VRKA Android 4.5.1

VRKA Android 4.5.1 — Download Location UX, HTTP Header Propagation, Native Opus Alignment, and In-App Updater

VRKA Android 4.5.1 delivers a targeted release refining download destination management, end-to-end HTTP header transport verification, native Opus stream copy labeling, complete documentation alignment, and an integrated in-app application self-update mechanism.

Key Changes & Corrections

• Download Location UX Simplification:
  • Completely removed internal platform terminology ("MediaStore", "SAF", "remembered directory", "URI") across all user-facing interfaces.
  • Replaced technical storage labels with clear, user-focused "Download Location".
  • Implemented an application-owned modal prompt on first download attempt displaying the target destination (Downloads/VRKA), a [Choose Location] button, a Set as default and don't ask again option, and [Download] / [Cancel] actions.
  • Revamped Settings Storage section into a unified "Download Location" card showing the current destination with [Change] and [Reset] actions, accompanied by a two-way segmented selector ([Use selected] vs [Ask every time]).
  • Destinations are resolved at enqueue time so that queued items never prompt or stall.
• HTTP Header End-to-End Propagation:
  • Validated that Referer, Origin, and user-defined custom headers reliably reach network requests across direct extractor, direct stream, and HLS manifest + segment transport paths.
  • Backed by automated unit test suites (HttpHeaderE2ETest) and verified on physical hardware with live network captures (HttpHeaderDeviceTest).
• Opus Stream-Copy vs Transcode Clarification:
  • Updated audio option labels to "Opus (prefer native)" and added explicit helper documentation: "Prefer native Opus stream copy when available; transcode fallback if non-Opus source."
• Typography & Font Integrity:
  • Confirmed system font preference cleanly overrides monospace globally without residual layout clipping.
• Physical Device & Test Suite Verification:
  • 190 automated unit tests passing offline across 17 test suites.
  • Verified on OnePlus 11 5G (CPH2447, Android 16) with successful in-place upgrade, modal flow verification, live header inspection, native Opus direct stream copy extraction, and live updater verification.

In-App Application Update Mechanism

VRKA Android now features a native in-app application self-update mechanism, providing seamless upgrade notifications and installation directly within the application:

• GitHub Releases Integration: Periodically checks the official VRKA Android GitHub Releases repository (/repos/MaverickRox/VRKA-Android/releases/latest) for new application releases.
• 24-Hour Gating: Automatic startup update checks are rate-limited to execute at most once every 24 hours (86,400,000 ms), preventing unnecessary network traffic and API rate-limiting.
• Manual Check Bypass: A dedicated [Check for Updates] button in the Settings "About" section bypasses the 24-hour rate limit and triggers an immediate update check with informative feedback.
• Non-Blocking Startup: Startup update checks execute asynchronously on a background thread (Dispatchers.IO) and fail completely silently upon network timeouts, rate limits, or offline conditions, ensuring zero interruption to the application launch flow.
• Semantic Version Comparison: Evaluates versions using formal numeric segment comparison (SemanticVersion), ensuring proper ordering across multi-digit versions (e.g., 4.5.9 < 4.5.10, 4.9.0 < 5.0.0).
• Strict APK Asset Selection: Enforces the canonical VRKA naming pattern ^VRKA-Android-v\d+\.\d+\.\d+\.apk$ and selects the asset corresponding exactly to VRKA-Android-v$version.apk. Arbitrary APKs, non-matching asset names, and non-APK files are strictly rejected.
• Per-Hop Redirect Security: Validates all HTTP redirects explicitly (instanceFollowRedirects = false). Rejects insecure HTTP and protocol downgrades, validates hosts against approved GitHub release and asset hosts (api.github.com, github.com, objects.githubusercontent.com, release-assets.githubusercontent.com, raw.githubusercontent.com, *.githubusercontent.com), rejects arbitrary or look-alike hosts, and enforces a strict redirect limit (max 5 hops). Applied consistently to both GitHub API release querying and APK binary streaming.
• Secure FileProvider Installation: Downloads the release package into internal app cache (cacheDir/updates/) and safely invokes the Android PackageInstaller via FileProvider (com.mvrk.vrka.fileprovider) with temporary read URI permissions, validating canRequestPackageInstalls() on Android 8.0+.
• Independent Component Updater Separation: The application self-updater is strictly separate from the existing cryptographically authenticated yt-dlp native component updater (SecureComponentUpdater), which continues to operate independently with its own pinned OpenPGP verification.

Updater Verification

• Automated Tests: 14 dedicated unit tests in AppUpdateManagerTest (part of the 190-test offline suite) validating SemVer parsing, numeric comparison, draft/pre-release filtering, strict APK asset selection, HTTPS enforcement, HTTP downgrade rejection, arbitrary host rejection, and redirect resolution.
• Physical Hardware Verification: Verified on OnePlus 11 5G (CPH2447, Android 16, serial 897f6ce5). Clean startup, verified 24h gating log (VRKA-AppUpdater: Skipping background update check; within 24h gate), verified manual check reporting "VRKA is up to date", and verified seamless in-place package installation.

Release Artifacts & Checksums

• Package: VRKA-Android-v4.5.1.apk
• Size: 152,573,251 bytes
• SHA-256 Checksum: 5ad6eef20b5843cf726bad2f60993e7a98248aad171212a642bd95f4201ba594
• Signing Certificate (SHA-256): 9befdbf4fb00acedb72f866ce4016944c95ea99448e205768383b310ca11e1fa (Canonical Lineage)
• Signing Certificate (SHA-1): 7758980f74a503684bf1a187994e447823d19d7c