Skip to content

v0.3.0 — Provisioning that works, AMAPI features, hardened enrollment

Choose a tag to compare

View all tags
@andersonkxiass andersonkxiass released this 15 Jul 13:50
v0.3.0
144347d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

A prebuilt demo agent APK is attached to this release — openmdm-agent-v0.3.0.apk, signed, generic (server URL and enrollment config arrive via the provisioning QR), built without a TLS pin for evaluation. provisioning-checksum.txt carries the ready-to-paste PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM. See the README Quick Start and the openmdm-demo Android quick start.

Provisioning & enrollment

  • Managed provisioning actually works end-to-end: QR, afw#, and zero-touch provisioning intents are consumed, the mandatory GET_PROVISIONING_MODE / ADMIN_POLICY_COMPLIANCE activities exist (required on API 31+), and provisioning extras flow into automatic enrollment via a network-constrained worker (#16)
  • Work profile (BYOD) and COPE provisioning support (#21)
  • Device-pinned-key enrollment: single-use server challenge + hardware-Keystore ECDSA signature, with automatic HMAC fallback (#3); corrected HMAC canonical form (#2)
  • Enrollment security moved into :library for embedders; APK hash verification on installApp (#15)

Security

  • TLS certificate pinning is enforced on release builds — it was previously silently disabled because the buildConfig fields the pinner read were never defined (#14)

AMAPI feature set

  • ComplianceEvaluator enforcing OS-version/encryption/screen-lock rules, managed configurations, OS update policy + freeze periods, certificate install, full password policy (#18); AMAPI policy fields deserialized in PolicyMapper (#20)
  • DeviceOwnerManager collapsed onto the library's DeviceManager (965→185 lines), fixing a setAdbEnabled no-op and a wipeDevice preserveData inversion (#17)
  • VPN/proxy policy stubs removed rather than left advertising unimplemented behavior (#19)

Project

  • First CI (build/lint/test, caught 4 latent bugs), dependabot, hygiene docs (#4); test flake fixes (#22, #23)
  • Release workflow publishing the signed demo APK + provisioning checksum with every release (#24)
  • README rewritten to match the implementation: both enrollment paths, QR admin-extras keys, apksigner checksum recipe, correct minimum server version (#25)

Compatibility

Requires OpenMDM server ≥ 0.3.0 (protocol v2); device-pinned-key enrollment needs ≥ 0.9 with challenge storage. Tested against server 0.10.0.

Known limitations

The managed-provisioning flow and the new AMAPI DPM calls have unit/Robolectric coverage but have not yet had a full real-hardware Device Owner verification pass. Treat this as an evaluation release; production hardening is ongoing.

Assets 4
Loading