* Encrypt stored secrets with a keystore AES-GCM key and migrate old values on read
Secrets and the PIN were AES-CBC without authentication, under a random key kept in shared preferences
and wrapped by a keystore RSA key with PKCS#1 v1.5 padding. They are now AES-256-GCM under a key that
never leaves the Android keystore, stored as "v2:" + Base64.
Old values stay readable through a read-only decrypter of the previous scheme; nothing is written in it
any more and no new RSA key is created. A legacy value is re-encrypted when it is read, and replaced
only once the new copy decrypts to the same text. A value that cannot be decrypted now reads as absent
and is left untouched, where decrypt() used to return "" and let a caller treat it as a value.
* Bind biometric unlock to a keystore key
A biometric success was taken from the prompt callback alone. With strong biometrics the prompt now
carries a cipher of a keystore key that requires user authentication and is invalidated when
biometrics are enrolled: the first prompt seals a random token, later ones must open it, and only an
opened token unlocks. If biometrics changed, biometry is turned off and the PIN is asked for. Weak
biometrics (most face unlock) cannot use a keystore key and keep the plain prompt. androidx.biometric
goes to 1.1.0 for the authenticator classes.
* Log the light client under a fixed tag; LOG_TAG in a coroutine named the coroutine
* DKS hub: open each app on its own domain
Seven tiles opened app.pezkuwichain.io routes or a front page while the app
has a domain of its own. Each now opens that domain, even where the site is
still a "coming soon" page, so the tile keeps its address when the site
arrives:
Wallet explorer front page -> cuzdan.pex.network
P2P / Buy-Sell app/p2p -> buy-sell.pezkiwi.app
B2B app/bereketli -> bereketli.pezkiwi.app
Vote app/elections -> governance.pezkuwichain.io
Proposals app/citizens/government-> governance.pezkuwichain.io
Identity app/identity -> be-citizen.pezkiwi.app
Forum app/forum -> forum.pezkuwichain.io
B2B went through a sign-in bridge that only helps a user signed in to the
web app, which the wallet's DApp browser never is: it loaded the whole web
app, then forwarded to bereketli.pezkiwi.app anyway.
* Release 1.3.0
Version 1.2.0 -> 1.3.0, with release notes in English, Turkish and
Kurmanci for the Ecosystem Hub, the config that keeps working when
GitHub is blocked, and the splash and deep link fixes.
* feat(network): fetch config from jsDelivr when raw.githubusercontent.com fails
Every config file the app reads -- chains, assets, DApps, XCM, banners, token
icons -- comes from raw.githubusercontent.com with no other source, so when that
host cannot be reached a fresh install has no chains at all.
ConfigMirrorInterceptor retries the same file on cdn.jsdelivr.net and then
fastly.jsdelivr.net when the primary fails to connect or answers 403, 429, 451
or 5xx. A 404 is an answer and is returned as is. A host that failed is skipped
for ten minutes so later requests do not each wait for its timeout. Mirror
requests revalidate, so a mirror's long max-age cannot pin a copy in the HTTP
cache after the primary is back.
The shared OkHttp client and Coil's image client both carry it.
* feat(runtime): start a first install from the chain list the APK was built with
A first install has no chains until chains.json is fetched, and the fetch
retries forever: with GitHub and its mirrors unreachable the wallet stays
empty.
The runtime module now bundles the live chains.json at build time
(bundleChainsConfig, run before preBuild, falling back to jsDelivr and
refusing anything that is not a non-empty JSON array). When the local
database is empty, ChainSyncService tries the network once and, if that
fails, applies the bundled list so the wallet opens; the fetched list then
replaces it through the usual diff as soon as it arrives.
* feat(dapps): show the bundled DApps catalog until one can be fetched
The DApps catalog lived only in memory and every read waited on first(), so
with the catalog URL unreachable the DApps screen waited forever.
feature-dapp-impl now bundles dapps_full.json at build time. On the first
sync the repository tries the network once and, if that fails, publishes the
bundled catalog so every read returns; the fetched catalog replaces it as
soon as it arrives.
