More submodules.

* Set android:debuggable=false.
 * Call native code through JNI only.  Having a native executable on disk and exec-ing it no longer seems possible.
 * Do all the Tilde Friends things in one process, without a proper sandbox, until I can wire up a restricted service worker process.
 * Jam Android App Bundle (.aab) building into the makefile.
 * Yuck.

.fdroid.yml

@@ -0,0 +1,40 @@
+Categories:
+  - Internet
+License: MIT
+
+AutoName: tildefriends
+AuthorName: Cory McWilliams
+AuthorEmail: cory@tildefriends.net
+
+RepoType: git
+Repo: https://dev.tildefriends.net/cory/tildefriends.git
+
+Builds:
+  - versionName: 0.0.21-wip
+    versionCode: 22
+    commit: 09b6a00731d45fa160b23a2c44be6def98d92d6a
+    subdir: src/android
+    submodules: true
+    sudo:
+      - apt-get update
+      - apt-get install -y ant make zip
+    androidupdate:
+      - no
+    scandelete:
+      - deps/libuv/docs/src/static/diagrams.key/Index.zip
+      - deps/openssl_src/cloudflare-quiche/*
+      - deps/openssl_src/fuzz/*
+      - deps/openssl_src/gost-engine/*
+      - deps/openssl_src/test/*
+      - deps/openssl_src/tlslite-ng/*
+    prebuild:
+      - sdkmanager "platforms;android-34" "build-tools;34.0.0"
+    build:
+      - mkdir bin/
+      - ANDROID_SDK=$$SDK$$ ANDROID_NDK=$$NDK$$ ANDROID_NDK_ROOT=$$NDK$$ make -C ../../ -j`nproc` fdroid
+    ndk: r26d
+
+AutoUpdateMode: Version ^v[0-9\.]+$
+UpdateCheckMode: Tags
+CurrentVersion: 0.0.21-wip
+CurrentVersionCode: 22

.gitea/workflows/build.yaml

@@ -0,0 +1,19 @@
+name: Build Tilde Friends
+run-name: ${{ gitea.actor }} is testing out Gitea Actions 🚀
+on: [push]
+
+jobs:
+  Build-All:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "🎉 The job was automatically triggered by a ${{ gitea.event_name }} event."
+      - run: echo "🐧 This job is now running on a ${{ runner.os }} server hosted by Gitea!"
+      - run: echo "🔎 The name of your branch is ${{ gitea.ref }} and your repository is ${{ gitea.repository }}."
+      - name: Check out repository code
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+      - run: echo "💡 The ${{ gitea.repository }} repository has been cloned to the runner."
+      - run: echo "🖥️ The workflow is now ready to test your code on the runner."
+      - run: make all -j`nproc`
+      - run: echo "🍏 This job's status is ${{ job.status }}."

.gitignore

@@ -1,11 +1,17 @@
+build/
+*.core
 db.*
 deps/ios_toolchain/
 deps/openssl/
 dist/
 .keys
+logs/
 **/node_modules
 out
+repo/
+result
 *.swo
 *.swp
+tmp/
+unsigned/
 .zsign_cache/
-result

.gitmodules

@@ -19,3 +19,6 @@
 [submodule "deps/picohttpparser"]
 	path = deps/picohttpparser
 	url = https://github.com/h2o/picohttpparser.git
+[submodule "deps/openssl_src"]
+	path = deps/openssl_src
+	url = https://github.com/openssl/openssl.git

GNUmakefile

@@ -3,12 +3,13 @@
 MAKEFLAGS += --warn-undefined-variables
 MAKEFLAGS += --no-builtin-rules
 
-VERSION_CODE := 21
+VERSION_CODE := 22
 VERSION_NUMBER := 0.0.21-wip
 VERSION_NAME := Psst.  Look behind you.
 
 SQLITE_URL := https://www.sqlite.org/2024/sqlite-amalgamation-3460000.zip
 LIBUV_URL := https://dist.libuv.org/dist/v1.48.0/libuv-v1.48.0.tar.gz
+BUNDLETOOL_URL := https://github.com/google/bundletool/releases/download/1.17.0/bundletool-all-1.17.0.jar
 
 PROJECT = tildefriends
 BUILD_DIR ?= out
@@ -16,6 +17,7 @@ UNAME_S := $(shell uname -s)
 UNAME_M := $(shell uname -m)
 
