Stream UnifOMR digests and harden Android FFI/chat sync path.

Adopt chunked GetUnifOmrDigest, ownership/envelope/TLS/Tor hardening, and
scroll chat threads to the newest message on open.

Author: nighthawk24

app/build.gradle.kts

@@ -27,6 +27,15 @@ android {
         // Override: -PLIGHTWALLET_TLS_PIN_SHA256=<hex> or gradle.properties.
         val tlsPin = (project.findProperty("LIGHTWALLET_TLS_PIN_SHA256") as? String)?.trim().orEmpty()
         manifestPlaceholders["LIGHTWALLET_TLS_PIN_SHA256"] = tlsPin
+        // Release builds must ship a pin (fail closed at configure time).
+        val isReleaseTask = gradle.startParameter.taskNames.any {
+            it.contains("Release", ignoreCase = true) && !it.contains("UnitTest", ignoreCase = true)
+        }
+        if (isReleaseTask && (tlsPin.isEmpty() || tlsPin == "0".repeat(64) || tlsPin.equals("PLACEHOLDER", true))) {
+            throw GradleException(
+                "LIGHTWALLET_TLS_PIN_SHA256 must be set to a real 64-hex leaf pin for release builds"
+            )
+        }
 
         if (project.property("IS_USE_TEST_ORCHESTRATOR").toString().toBoolean()) {
             testInstrumentationRunnerArguments["clearPackageData"] = "true"

darkfi-android-sdk/src/main/java/com/nighthawkapps/lib/android/sdk/chat/DarkfiChatPreferences.kt

@@ -21,7 +21,7 @@ class DarkfiChatPreferences(
      * ([socksHost]:[socksPort], default loopback). Also gates DarkIRC SOCKS for non-loopback hosts.
      */
     var routeOutboundThroughTor: Boolean
-        get() = sp.getBoolean(KEY_TOR, false)
+        get() = sp.getBoolean(KEY_TOR, true)
         set(value) {
             sp.edit().putBoolean(KEY_TOR, value).apply()
         }

darkfi-android-sdk/src/main/java/com/nighthawkapps/lib/android/sdk/daemon/EmbeddedPackagedExecutable.kt

@@ -8,6 +8,7 @@ import com.nighthawkapps.lib.android.spackle.Twig
 import java.io.File
 import java.io.FileOutputStream
 import java.io.IOException
+import java.security.MessageDigest
 
 /**
  * Resolves packaged native executables for Android 10+ (W^X / SELinux).
@@ -17,6 +18,14 @@ import java.io.IOException
  * `android:extractNativeLibs="true"` so they land under [android.content.pm.ApplicationInfo.nativeLibraryDir].
  */
 internal object EmbeddedPackagedExecutable {
+    /**
+     * Optional expected SHA-256 (hex) per ABI for release integrity.
+     * Empty map / missing ABI = skip check (debug). Release builds should populate
+     * via BuildConfig from Gradle.
+     */
+    @Volatile
+    var expectedSha256ByAbi: Map<String, String> = emptyMap()
+
     fun resolve(
         context: Context,
         jniLibFileName: String,
@@ -27,22 +36,58 @@ internal object EmbeddedPackagedExecutable {
         val app = context.applicationContext
         val fromJni = File(app.applicationInfo.nativeLibraryDir, jniLibFileName)
         if (fromJni.exists() && fromJni.length() > 0L) {
-            return fromJni
+            return verifyOrNull(fromJni)
         }
 
         val fromCodeCache = extractAssetOnce(app, assetSubdir, assetBinaryName, File(app.codeCacheDir, jniLibFileName))
         if (fromCodeCache != null) {
-            return fromCodeCache
+            return verifyOrNull(fromCodeCache)
         }
 
         return extractAssetOnce(
             app,
             assetSubdir,
             assetBinaryName,
             File(app.filesDir, legacyRelativePath),
-        )
+        )?.let { verifyOrNull(it) }
     }
 
+    private fun verifyOrNull(file: File): File? {
+        val expected = expectedSha256ByAbi[Build.SUPPORTED_ABIS.firstOrNull().orEmpty()]
+            ?: expectedSha256ByAbi[abiFolder()]
+        if (expected.isNullOrBlank()) {
+            return file
+        }
+        val actual = sha256Hex(file) ?: return null
+        if (!actual.equals(expected, ignoreCase = true)) {
+            Twig.error {
+                "Embedded executable SHA-256 mismatch for ${file.name}: refusing exec"
+            }
+            return null
+        }
+        return file
+    }
+
+    private fun abiFolder(): String =
+        mapAbiToAssetFolder(Build.SUPPORTED_ABIS.firstOrNull().orEmpty()).orEmpty()
+
+    private fun sha256Hex(file: File): String? =
+        try {
+            val md = MessageDigest.getInstance("SHA-256")
+            file.inputStream().use { input ->
+                val buf = ByteArray(8192)
+                while (true) {
+                    val n = input.read(buf)
+                    if (n <= 0) break
+                    md.update(buf, 0, n)
+                }
+            }
+            md.digest().joinToString("") { "%02x".format(it) }
+        } catch (e: Exception) {
+            Twig.warn { "SHA-256 failed for ${file.absolutePath}: $e" }
+            null
+        }
+
     /**
      * argv for [ProcessBuilder] when running a PIE binary packaged as `lib*_embedded.so`.
      * Uses the system dynamic linker so Android loads the ELF like a normal executable.

darkfi-android-sdk/src/test/java/com/nighthawkapps/lib/android/sdk/chat/DarkfiChatPreferencesEmbeddedTorTest.kt

@@ -33,10 +33,10 @@ class DarkfiChatPreferencesEmbeddedTorTest {
     }
 
     @Test
-    fun routeOutboundThroughTor_defaultsToFalse() {
+    fun routeOutboundThroughTor_defaultsToTrue() {
         val app = RuntimeEnvironment.getApplication() as Application
         val prefs = DarkfiChatPreferences(app)
-        assertFalse(prefs.routeOutboundThroughTor)
+        assertTrue(prefs.routeOutboundThroughTor)
     }
 
     @Test

rust/Cargo.lock

@@ -45,6 +45,7 @@ smol = "2.0.2"
 unicode-normalization = "0.1.24"
 url = "2.5.8"
 zeroize = "1.8"
+x509-parser = "0.16"
 uniffi = { version = "0.31.1", features = ["scaffolding-ffi-buffer-fns", "cli"] }
 thiserror = "2"
 log = "0.4"
@@ -53,6 +54,7 @@ tracing-subscriber = { version = "0.3", default-features = false, features = ["f
 tonic = { version = "0.12", features = ["tls", "tls-webpki-roots"] }
 prost = "0.13"
 async-compat = "0.2"
+async-stream = "0.3"
 rustls = { version = "0.23", default-features = false, features = ["ring", "tls12"] }
 rustls-pki-types = "1"
 regex-lite = "0.1"