicy(item: PolicyRvItem, enable: Boolean) {
+    fun updatePolicy(item: PolicyRvItem, policy: Int) {
         val items = itemsPolicies.filter { it.item.uid == item.item.uid }
         fun updateState() {
             viewModelScope.launch {
-                val res = if (enable) R.string.su_snack_grant else R.string.su_snack_deny
-                item.item.policy = if (enable) SuPolicy.ALLOW else SuPolicy.DENY
+                val res = if (policy >= SuPolicy.ALLOW) R.string.su_snack_grant else R.string.su_snack_deny
+                item.item.policy = policy
                 db.update(item.item)
                 items.forEach {
                     it.notifyPropertyChanged(BR.enabled)
+                    it.notifyPropertyChanged(BR.sliderValue)
                 }
                 SnackbarEvent(res.asText(item.appName)).publish()
             }

app/apk/src/main/res/layout/item_log_access_md2.xml

@@ -25,7 +25,7 @@
 
         <include
             android:id="@+id/log_track_container"
-            bullet="@{item.log.action == 2 ? R.drawable.ic_check_md2 : R.drawable.ic_close_md2}"
+            bullet="@{item.log.action >= 2 ? R.drawable.ic_check_md2 : R.drawable.ic_close_md2}"
             isBottom="@{item.isBottom}"
             isSelected="@{item.log.action != 2}"
             isTop="@{item.isTop}"

app/apk/src/main/res/layout/item_policy_md2.xml

@@ -5,6 +5,8 @@
 
     <data>
 
+        <import type="com.topjohnwu.magisk.databinding.DataBindingAdaptersKt" />
+
         <variable
             name="item"
             type="com.topjohnwu.magisk.ui.superuser.PolicyRvItem" />
@@ -85,16 +87,32 @@
                         app:layout_constraintVertical_bias="0"
                         tools:text="com.topjohnwu.magisk" />
 
-                    <com.google.android.material.switchmaterial.SwitchMaterial
+                    <FrameLayout
                         android:id="@+id/policy_indicator"
                         android:layout_width="wrap_content"
                         android:layout_height="wrap_content"
                         android:layout_marginEnd="@dimen/l1"
-                        android:checked="@={item.enabled}"
                         android:nextFocusLeft="@id/policy"
                         app:layout_constraintBottom_toBottomOf="parent"
                         app:layout_constraintEnd_toEndOf="parent"
-                        app:layout_constraintTop_toTopOf="parent" />
+                        app:layout_constraintTop_toTopOf="parent">
+
+                        <com.google.android.material.switchmaterial.SwitchMaterial
+                            gone="@{item.showSlider}"
+                            android:layout_width="wrap_content"
+                            android:layout_height="wrap_content"
+                            android:checked="@={item.enabled}" />
+
+                        <com.google.android.material.slider.Slider
+                            goneUnless="@{item.showSlider}"
+                            labelFormatter="@{item.sliderValueToPolicyString}"
+                            android:layout_width="96dp"
+                            android:layout_height="wrap_content"
+                            android:stepSize="1"
+                            android:value="@={DataBindingAdaptersKt.policyToSliderValue(item.sliderValue)}"
+                            android:valueFrom="1"
+                            android:valueTo="3" />
+                    </FrameLayout>
 
                 </androidx.constraintlayout.widget.ConstraintLayout>
 

app/buildSrc/build.gradle.kts

@@ -30,5 +30,6 @@ dependencies {
     implementation(libs.ksp.plugin)
     implementation(libs.navigation.safe.args.plugin)
     implementation(libs.lsparanoid.plugin)
+    implementation(libs.moshi.plugin)
     implementation(libs.jgit)
 }

