android

dcap-qvl for Android

Part of dcap-qvl — see the main README for the library and the other language bindings.

Native Android binding for dcap-qvl. Published as an AAR (com.phala:dcap-qvl-android) that bundles:

• libdcap_qvl_mobile.so for arm64-v8a, armeabi-v7a, x86, x86_64
• Kotlin bindings under com.phala.dcapqvl (generated by UniFFI)

Install

// settings.gradle.kts
dependencyResolutionManagement {
    repositories {
        mavenCentral()
    }
}

// app/build.gradle.kts
dependencies {
    implementation("com.phala:dcap-qvl-android:0.5.1")
}

Use

import com.phala.dcapqvl.*

// Fetch the collateral JSON over your own HTTP stack (OkHttp, Ktor, ...) and
// pass the raw bytes straight in — no field-by-field marshalling needed.
val collateralJson: ByteArray = httpClient.get(pccsUrl).body()
val quote = parseQuote(rawQuote)
val report = verify(rawQuote, collateralJson, /* nowSecs = */ (System.currentTimeMillis() / 1000).toULong())
println("status=${report.status} advisories=${report.advisoryIds}")

Wrap calls in withContext(Dispatchers.IO) if you're on the main thread — verification is synchronous and takes ~10 ms on modern hardware.

Build from source

Requires:

• Rust toolchain with Android targets: rustup target add aarch64-linux-android armv7-linux-androideabi i686-linux-android x86_64-linux-android
• cargo-ndk: cargo install cargo-ndk
• Android NDK (≥ r25). Set ANDROID_NDK_HOME or ANDROID_NDK_ROOT.
• JDK 17 + Gradle 8 (the included wrapper bootstraps Gradle itself).

Then:

make build_mobile_android   # from repository root

The script cross-compiles the four ABIs, regenerates the Kotlin source from the cdylib metadata, drops everything into the Gradle project, and assembles the AAR at android/build/outputs/aar/dcap-qvl-android-release.aar.

Tests

make test_mobile_android

Runs as JVM unit tests (no emulator required). The build script stages the host-built .so into dcap-qvl-mobile/android/.host-jna/, and build.gradle.kts passes that directory to the test JVM via -Djna.library.path so JNA dlopens it without classpath extraction.

Limitations

• No support for the encrypted-PPID PCK fetch flow yet (cert_type 2/3 quotes need their PCK certificate chain fetched separately and attached to the collateral before verifying).
• The PCCS HTTP client is intentionally not bundled — use OkHttp or Ktor from the app layer and pass the JSON collateral in.