The download task moves to scripts/bundled-config.gradle and serves both
the chain list and the DApps catalog. runtime and feature-dapp-impl unit
tests return defaults for android.util.Log, which the fallback calls.
* feat(network): resolve names over DNS-over-HTTPS first, system DNS as fallback
A network that answers plain DNS with a wrong address decides where the app
connects. The shared OkHttp client and Coil's client now resolve through
EncryptedFirstDns: Google, Cloudflare and Quad9 over HTTPS, each reached by
IP, then the system resolver if all of them fail, so no network is worse off.
- A resolver whose request failed is skipped for ten minutes, so a network
that blocks DoH pays the four-second timeout once. NXDOMAIN and SERVFAIL do
not count as failures.
- IPv4 addresses are returned first: DoH answers IPv6 whether or not the
network has it, and OkHttp tries addresses in order.
- IP literals and localhost never leave the device.
WebSocket RPC (nv-websocket) still resolves through the system.
* feat(config): verify signed config metadata, TUF style
The rules the app will apply to config it fetches, not wired yet:
- A root, signed by a threshold of root keys, names the keys that may sign
the targets list and how many must. The APK carries the first root.
- A new root is accepted one version at a time, signed by a threshold of the
old root's keys and of its own, so keys can be replaced without a release
and a lost targets key can be revoked.
- The targets list gives the sha256 of each config file; it cannot go back a
version, cannot jump more than 10,000 at once, and is refused once it or
its root has expired.
- Ed25519 over the payload bytes exactly as published (BouncyCastle, already
a dependency); a key signing twice counts once; a key must match its id.
* fix(config): parse metadata with the Gson API the app resolves
JsonParser.parseString is not in the Gson version on the app's classpath;
the instance parse method is, and behaves the same here.
* test(runtime): add the Log.e overload with a throwable to the test shim
The first-install fallback logs the failed fetch with its exception, and the
shim only had the two-argument form, so the test hit NoSuchMethodError.
* feat(config): refuse config files the signed list does not give
SignedConfigInterceptor checks every JSON file from pezkuwi-wallet-utils
against signed/targets.json, whichever host the mirrors got it from. A
file the list does not give, or one without a verified list behind it,
comes back as a 502, so callers keep the stored chains and bundled
lists as they do when the source is unreachable. Newer roots are
followed from signed/root.N.json; the targets version and the latest
time seen are stored, so an older list cannot be replayed.
Root keys may now be sr25519 wallet accounts: they sign through the
wallet's message signing, which wraps the bytes in <Bytes>, and the
SDK's schnorrkel verifies them. The APK carries root 1 as an asset,
trusted as the APK is.
Play rejects updates whose native libraries are not aligned for 16 KB memory pages,
enforced since Nov 1 2025. Measuring the released bundle showed exactly one library
short, and only on one ABI:
arm64-v8a 7/7 aligned at 0x4000
x86_64 6/7 aligned; libpl_droidsonroids_gif.so at 0x1000
That library comes from pl.droidsonroids.gif:android-gif-drawable 1.2.19, inherited
from upstream and never used here: no GifDrawable, GifImageView, GifTextView or
pl.droidsonroids reference exists in any Kotlin, Java or XML file in the project.
Removing it beats upgrading to 1.2.32 — an unused dependency should not be carried at
any version, and this also drops roughly 175 KB of dead native code across four ABIs.
Everything else in the bundle was already aligned, and jniLibs.useLegacyPackaging is
already false, so nothing more is needed for the requirement.
Two gaps, both invisible until you look for them.
There was no update mechanism at all. Someone on an old build stayed on it until they
happened to open the Play Store on their own. For a wallet that is worse than an
inconvenience: today's multisig signing fix would have reached nobody who was not
already looking.