app/buildSrc/src/main/java/AddCommentTask.kt

@@ -0,0 +1,77 @@
+import com.android.build.api.artifact.ArtifactTransformationRequest
+import com.android.build.api.dsl.ApkSigningConfig
+import com.android.builder.internal.packaging.IncrementalPackager
+import com.android.tools.build.apkzlib.sign.SigningExtension
+import com.android.tools.build.apkzlib.sign.SigningOptions
+import com.android.tools.build.apkzlib.zfile.ZFiles
+import com.android.tools.build.apkzlib.zip.ZFileOptions
+import org.gradle.api.DefaultTask
+import org.gradle.api.file.DirectoryProperty
+import org.gradle.api.provider.Property
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.InputFiles
+import org.gradle.api.tasks.Internal
+import org.gradle.api.tasks.OutputDirectory
+import org.gradle.api.tasks.TaskAction
+import java.io.File
+import java.security.KeyStore
+import java.security.cert.X509Certificate
+import java.util.jar.JarFile
+
+abstract class AddCommentTask: DefaultTask() {
+    @get:Input
+    abstract val comment: Property<String>
+
+    @get:Input
+    abstract val signingConfig: Property<ApkSigningConfig>
+
+    @get:InputFiles
+    abstract val apkFolder: DirectoryProperty
+
+    @get:OutputDirectory
+    abstract val outFolder: DirectoryProperty
+
+    @get:Internal
+    abstract val transformationRequest: Property<ArtifactTransformationRequest<AddCommentTask>>
+
+    @TaskAction
+    fun taskAction() = transformationRequest.get().submit(this) { artifact ->
+        val inFile = File(artifact.outputFile)
+        val outFile = outFolder.file(inFile.name).get().asFile
+
+        val privateKey = signingConfig.get().getPrivateKey()
+        val signingOptions = SigningOptions.builder()
+            .setMinSdkVersion(0)
+            .setV1SigningEnabled(true)
+            .setV2SigningEnabled(true)
+            .setKey(privateKey.privateKey)
+            .setCertificates(privateKey.certificate as X509Certificate)
+            .setValidation(SigningOptions.Validation.ASSUME_INVALID)
+            .build()
+        val options = ZFileOptions().apply {
+            noTimestamps = true
+            autoSortFiles = true
+        }
+        outFile.parentFile?.mkdirs()
+        inFile.copyTo(outFile, overwrite = true)
+        ZFiles.apk(outFile, options).use {
+            SigningExtension(signingOptions).register(it)
+            it.eocdComment = comment.get().toByteArray()
+            it.get(IncrementalPackager.APP_METADATA_ENTRY_PATH)?.delete()
+            it.get(IncrementalPackager.VERSION_CONTROL_INFO_ENTRY_PATH)?.delete()
+            it.get(JarFile.MANIFEST_NAME)?.delete()
+        }
+
+        outFile
+    }
+
+    private fun ApkSigningConfig.getPrivateKey(): KeyStore.PrivateKeyEntry {
+        val keyStore = KeyStore.getInstance(storeType ?: KeyStore.getDefaultType())
+        storeFile!!.inputStream().use {
+            keyStore.load(it, storePassword!!.toCharArray())
+        }
+        val keyPwdArray = keyPassword!!.toCharArray()
+        val entry = keyStore.getEntry(keyAlias!!, KeyStore.PasswordProtection(keyPwdArray))
+        return entry as KeyStore.PrivateKeyEntry
+    }
+}

app/buildSrc/src/main/java/Plugin.kt

@@ -5,6 +5,12 @@ import org.gradle.api.Project
 import org.gradle.kotlin.dsl.provideDelegate
 import java.io.File
 import java.util.Properties
+import java.util.Random
+
+// Set non-zero value here to fix the random seed for reproducible builds
+// CI builds are always reproducible
+val RAND_SEED = if (System.getenv("CI") != null) 42 else 0
+lateinit var RANDOM: Random
 
 private val props = Properties()
 private var commitHash = ""
@@ -28,7 +34,11 @@ object Config {
     }
 }
 
-val Project.baseDir: File get() = rootProject.file("..")
+fun Project.rootFile(path: String): File {
+    val file = File(path)
+    return if (file.isAbsolute) file
+    else File(rootProject.file(".."), path)
+}
 
 class MagiskPlugin : Plugin<Project> {
     override fun apply(project: Project) = project.applyPlugin()
@@ -38,11 +48,11 @@ class MagiskPlugin : Plugin<Project> {
         props.clear()
         rootProject.file("gradle.properties").inputStream().use { props.load(it) }
         val configPath: String? by this
-        val config = configPath?.let { File(it) } ?: File(baseDir, "config.prop")
+        val config = rootFile(configPath ?: "config.prop")
         if (config.exists())
             config.inputStream().use { props.load(it) }
 
