Skip to content

VRKA Android 4.5.2

Choose a tag to compare

View all tags
@MaverickRox MaverickRox released this 09 Sep 16:17
· 22 commits to main since this release
v4.5.2
85631ee

VRKA Android 4.5.2 — yt-dlp Component Updater BouncyCastle Provider & R8 Compatibility Fix

VRKA Android 4.5.2 delivers a targeted cryptographic reliability fix for the native yt-dlp component updater, resolving an OpenPGP verification crash on minified release builds, adding comprehensive regression tests, and confirming in-place upgrade and live component updates on physical hardware.

Root Cause & Problem Description

On fresh installations of minified release builds, triggering a yt-dlp Engine update resulted in:
Update failed: exception on setup: java.security.NoSuchAlgorithmException: no such algorithm: S

Investigation revealed two interrelated factors:

  1. R8 Minification Stripping / Obfuscation: Release builds enabled with R8 obfuscated and stripped internal BouncyCastle reflection and algorithm lookup tables because app/proguard-rules.pro lacked an explicit keep rule for org.bouncycastle.**.
  2. Android Platform Security Provider Precedence: SecureComponentUpdater.ensureBouncyCastleProvider() relied on Security.getProvider("BC"). Because Android includes a stripped internal system provider named "BC" (com.android.org.bouncycastle), the application could route cryptographic operations through Android's incomplete system provider rather than the bundled full BouncyCastle library.

Key Changes & Fix

  • BouncyCastle R8 Keep Rules: Added -keep class org.bouncycastle.** { *; }, -dontwarn org.bouncycastle.**, and -dontwarn javax.naming.** to app/proguard-rules.pro, preserving complete algorithm lookup mappings and cryptographic provider infrastructure under R8 shrinking and obfuscation.
  • Explicit Bundled Provider Resolution: Updated SecureComponentUpdater to instantiate and cache a direct instance of org.bouncycastle.jce.provider.BouncyCastleProvider. This explicit provider instance is supplied directly to JcaPGPContentVerifierBuilderProvider().setProvider(provider) and JcaKeyFingerprintCalculator().setProvider(provider) during OpenPGP detached signature verification, eliminating reliance on platform "BC" lookup while preserving platform security provider ordering.
  • Post-Update Execution Verification: Refined Step 5 post-update execution checks to verify the newly installed binary directly via subprocess execution (--version) and fallback to disk presence verification, preventing false rollback triggers on fresh installs where shared preferences have not yet initialized.
  • Cryptographic Security Continuity: The full OpenPGP verification model is strictly preserved. Detached signatures (SHA2-256SUMS.sig) are validated against the pinned primary trust anchor (AC0CBBE6848D6A873464AF4E57CF65933B5A7581), SHA-256 checksums are verified before binary replacement, and transactional rollback protection remains fully intact.

Regression Testing & Test Results

  • Automated Regression Suite:
    • SecureComponentUpdaterTest#test29_EnsureBouncyCastleProviderSuppliesRequiredAlgorithms: Verifies the bundled BouncyCastle provider exposes SHA-256, SHA-512, SHA256withRSA, and SHA512withRSA.
    • SecureComponentUpdaterTest#test30_VerifyManifestSignatureUsesBundledProviderDirectly: Verifies real PGP manifest and signature verification against the pinned public key using the explicit bundled provider.
  • Total Test Results: 192 unit tests executed across 17 test suites with 0 failures, 0 errors, 0 skipped.

Physical Device Verification

  • Target Hardware: OnePlus 11 5G (CPH2447, Android 16, serial 897f6ce5).
  • In-Place Upgrade: Verified via adb install -r VRKA-Android-v4.5.2.apk with zero signature mismatch against canonical lineage.
  • Live Component Update: Triggered live yt-dlp update on device. Logcat confirmed:
    • VRKA-SecureUpdater: Fetching and verifying manifest for yt-dlp/yt-dlp-nightly-builds@2026.08.30.232658...
    • VRKA-SecureUpdater: OpenPGP signature successfully verified against pinned primary key (AC0CBBE6848D6A873464AF4E57CF65933B5A7581)
    • VRKA-SecureUpdater: SHA-256 checksum verified successfully
    • VRKA-SecureUpdater: Executing post-update verification...
    • VRKA-SecureUpdater: yt-dlp successfully updated and verified: v2026.08.30.232658
    • Zero occurrence of NoSuchAlgorithmException: no such algorithm: S.

Release Artifacts & Checksums

  • Package: VRKA-Android-v4.5.2.apk
  • Size: 154,866,257 bytes
  • SHA-256 Checksum: 468df24d3d0d123f386e8acdf1fcadda7e726950b387394024b418d5db575996
  • Signing Certificate (SHA-256): 9befdbf4fb00acedb72f866ce4016944c95ea99448e205768383b310ca11e1fa (Canonical Lineage)
  • Signing Certificate (SHA-1): 7758980f74a503684bf1a187994e447823d19d7c
Assets 3
Loading