 ANDROID_SDK ?= ~/Android/Sdk
+BUNDLETOOL = out/bundletool.jar
 
 HAVE_WIN := 0
 
@@ -90,7 +92,7 @@ BUILD_TYPES += \
 	androidrelease-x86 \
 	androiddebug-x86_64 \
 	androidrelease-x86_64
-all: out/TildeFriends-arm-debug.apk out/TildeFriends-arm-release.apk out/TildeFriends-x86-debug.apk out/TildeFriends-x86-release.apk
+all: out/TildeFriends-arm-debug.apk out/TildeFriends-arm-release.apk out/TildeFriends-x86-debug.apk out/TildeFriends-x86-release.apk out/TildeFriends-release.fdroid.apk
 endif
 
 WINDOWS_TARGETS := \
@@ -150,9 +152,10 @@ ANDROID_RELEASE_TARGETS := $(filter-out $(DEBUG_TARGETS),$(ANDROID_TARGETS))
 NONANDROID_RELEASE_TARGETS := $(filter-out $(ANDROID_ARM64_TARGETS),$(RELEASE_TARGETS))
 NONANDROID_TARGETS := $(filter-out $(ANDROID_TARGETS),$(ALL_TARGETS))
 NONMACOS_TARGETS := $(filter-out $(MACOS_TARGETS) $(IOS_TARGETS) $(IOSSIM_TARGETS),$(ALL_TARGETS))
+DEADSTRIP_TARGETS := $(filter-out $(ANDROID_TARGETS),$(NONMACOS_TARGETS))
 
 $(NONANDROID_TARGETS): CFLAGS += -fno-omit-frame-pointer
-$(filter-out $(ANDROID_TARGETS) $(WINDOWS_TARGETS),$(ALL_TARGETS)): LDFLAGS += -rdynamic
+$(filter-out $(WINDOWS_TARGETS),$(ALL_TARGETS)): LDFLAGS += -rdynamic
 $(ANDROID_TARGETS): CFLAGS += \
 	--sysroot $(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/sysroot \
 	-fPIC \
@@ -205,7 +208,7 @@ $(ANDROID_X86_TARGETS): LDFLAGS += -Ldeps/openssl/android/x86/usr/local/lib
 $(ANDROID_X86_64_TARGETS): CFLAGS += -Ideps/openssl/android/x86_64/usr/local/include
 $(ANDROID_X86_64_TARGETS): LDFLAGS += -Ldeps/openssl/android/x86_64/usr/local/lib
 $(NONMACOS_TARGETS): CFLAGS += -Wno-cast-function-type
-$(NONMACOS_TARGETS): LDFLAGS += -Wl,--gc-sections
+$(DEADSTRIP_TARGETS): LDFLAGS += -Wl,--gc-sections
 $(IOS_TARGETS): CFLAGS += -mios-version-min=9.0 -Ideps/openssl/ios/ios64-xcrun/usr/local/include
 $(IOS_TARGETS): LDFLAGS += -Ldeps/openssl/ios/ios64-xcrun/usr/local/lib
 $(IOSSIM_TARGETS): CFLAGS += -Ideps/openssl/ios/iossimulator-xcrun/usr/local/include
@@ -616,7 +619,7 @@ $(IOS_TARGETS) $(IOSSIM_TARGETS): LDFLAGS += \
 
 unix: debug release
 win: windebug winrelease
-all: $(BUILD_TYPES) default.nix
+all: $(BUILD_TYPES)
 .PHONY: all win unix
 
 ALL_APP_OBJS := \
@@ -664,19 +667,6 @@ src/version.h : $(firstword $(MAKEFILE_LIST))
 	@echo "#define VERSION_NUMBER \"$(VERSION_NUMBER)\"" > $@
 	@echo "#define VERSION_NAME \"$(VERSION_NAME)\"" >> $@
 
-src/android/AndroidManifest.xml : $(firstword $(MAKEFILE_LIST))
-	@echo "[android_version] $@"
-	@sed -i \
-		-e 's/versionCode=".*"/versionCode="$(VERSION_CODE)"/' \
-		-e 's/versionName=".*"/versionName="$(VERSION_NUMBER)"/' \
-		-e 's/android:minSdkVersion="[[:digit:]]*"/android:minSdkVersion="$(ANDROID_MIN_SDK_VERSION)"/' \
-		-e 's/android:targetSdkVersion="[[:digit:]]*"/android:targetSdkVersion="$(ANDROID_TARGET_SDK_VERSION)"/' \
-		$@
-
-default.nix : $(firstword $(MAKEFILE_LIST))
-	@echo "[version] $@"
-	@sed -i -e 's/version = ".*";/version = "$(VERSION_NUMBER)";/' $@
-
 # Android support.
 out/res/layout_activity_main.xml.flat: src/android/res/layout/activity_main.xml
 	@mkdir -p $(dir $@)
@@ -689,8 +679,29 @@ out/res/drawable_icon.xml.flat: src/android/res/drawable/icon.xml
 	@$(ANDROID_BUILD_TOOLS)/aapt2 compile -o out/res/ src/android/res/drawable/icon.xml
 