-        val repo = FileRepository(File(baseDir, ".git"))
+        val repo = FileRepository(rootFile(".git"))
         val refId = repo.refDatabase.exactRef("HEAD").objectId
         commitHash = repo.newObjectReader().abbreviate(refId, 8).name()
     }

app/buildSrc/src/main/java/Stub.kt

@@ -1,8 +1,11 @@
+import com.android.build.api.artifact.SingleArtifact
 import org.gradle.api.DefaultTask
+import org.gradle.api.Project
 import org.gradle.api.file.DirectoryProperty
 import org.gradle.api.file.RegularFileProperty
 import org.gradle.api.provider.Property
 import org.gradle.api.tasks.CacheableTask
+import org.gradle.api.tasks.Delete
 import org.gradle.api.tasks.Input
 import org.gradle.api.tasks.InputFile
 import org.gradle.api.tasks.InputFiles
@@ -10,22 +13,25 @@ import org.gradle.api.tasks.OutputFile
 import org.gradle.api.tasks.PathSensitive
 import org.gradle.api.tasks.PathSensitivity
 import org.gradle.api.tasks.TaskAction
+import org.gradle.kotlin.dsl.assign
+import org.gradle.kotlin.dsl.named
 import java.io.ByteArrayInputStream
 import java.io.ByteArrayOutputStream
 import java.io.File
 import java.io.PrintStream
 import java.security.SecureRandom
 import java.util.Random
+import java.util.zip.Deflater
+import java.util.zip.DeflaterOutputStream
+import java.util.zip.ZipEntry
+import java.util.zip.ZipFile
+import java.util.zip.ZipOutputStream
 import javax.crypto.Cipher
 import javax.crypto.CipherOutputStream
 import javax.crypto.spec.IvParameterSpec
 import javax.crypto.spec.SecretKeySpec
 import kotlin.random.asKotlinRandom
 
-// Set non-zero value here to fix the random seed for reproducible builds
-// CI builds are always reproducible
-val RAND_SEED = if (System.getenv("CI") != null) 42 else 0
-private lateinit var RANDOM: Random
 private val kRANDOM get() = RANDOM.asKotlinRandom()
 
 private val c1 = mutableListOf<String>()
@@ -72,7 +78,7 @@ private fun PrintStream.byteField(name: String, bytes: ByteArray) {
 }
 
 @CacheableTask
-abstract class ManifestUpdater: DefaultTask() {
+private abstract class ManifestUpdater: DefaultTask() {
     @get:Input
     abstract val applicationId: Property<String>
 
@@ -182,9 +188,7 @@ abstract class ManifestUpdater: DefaultTask() {
 }
 
 
-fun genStubClasses(factoryOutDir: File, appOutDir: File) {
-    fun String.ind(level: Int) = replaceIndentByMargin("    ".repeat(level))
-
+private fun genStubClasses(factoryOutDir: File, appOutDir: File) {
     val classNameGenerator = sequence {
         fun notJavaKeyword(name: String) = when (name) {
             "do", "if", "for", "int", "new", "try" -> false
@@ -228,7 +232,7 @@ fun genStubClasses(factoryOutDir: File, appOutDir: File) {
     genClass("StubApplication", appOutDir)
 }
 
-fun genEncryptedResources(res: ByteArray, outDir: File) {
+private fun genEncryptedResources(res: ByteArray, outDir: File) {
     val mainPkgDir = File(outDir, "com/topjohnwu/magisk")
     mainPkgDir.mkdirs()
 
