OTT Play Native 0.2.1-preview.5

This preview fixes a playlist input-limit bypass and updates the build and CI toolchain. It is built from commit b34fd3ff8741eac40db78a81864d34771d6b3156, with Android versionCode=5.

Changes since preview.4

• The shared playlist parser now checks every normalized line before HLS detection and folded-metadata handling. These paths previously bypassed the existing per-line size check. Lines longer than 1,048,576 UTF-16 code units are now rejected with LINE_SIZE; the exact accepted boundary is covered by regression tests. Ordinary playlists retain the existing parsing behavior.
• Update the bundled shared core to source 96767e8, with a source/artifact hash manifest checked during the Android build. The Android change is the playlist-parser fix; the separate browser EPG helper in that upstream commit is not part of this APK.
• Update the Gradle Wrapper from 9.8.0 to 9.8.1, retaining distribution checksum verification. CI updates include CodeQL 4.38.3, artifact upload 7.0.2 and the reviewed CodeRabbit workflow revisions.

Security and compatibility

The playlist fix closes an input-boundary gap present in preview.4. This is separate from the HTTPS certificate-key policy, which was first included in preview.4 and remains enabled here. For users upgrading from preview.3, the owned HTTPS clients reject undersized or unsupported keys in the verified certificate chain before sending origin HTTP requests. Servers with weak certificates must replace the affected chain; disabling certificate verification is not a supported workaround.

Preview builds continue to require HTTPS. This release does not establish compatibility with every commercial provider, physical device or hardware DRM implementation.

Install or update

Install the signed APK on Android 8.0 / API 26 or later. The AAB is a distribution bundle and is not directly installable. The application ID remains play.ott.foss.nativeapp.preview; it can coexist with the older app and the separate production application. Existing previews update with the same signing certificate and an increasing version code. Do not uninstall an existing preview to work around a signature or downgrade error.

To migrate from a different application ID, export and import sources. Exported JSON contains plaintext credentials: keep it private and remove unnecessary copies after migration.

Verification

The source-matched host and emulator run passed unit tests, Android lint and builds, phone API 35 tests, and Android TV API 36 tests. Emulator results do not establish physical-device or Google Play acceptance.

The attached release-manifest.json and SHA256SUMS identify the signed APK/AAB and source commit. The preview signing certificate SHA-256 is 2021e3c927fff7c42daf395beacbf0ef738c6d878a827091afb48ddaa32c4dd8.

Full source comparison from preview.4.

This is a preview release, not a Google Play production release.

OTT Play Native 0.2.1-preview.4

This preview adds an explicit HTTPS certificate-key policy and refreshes the shared core and Android build dependencies. It is built from commit ae11bef4e58b0cd60312f9f200124e757e068cc8, with Android versionCode=4.

Changes since preview.3

• Before an owned HTTPS client sends an origin HTTP request, check every certificate in the platform-verified chain. Reject RSA keys below 2048 bits, EC fields or subgroup orders below 224 bits, DSA primes below 2048 bits or subgroups below 224 bits, unsupported key types and invalid Edwards key encodings. Normal CA/hostname verification remains enabled.
• Apply the policy after redirects and to reused/resumed HTTPS connections. Tests cover these paths and rejection before origin headers/body are sent. The policy also applies to HTTPS requests in the separate HTTP-compatible Full distribution; it does not add TLS protection to plain HTTP.
• Refresh the pinned shared-core artifact and its source/hash manifest, retain native Android networking, storage and playback adapters, and remove an unused provider-array helper.
• Update Kotlin to 2.4.20, Android Gradle Plugin to 9.4.1 and Gradle to 9.8.0, together with reviewed Android library and CI workflow updates. Improve emulator startup synchronization and avoid full Android builds for documentation-only changes.

Security and upgrade effects

Older previews relied on platform certificate acceptance without this additional key-size floor. A source using an undersized certificate may now fail to connect; replace the affected certificate chain rather than disabling verification. This policy covers owned HTTP clients and does not certify external DRM/platform implementations or all TLS key-exchange parameters.

Install the signed APK on Android 8.0 / API 26 or later. The preview application ID is unchanged and the version code advances from 3 to 4; retain the configured preview signing identity when updating. For migration from a different application ID, export/import sources and protect the plaintext credentials in exported JSON.