InAppUpdates asks Play on every foreground. A user a few days behind gets the flexible
flow — the download runs in the background and the wallet stays usable, because
interrupting someone mid-transfer to force an update is its own kind of harm. Past
fourteen days of staleness, or on a release marked priority 4+ in Play Console, it
switches to immediate. onResume finishes an interrupted immediate update and installs a
flexible one that completed while the app was backgrounded; without that the first
leaves a user stuck and the second never installs.
Ratings had the same shape of gap: people who would happily rate the wallet never do,
because nothing ever asks. Play's in-app card asks without sending them to the store.
Play answers neither "has this user rated" nor "what did they choose" — by design. It
also throttles to a handful of showings a year and silently drops the rest. So the gates
in AppReviewTracker are not there to avoid nagging, which Play already handles; they
exist to spend those few real chances well: three successful operations, three days
since first use, ninety since the last ask, and not within two days of an error.
Recording sits in RealExtrinsicService, the single point every on-chain action passes
through, so transfers and staking are covered without a hook per screen. The tracker
swallows everything it touches — a rating counter must never be able to fail a transfer.
Both features no-op outside a Play install, so neither can be verified from a Firebase
build; that needs an internal testing track.
Version 1.2.0.
* redesign(dashboard): brand-book restyle of Pezkuwi dashboard card
Match the brand book / handoff screenshot:
- bg_pezkuwi_dashboard: blue/indigo gradient -> frosted dark-navy surface
(#1C1F2E) with a 1px periwinkle hairline, 20dp corners.
- item_pezkuwi_dashboard: replace hardcoded non-brand colors —
trust value amber #FFD54F -> zer #FDB813; welati count -> positive #2FC864;
Approve/start buttons Material-green -> kesk #009639; Sign red -> sor #E2231A;
Share button yellow #FDD835 -> frosted-navy secondary #2A2F45 (white text);
blue-grey text -> brand white tokens. Pill-er 12dp button corners.
* redesign(actions): circular action buttons (primary green Send + dark rest)
Match the brand-book screenshot: the balance action row (Send/Receive/Swap/
Buy/Gift) becomes circular icon buttons with a label below — Send on a kesk
green circle, the rest on frosted-dark circles. IDs preserved (used only for
click + isEnabled), so AssetsTotalBalanceView keeps working.
* redesign(dashboard): pro-level Pezkuwi card layout
Rework the card to match the brand-book screenshot: header row with a small
Newroz-flame icon + title/roles on the left and the citizen count on the right;
trust score row; full-height (48dp) pill-er (14dp) action buttons — Approve
(kesk, bold), Sign (sor), Share (frosted-dark with hairline). Adds the small
ic_nevroz_flame icon.
* release: bump versionName to 1.1.1 (dashboard & action-row redesign)
* redesign(colors): purge forbidden magenta/purple from palette
Brand book permits only the Kurdistan palette (kesk/sor/zer/fire) + navy.
Replace the four Nova-legacy violations in common colors.xml (names preserved,
so no references break):
- crowdloan_banner_gradient_start #BD387F -> #009639 (kesk)
- networks_banner_gradient_end #661D78 -> #017A2F (kesk-700)
- chip_on_card_background #443679 -> #3D999EC7 (frosted periwinkle)
- button_wallet_connect_background #353D67 -> #1F2A4D (neutral navy)
Repo-wide grep confirmed no other hardcoded magenta/purple literals or
purple/pink-named resources remain.
* redesign(type): adopt brand fonts (Space Grotesk / Plus Jakarta Sans / JetBrains Mono)
Brand book typography. Add OFL static fonts under common/res/font and repoint
the theme font attrs (consumed app-wide via ?attr/font* in styles.xml):
- fontRegular -> Plus Jakarta Sans Regular (body/UI)
- fontSemiBold -> Plus Jakarta Sans SemiBold
- fontBold/ExtraBold -> Space Grotesk Bold (display: balances, titles)
- fontExtraLight -> Plus Jakarta Sans Light
- Monospace text appearance (addresses/hashes) -> JetBrains Mono
Static TTFs chosen (minSdk 24 < variable-font API 26). All five verified to
cover Turkish + Kurdish Kurmancî glyphs (ş ğ ı İ ê î û ç …).