@@ -259,3 +263,86 @@ fun genEncryptedResources(res: ByteArray, outDir: File) {
         it.println("}")
     }
 }
+
+fun Project.setupStubApk() {
+    setupAppCommon()
+
+    androidComponents.onVariants { variant ->
+        val variantName = variant.name
+        val variantCapped = variantName.replaceFirstChar { it.uppercase() }
+        val manifestUpdater =
+            project.tasks.register("${variantName}ManifestProducer", ManifestUpdater::class.java) {
+                dependsOn("generate${variantCapped}ObfuscatedClass")
+                applicationId = variant.applicationId
+                appClassDir.set(layout.buildDirectory.dir("generated/source/app/$variantName"))
+                factoryClassDir.set(layout.buildDirectory.dir("generated/source/factory/$variantName"))
+            }
+        variant.artifacts.use(manifestUpdater)
+            .wiredWithFiles(
+                ManifestUpdater::mergedManifest,
+                ManifestUpdater::outputManifest)
+            .toTransform(SingleArtifact.MERGED_MANIFEST)
+    }
+
+    androidApp.applicationVariants.all {
+        val variantCapped = name.replaceFirstChar { it.uppercase() }
+        val variantLowered = name.lowercase()
+        val outFactoryClassDir = layout.buildDirectory.file("generated/source/factory/${variantLowered}").get().asFile
+        val outAppClassDir = layout.buildDirectory.file("generated/source/app/${variantLowered}").get().asFile
+        val outResDir = layout.buildDirectory.dir("generated/source/res/${variantLowered}").get().asFile
+        val aapt = File(androidApp.sdkDirectory, "build-tools/${androidApp.buildToolsVersion}/aapt2")
+        val apk = layout.buildDirectory.file("intermediates/linked_resources_binary_format/" +
+                "${variantLowered}/process${variantCapped}Resources/linked-resources-binary-format-${variantLowered}.ap_").get().asFile
+
+        val genManifestTask = tasks.register("generate${variantCapped}ObfuscatedClass") {
+            inputs.property("seed", RAND_SEED)
+            outputs.dirs(outFactoryClassDir, outAppClassDir)
+            doLast {
+                outFactoryClassDir.mkdirs()
+                outAppClassDir.mkdirs()
+                genStubClasses(outFactoryClassDir, outAppClassDir)
+            }
+        }
+        registerJavaGeneratingTask(genManifestTask, outFactoryClassDir, outAppClassDir)
+
+        val processResourcesTask = tasks.named("process${variantCapped}Resources") {
+            outputs.dir(outResDir)
+            doLast {
+                val apkTmp = File("${apk}.tmp")
+                exec {
+                    commandLine(aapt, "optimize", "-o", apkTmp, "--collapse-resource-names", apk)
+                }
+
+                val bos = ByteArrayOutputStream()
+                ZipFile(apkTmp).use { src ->
+                    ZipOutputStream(apk.outputStream()).use {
+                        it.setLevel(Deflater.BEST_COMPRESSION)
+                        it.putNextEntry(ZipEntry("AndroidManifest.xml"))
+                        src.getInputStream(src.getEntry("AndroidManifest.xml")).transferTo(it)
+                        it.closeEntry()
+                    }
+                    DeflaterOutputStream(bos, Deflater(Deflater.BEST_COMPRESSION)).use {
+                        src.getInputStream(src.getEntry("resources.arsc")).transferTo(it)
+                    }
+                }
+                apkTmp.delete()
+                genEncryptedResources(bos.toByteArray(), outResDir)
+            }
+        }
+
+        registerJavaGeneratingTask(processResourcesTask, outResDir)
+    }
+    // Override optimizeReleaseResources task
+    val apk = layout.buildDirectory.file("intermediates/linked_resources_binary_format/" +
+            "release/processReleaseResources/linked-resources-binary-format-release.ap_").get().asFile
+    val optRes = layout.buildDirectory.file("intermediates/optimized_processed_res/" +
+            "release/optimizeReleaseResources/resources-release-optimize.ap_").get().asFile
+    afterEvaluate {
+        tasks.named("optimizeReleaseResources") {
+            doLast { apk.copyTo(optRes, true) }
+        }
+    }
+    tasks.named<Delete>("clean") {
+        delete.addAll(listOf("src/debug/AndroidManifest.xml", "src/release/AndroidManifest.xml"))
+    }
+}

app/core/.gitignore

@@ -1,4 +1,3 @@
 /build
-src/*/assets
-src/*/jniLibs
-src/*/resources
+src/debug
+src/release

app/core/build.gradle.kts

@@ -2,6 +2,7 @@ plugins {
     id("com.android.library")
     kotlin("android")
     kotlin("plugin.parcelize")
+    id("dev.zacsweers.moshix")
     id("com.google.devtools.ksp")
 }
 
@@ -48,9 +49,6 @@ dependencies {
     implementation(libs.okhttp.logging)
     implementation(libs.okhttp.dnsoverhttps)
 