The linked source-matched run passed host tests/lint/builds and both phone API 35 and Android TV API 36 emulator suites. These results do not establish physical-device, paid-provider or Google Play acceptance.

Full source comparison from preview.3.

Build and publication record

Commit: ae11bef4e58b0cd60312f9f200124e757e068cc8

VersionCode: 4. Signed APK and AAB; checksums and certificate fingerprint are attached.

Verified host + phone/TV matrix: https://github.com/open-ott-play/ottplay-android/actions/runs/37977082351

Preview only. Application ID play.ott.foss.nativeapp.preview coexists with the previous app. Export/import sources to migrate; the exported file contains credentials. AAB is not directly installable. This is not a Google Play production release.

OTT Play Native 0.2.1-preview.3

This preview brings the native Android app onto the shared OttPlay domain core.

Changes:

• Shared policies now handle provider catalogs, EPG refresh decisions, channel navigation, playback decisions, favorites, backup and legacy source imports.
• Android keeps its native playback, networking and storage integrations. Migration contract tests preserve existing settings, favorite selections and import behavior.

Validation:

• 57 core and 90 app unit tests passed on the release source commit.
• Phone API 35 and Android TV API 36 each passed 26 instrumented tests, including onboarding, playback, Back navigation and the source editor.
• The signed preview build passed lint with 0 errors and 14 existing warnings.
• Published APK and AAB signatures, package/version metadata, checksums and source commit were independently verified.

Upgrade continuity with v0.2.0-preview.2 is verified at the package/signature level: the preview application ID and signing certificate are unchanged, and versionCode advances from 2 to 3. An in-place device upgrade was not run.

Commit: 88b7944f3028440cca64b49f46140a585656390c

VersionCode: 3. Signed APK and AAB; checksums and certificate fingerprint are attached.

Verified host + phone/TV matrix: https://github.com/open-ott-play/ottplay-android/actions/runs/35804109682

Preview only. Application ID play.ott.foss.nativeapp.preview coexists with the previous app. Export/import sources to migrate; the exported file contains credentials. AAB is not directly installable. This is not a Google Play production release.

OTT Play Native 0.2.0-preview.2

This is a signed native Android/Android TV preview for user-supplied IPTV sources. It provides a Kotlin/Compose interface and native Media3 playback, without embedding the older JavaScript player.

Included functionality

• Load M3U playlists or selected files, Xtream catalogs and the documented Stalker protocols; browse live channels, movies, series, groups and favorites.
• Display XMLTV programme information and supported catch-up streams. Background guide refresh uses Android WorkManager, so its requested interval is not an exact execution schedule.
• Use touch or TV remote navigation, native audio/subtitle selection, playback controls and supported picture-in-picture. Movie progress is retained across leaving the player.
• Store source configuration and cached stream/guide URLs with Android Keystore-backed AES-GCM. Manual JSON exports contain plaintext credentials and must be kept private.
• Try the bundled short synthetic offline video without a provider account. Native DRM support depends on Android, the device and the provider; this preview is not a claim of commercial-provider or physical-device acceptance.

The signed APK requires Android 8.0 / API 26 or later. Use the separate preview application ID described below. This preview predates the certificate-key-strength policy introduced in preview.4 and the playlist-line limit fix introduced in preview.5; prefer the current preview for those fixes.

Source and feature documentation for this preview.

Original build and publication record

Original build commit: f29a4eb17abb237e5cb58b2fd6a102012a0260fe

VersionCode: 2. Signed APK and AAB; checksums and the certificate fingerprint are attached.

Verified host + phone/TV matrix for the original build: https://github.com/open-ott-play/ottplay-android/actions/runs/34765433919

The documentation history was translated to English on 2026-09-13. The tag now points to the equivalent rewritten source revision 7b0eb46b785a00c308b066318eca4e61e3236378. Application code and build inputs are unchanged. The four uploaded assets, including the original release manifest and checksums, are preserved; their build SHA remains the original one above. Existing CI records describe that original build, not a new run on the rewritten commit.

Preview only. Application ID play.ott.foss.nativeapp.preview coexists with the previous app. Export/import sources to migrate; the exported file contains credentials. AAB is not directly installable. This is not a Google Play production release.