* redesign(splash): replace map+wordmark logo with Newroz flame brand mark
The first-launch splash logo (ic_loading_screen_logo) showed a Kurdistan map
with a baked-in wordmark. Per the brand book the mark is the Newroz flame.
Rasterized assets/nevroz-fire-flame.svg into the existing 6 density slots
(same pixel dimensions = drop-in, no bg_splash.xml change, transparent WebP so
it composites cleanly over the splash background).
* redesign(onboarding): welcome hero -> Global United States of Pezkuwi
Replace the legacy onboarding hero (ic_create_wallet_background, whose six
density PNGs had inconsistent broken dimensions) with the brand 'Global United
States of Pezkuwi' infographic. Consolidate to a single high-res WebP in
drawable-nodpi (1408x768, 204K vs 1.75MB PNG) and switch the welcome ImageView
scaleType centerCrop -> fitCenter so it shows full and uncropped above the
CTA buttons, per the brand book.
* redesign(assets): purge magenta/purple from raster illustrations
colors.xml only covers named colors; these raster drawables still carried
forbidden magenta/purple/pink pixels. Selectively rotate the 255-350 deg hue
band (purple-magenta-pink) toward kesk green/teal across all densities,
preserving gradients, shapes and the on-brand blues:
- ic_pink_siri, ic_networks_banner_image, ic_no_added_networks,
ic_import_option_hardware, tinder_gov (6 densities each).
Third-party ic_powered_by_oak (OAK Network trademark) left untouched.
crowdloan_banner_image is being handled separately.
* redesign(assets): de-pink crowdloan banner across all densities
The crowdloan banner's magenta sphere was recolored to brand sor red (xxxhdpi).
Propagate that fix to the other five densities by downscaling the corrected
xxxhdpi master (LANCZOS), so every device shows the same brand-clean banner.
Pink-pixel scan now 0% on all six variants.
* chore: remove pre-production debug code (release-blocker)
CHANGELOG_PEZKUWI listed debug code to strip before production; two items were
still live:
- FeeLoaderV2Provider: the fee-retry dialog showed a raw "DEBUG: <err> | Runtime:
<diagnostics>" string to users -> reverted to the localized resource string and
dropped the diagnostics lookup.
- RuntimeFactory: removed the companion lastDiagnostics field and its assignment
(plus the now-dangling diagnostic vars), and the matching log line in the
PezkuwiLiveTransferTest androidTest.
Items #3-#6 were already clean. Repo now has no 'DEBUG:' literals or
lastDiagnostics references. CHANGELOG marked cleaned.
* docs: add BRAND.md — enforceable wallet brand rules
Kurdistan-only palette (no pink/magenta/purple), brand fonts, Newroz flame mark,
a PR brand checklist with a raster pink-scan snippet, the third-party-logo
exception, and the Apache-2.0 attribution rule (keep LICENSE/NOTICE). Points to
the canonical brand book at wiki.pezkuwichain.io/brand.
* release: bump versionName to 1.1.0 (brand-book UI redesign)
Live Play version is 1.0.4; minor bump for the UI redesign. versionCode stays
CI-managed (CI_BUILD_ID). Add the v1.1.0 entry to CHANGELOG_PEZKUWI.
Branch.io was inherited from Nova Wallet fork but never configured.
Removed SDK integration, manifest intent filters, Gradle dependencies,
Dagger DI modules, and string resources. Deep linking now routes
exclusively through app.pezkuwichain.io with verified assetlinks.json.
- Add 16KB page size alignment for native Rust libraries (Google Play requirement)
- Make Play Store workflow parametric (track/status as inputs)
- Update release notes for all languages (en, tr, ku)
- Add .gitignore entries for node_modules and version.properties
SatoshiQaziMuhammed