-    implementation(libs.moshi)
-    ksp(libs.moshi.codegen)
-
     implementation(libs.room.runtime)
     implementation(libs.room.ktx)
     ksp(libs.room.compiler)

app/core/src/main/java/com/topjohnwu/magisk/core/Config.kt

@@ -32,8 +32,9 @@ object Config : PreferenceConfig, DBConfig {
         const val SU_NOTIFICATION = "su_notification"
         const val SU_REAUTH = "su_reauth"
         const val SU_TAPJACK = "su_tapjack"
+        const val SU_RESTRICT = "su_restrict"
         const val CHECK_UPDATES = "check_update"
-        const val UPDATE_CHANNEL = "update_channel"
+        const val RELEASE_CHANNEL = "release_channel"
         const val CUSTOM_CHANNEL = "custom_channel"
         const val LOCALE = "locale"
         const val DARK_THEME = "dark_theme_extended"
@@ -48,7 +49,7 @@ object Config : PreferenceConfig, DBConfig {
             SU_AUTO_RESPONSE, SU_REAUTH, SU_TAPJACK)
     }
 
-    object Value {
+    object OldValue {
         // Update channels
         const val DEFAULT_CHANNEL = -1
         const val STABLE_CHANNEL = 0
@@ -56,6 +57,15 @@ object Config : PreferenceConfig, DBConfig {
         const val CUSTOM_CHANNEL = 2
         const val CANARY_CHANNEL = 3
         const val DEBUG_CHANNEL = 4
+    }
+
+    object Value {
+        // Update channels
+        const val DEFAULT_CHANNEL = -1
+        const val STABLE_CHANNEL = 0
+        const val BETA_CHANNEL = 1
+        const val DEBUG_CHANNEL = 2
+        const val CUSTOM_CHANNEL = 3
 
         // root access mode
         const val ROOT_ACCESS_DISABLED = 0
@@ -86,14 +96,6 @@ object Config : PreferenceConfig, DBConfig {
         val TIMEOUT_LIST = longArrayOf(0, -1, 10, 20, 30, 60)
     }
 
-    private val defaultChannel =
-        if (BuildConfig.DEBUG)
-            Value.DEBUG_CHANNEL
-        else if (Const.APP_IS_CANARY)
-            Value.CANARY_CHANNEL
-        else
-            Value.DEFAULT_CHANNEL
-
     @JvmField var keepVerity = false
     @JvmField var keepEnc = false
     @JvmField var recovery = false
@@ -109,7 +111,7 @@ object Config : PreferenceConfig, DBConfig {
     private var checkUpdatePrefs by preference(Key.CHECK_UPDATES, true)
     private var localePrefs by preference(Key.LOCALE, "")
     var doh by preference(Key.DOH, false)
-    var updateChannel by preferenceStrInt(Key.UPDATE_CHANNEL, defaultChannel)
+    var updateChannel by preference(Key.RELEASE_CHANNEL, Value.DEFAULT_CHANNEL)
     var customChannelUrl by preference(Key.CUSTOM_CHANNEL, "")
     var downloadDir by preference(Key.DOWNLOAD_DIR, "")
     var randName by preference(Key.RAND_NAME, true)
@@ -146,8 +148,10 @@ object Config : PreferenceConfig, DBConfig {
         }
     var suReAuth by preference(Key.SU_REAUTH, false)
     var suTapjack by preference(Key.SU_TAPJACK, true)
+    var suRestrict by preference(Key.SU_RESTRICT, false)
 
     private const val SU_FINGERPRINT = "su_fingerprint"
+    private const val UPDATE_CHANNEL = "update_channel"
 
     fun toBundle(): Bundle {
         val map = prefs.all - Key.NO_MIGRATION
@@ -183,17 +187,23 @@ object Config : PreferenceConfig, DBConfig {
         }
 
         prefs.edit {
-            // Settings migration
+            // Migrate su_fingerprint
             if (prefs.getBoolean(SU_FINGERPRINT, false))
                 suBiometric = true
             remove(SU_FINGERPRINT)
-            prefs.getString(Key.UPDATE_CHANNEL, null).also {
-                if (it == null ||
-                    it.toInt() > Value.DEBUG_CHANNEL ||
-                    it.toInt() < Value.DEFAULT_CHANNEL) {
-                    putString(Key.UPDATE_CHANNEL, defaultChannel.toString())
+
+            // Migrate update_channel
+            prefs.getString(UPDATE_CHANNEL, null)?.let {
+                val channel = when (it.toInt()) {
+                    OldValue.STABLE_CHANNEL -> Value.STABLE_CHANNEL
+                    OldValue.CANARY_CHANNEL, OldValue.BETA_CHANNEL -> Value.BETA_CHANNEL
+                    OldValue.DEBUG_CHANNEL -> Value.DEBUG_CHANNEL
+                    OldValue.CUSTOM_CHANNEL -> Value.CUSTOM_CHANNEL
+                    else -> Value.DEFAULT_CHANNEL
                 }
+                putInt(Key.RELEASE_CHANNEL, channel)
             }
+            remove(UPDATE_CHANNEL)
         }
     }
 }

app/core/src/main/java/com/topjohnwu/magisk/core/Const.kt

@@ -2,6 +2,7 @@ package com.topjohnwu.magisk.core
 
 import android.os.Build
 import android.os.Process
+import com.topjohnwu.magisk.core.BuildConfig.APP_VERSION_CODE
 
 @Suppress("DEPRECATION")
 object Const {
@@ -20,18 +21,16 @@ object Const {
 
     // Misc
     val USER_ID = Process.myUid() / 100000
-    val APP_IS_CANARY get() = Version.isCanary(BuildConfig.APP_VERSION_CODE)
 
     object Version {
         const val MIN_VERSION = "v22.0"
         const val MIN_VERCODE = 22000
 
+        private fun isCanary() = (Info.env.versionCode % 100) != 0
         fun atLeast_24_0() = Info.env.versionCode >= 24000 || isCanary()
         fun atLeast_25_0() = Info.env.versionCode >= 25000 || isCanary()
         fun atLeast_28_0() = Info.env.versionCode >= 28000 || isCanary()
-        fun isCanary() = isCanary(Info.env.versionCode)
-
-        fun isCanary(ver: Int) = ver > 0 && ver % 100 != 0
+        fun atLeast_30_1() = Info.env.versionCode >= 30100 || isCanary()
     }
 
     object ID {
@@ -43,13 +42,9 @@ object Const {
         const val PATREON_URL = "https://www.patreon.com/topjohnwu"
         const val SOURCE_CODE_URL = "https://github.com/topjohnwu/Magisk"
 
-        val CHANGELOG_URL = if (APP_IS_CANARY) Info.remote.magisk.note
-        else "https://topjohnwu.github.io/Magisk/releases/${BuildConfig.APP_VERSION_CODE}.md"
-
-        const val GITHUB_RAW_URL = "https://raw.githubusercontent.com/"
         const val GITHUB_API_URL = "https://api.github.com/"
         const val GITHUB_PAGE_URL = "https://topjohnwu.github.io/magisk-files/"
-        const val JS_DELIVR_URL = "https://cdn.jsdelivr.net/gh/"
+        const val INVALID_URL = "https://example.com/"
     }
 
     object Key {

app/core/src/main/java/com/topjohnwu/magisk/core/Info.kt

@@ -19,12 +19,18 @@ object Info {
 
     var stub: StubApk.Data? = null
 
-    val EMPTY_REMOTE = UpdateInfo()
-    var remote = EMPTY_REMOTE
-    suspend fun getRemote(svc: NetworkService): UpdateInfo? {
-        return if (remote === EMPTY_REMOTE) {
-            svc.fetchUpdate()?.apply { remote = this }
-        } else remote
+    private val EMPTY_UPDATE = UpdateInfo()
+    var update = EMPTY_UPDATE
+        private set
+
+    suspend fun fetchUpdate(svc: NetworkService): UpdateInfo? {
+        return if (update === EMPTY_UPDATE) {
+            svc.fetchUpdate()?.apply { update = this }
+        } else update
+    }
+
+    fun resetUpdate() {
+        update = EMPTY_UPDATE
     }
 
     var isRooted = false

app/core/src/main/java/com/topjohnwu/magisk/core/JobService.kt

@@ -75,9 +75,8 @@ class JobService : BaseJobService() {
 
     private fun checkUpdate(params: JobParameters): Boolean {
         GlobalScope.launch(Dispatchers.IO) {
-            ServiceLocator.networkService.fetchUpdate()?.let {
-                Info.remote = it
-                if (Info.env.isActive && BuildConfig.APP_VERSION_CODE < it.magisk.versionCode)
+            Info.fetchUpdate(ServiceLocator.networkService)?.let {
+                if (Info.env.isActive && BuildConfig.APP_VERSION_CODE < it.versionCode)
                     Notifications.updateAvailable()
                 jobFinished(params, false)
             }

app/core/src/main/java/com/topjohnwu/magisk/core/data/NetworkServices.kt

@@ -1,45 +0,0 @@
-package com.topjohnwu.magisk.core.data
-
-import com.topjohnwu.magisk.core.model.BranchInfo
-import com.topjohnwu.magisk.core.model.ModuleJson
-import com.topjohnwu.magisk.core.model.UpdateInfo
-import okhttp3.ResponseBody
-import retrofit2.http.GET
-import retrofit2.http.Headers
-import retrofit2.http.Path
-import retrofit2.http.Streaming
-import retrofit2.http.Url
-
-private const val BRANCH = "branch"
-private const val REPO = "repo"
-private const val FILE = "file"
-
-interface GithubPageServices {
-
-    @GET
-    suspend fun fetchUpdateJSON(@Url file: String): UpdateInfo
-}
-
-interface RawServices {
-
-    @GET
-    @Streaming
-    suspend fun fetchFile(@Url url: String): ResponseBody
-
-    @GET
-    suspend fun fetchString(@Url url: String): String
-
-    @GET
-    suspend fun fetchModuleJson(@Url url: String): ModuleJson
-
-}
-
-interface GithubApiServices {
-
-    @GET("repos/{$REPO}/branches/{$BRANCH}")
-    @Headers("Accept: application/vnd.github.v3+json")
-    suspend fun fetchBranch(
-        @Path(REPO, encoded = true) repo: String,
-        @Path(BRANCH) branch: String
-    ): BranchInfo
-}

app/core/src/main/java/com/topjohnwu/magisk/core/data/RetrofitInterfaces.kt

@@ -0,0 +1,48 @@
+package com.topjohnwu.magisk.core.data
+
+import com.topjohnwu.magisk.core.model.ModuleJson
+import com.topjohnwu.magisk.core.model.Release
+import com.topjohnwu.magisk.core.model.UpdateJson
+import okhttp3.ResponseBody
+import retrofit2.Response
+import retrofit2.http.GET
+import retrofit2.http.Headers
+import retrofit2.http.Path
+import retrofit2.http.Query
+import retrofit2.http.Streaming
+import retrofit2.http.Url
+
+interface RawUrl {
+
+    @GET
+    @Streaming
+    suspend fun fetchFile(@Url url: String): ResponseBody
+
+    @GET
+    suspend fun fetchString(@Url url: String): String
+
+    @GET
+    suspend fun fetchModuleJson(@Url url: String): ModuleJson
+
+    @GET
+    suspend fun fetchUpdateJson(@Url url: String): UpdateJson
+}
+
+interface GithubApiServices {
+
+    @GET("/repos/{owner}/{repo}/releases")
+    @Headers("Accept: application/vnd.github+json")
+    suspend fun fetchReleases(
+        @Path("owner") owner: String = "topjohnwu",
+        @Path("repo") repo: String = "Magisk",
+        @Query("per_page") per: Int = 10,
+        @Query("page") page: Int = 1,
+    ): Response<MutableList<Release>>
+
+    @GET("/repos/{owner}/{repo}/releases/latest")
+    @Headers("Accept: application/vnd.github+json")
+    suspend fun fetchLatestRelease(
+        @Path("owner") owner: String = "topjohnwu",
+        @Path("repo") repo: String = "Magisk",
+    ): Release
+}

app/core/src/main/java/com/topjohnwu/magisk/core/di/Networking.kt

@@ -5,6 +5,7 @@ import com.squareup.moshi.Moshi
 import com.topjohnwu.magisk.ProviderInstaller
 import com.topjohnwu.magisk.core.BuildConfig
 import com.topjohnwu.magisk.core.Config
+import com.topjohnwu.magisk.core.model.DateTimeAdapter
 import com.topjohnwu.magisk.core.utils.LocaleSetting
 import okhttp3.Cache
 import okhttp3.ConnectionSpec
@@ -77,7 +78,7 @@ fun createOkHttpClient(context: Context): OkHttpClient {
 }
 
 fun createMoshiConverterFactory(): MoshiConverterFactory {
-    val moshi = Moshi.Builder().build()
+    val moshi = Moshi.Builder().add(DateTimeAdapter()).build()
     return MoshiConverterFactory.create(moshi)
 }
 

app/core/src/main/java/com/topjohnwu/magisk/core/di/ServiceLocator.kt

@@ -35,8 +35,8 @@ object ServiceLocator {
     val markwon by lazy { createMarkwon(AppContext) }
     val networkService by lazy {
         NetworkService(
-            createApiService(retrofit, Const.Url.GITHUB_PAGE_URL),
-            createApiService(retrofit, Const.Url.GITHUB_RAW_URL),
+            createApiService(retrofit, Const.Url.INVALID_URL),
+            createApiService(retrofit, Const.Url.GITHUB_API_URL),
         )
     }
 }

app/core/src/main/java/com/topjohnwu/magisk/core/download/Subject.kt

@@ -8,7 +8,7 @@ import android.net.Uri
 import android.os.Parcelable
 import androidx.core.net.toUri
 import com.topjohnwu.magisk.core.Info
-import com.topjohnwu.magisk.core.model.MagiskJson
+import com.topjohnwu.magisk.core.model.UpdateInfo
 import com.topjohnwu.magisk.core.model.module.OnlineModule
 import com.topjohnwu.magisk.core.utils.MediaStoreUtils
 import com.topjohnwu.magisk.view.Notifications
@@ -38,7 +38,7 @@ abstract class Subject : Parcelable {
 
     @Parcelize
     class App(
-        private val json: MagiskJson = Info.remote.magisk,
+        private val json: UpdateInfo = Info.update,
         override val notifyId: Int = Notifications.nextId()
     ) : Subject() {
         override val title: String get() = "Magisk-${json.version}(${json.versionCode})"

app/core/src/main/java/com/topjohnwu/magisk/core/model/UpdateInfo.kt

@@ -1,17 +1,23 @@
 package com.topjohnwu.magisk.core.model
 
 import android.os.Parcelable
+import com.squareup.moshi.FromJson
+import com.squareup.moshi.Json
 import com.squareup.moshi.JsonClass
+import com.squareup.moshi.JsonQualifier
+import com.squareup.moshi.ToJson
 import kotlinx.parcelize.Parcelize
+import java.time.LocalDateTime
+import java.time.format.DateTimeFormatter.ISO_OFFSET_DATE_TIME
 
 @JsonClass(generateAdapter = true)
-data class UpdateInfo(
-    val magisk: MagiskJson = MagiskJson(),
+class UpdateJson(
+    val magisk: UpdateInfo = UpdateInfo(),
 )
 
 @Parcelize
 @JsonClass(generateAdapter = true)
-data class MagiskJson(
+data class UpdateInfo(
     val version: String = "",
     val versionCode: Int = -1,
     val link: String = "",
@@ -27,11 +33,37 @@ data class ModuleJson(
 )
 
 @JsonClass(generateAdapter = true)
-data class CommitInfo(
-    val sha: String
+data class ReleaseAssets(
+    val name: String,
+    @Json(name = "browser_download_url") val url: String,
 )
 
+class DateTimeAdapter {
+    @ToJson
+    fun toJson(date: LocalDateTime): String {
+        return date.toString()
+    }
+
+    @FromJson
+    fun fromJson(date: String): LocalDateTime {
+        return LocalDateTime.parse(date, ISO_OFFSET_DATE_TIME)
+    }
+}
+
 @JsonClass(generateAdapter = true)
-data class BranchInfo(
-    val commit: CommitInfo
-)
+data class Release(
+    @Json(name = "tag_name") val tag: String,
+    val name: String,
+    val prerelease: Boolean,
+    val assets: List<ReleaseAssets>,
+    val body: String,
+    @Json(name = "created_at") val createdTime: LocalDateTime,
+) {
+    val versionCode: Int get() {
+        return if (tag[0] == 'v') {
+            (tag.drop(1).toFloat() * 1000).toInt()
+        } else {
+            tag.drop(7).toInt()
+        }
+    }
+}

app/core/src/main/java/com/topjohnwu/magisk/core/model/su/SuPolicy.kt

@@ -4,15 +4,16 @@ import com.topjohnwu.magisk.core.data.magiskdb.MagiskDB
 
 class SuPolicy(
     val uid: Int,
-    var policy: Int = INTERACTIVE,
+    var policy: Int = QUERY,
     var remain: Long = -1L,
     var logging: Boolean = true,
     var notification: Boolean = true,
 ) {
     companion object {
-        const val INTERACTIVE = 0
+        const val QUERY = 0
         const val DENY = 1
         const val ALLOW = 2
+        const val RESTRICT = 3
     }
 
     fun toMap(): MutableMap<String, Any> {