 out/apk/res.apk out/gen/com/unprompted/tildefriends/R.java: out/res/layout_activity_main.xml.flat out/res/drawable_icon.xml.flat src/android/AndroidManifest.xml
-	@mkdir -p $(dir $@)
-	@$(ANDROID_BUILD_TOOLS)/aapt2 link -I $(ANDROID_PLATFORM)/android.jar out/res/layout_activity_main.xml.flat out/res/drawable_icon.xml.flat --manifest src/android/AndroidManifest.xml -o out/apk/res.apk --java out/gen/
+	@echo [aapt2 link] res.apk
+	@mkdir -p out/apk/
+	@$(ANDROID_BUILD_TOOLS)/aapt2 link -I $(ANDROID_PLATFORM)/android.jar out/res/layout_activity_main.xml.flat out/res/drawable_icon.xml.flat \
+		--version-code $(VERSION_CODE) \
+		--version-name $(VERSION_NUMBER) \
+		--min-sdk-version $(ANDROID_MIN_SDK_VERSION) \
+		--target-sdk-version $(ANDROID_TARGET_SDK_VERSION) \
+		--manifest src/android/AndroidManifest.xml \
+		-o out/apk/res.apk \
+		--java out/gen/
+
+out/apk/res.fdroid.apk out/gen_fdroid/com/unprompted/tildefriends/R.java: out/res/layout_activity_main.xml.flat out/res/drawable_icon.xml.flat src/android/AndroidManifest.xml
+	@echo [aapt2 link] res.fdroid.apk
+	@mkdir -p out/apk/
+	@$(ANDROID_BUILD_TOOLS)/aapt2 link -I $(ANDROID_PLATFORM)/android.jar out/res/layout_activity_main.xml.flat out/res/drawable_icon.xml.flat \
+		--version-code $(VERSION_CODE) \
+		--version-name $(VERSION_NUMBER) \
+		--min-sdk-version $(ANDROID_MIN_SDK_VERSION) \
+		--target-sdk-version $(ANDROID_TARGET_SDK_VERSION) \
+		--rename-manifest-package com.unprompted.tildefriends.fdroid \
+		--manifest src/android/AndroidManifest.xml \
+		-o out/apk/res.fdroid.apk \
+		--java out/gen_fdroid/
 
 JAVA_FILES := out/gen/com/unprompted/tildefriends/R.java $(wildcard src/android/com/unprompted/tildefriends/*.java)
 CLASS_FILES := $(foreach src,$(JAVA_FILES),out/classes/com/unprompted/tildefriends/$(notdir $(src:.java=.class)))
@@ -702,7 +713,7 @@ $(CLASS_FILES) &: $(JAVA_FILES)
 out/apk/classes.dex: $(CLASS_FILES)
 	@mkdir -p $(dir $@)
 	@echo "[d8] $@"
-	@$(ANDROID_BUILD_TOOLS)/d8 --$(BUILD_TYPE) --lib $(ANDROID_PLATFORM)/android.jar --output $(dir $@) out/classes/com/unprompted/tildefriends/*.class
+	@$(ANDROID_BUILD_TOOLS)/d8 --lib $(ANDROID_PLATFORM)/android.jar --output $(dir $@) out/classes/com/unprompted/tildefriends/*.class
 
 PACKAGE_DIRS := \
 	apps/ \
@@ -717,19 +728,59 @@ out/apk/TildeFriends-arm-debug.unsigned.apk: BUILD_TYPE := debug
 out/apk/TildeFriends-arm-release.unsigned.apk: BUILD_TYPE := release
 out/apk/TildeFriends-x86-debug.unsigned.apk: BUILD_TYPE := debug
 out/apk/TildeFriends-x86-release.unsigned.apk: BUILD_TYPE := release
+out/apk/TildeFriends-release.fdroid.unsigned.apk: BUILD_TYPE := release
 
 out/apk/TildeFriends-arm-debug.unsigned.apk: out/apk/classes.dex out/androiddebug/tildefriends out/androiddebug-armv7a/tildefriends $(RAW_FILES) out/apk/res.apk
 out/apk/TildeFriends-arm-release.unsigned.apk: out/apk/classes.dex out/androidrelease/tildefriends out/androidrelease-armv7a/tildefriends $(RAW_FILES) out/apk/res.apk
 out/apk/TildeFriends-x86-debug.unsigned.apk: out/apk/classes.dex out/androiddebug-x86_64/tildefriends out/androiddebug-x86/tildefriends $(RAW_FILES) out/apk/res.apk
 out/apk/TildeFriends-x86-release.unsigned.apk: out/apk/classes.dex out/androidrelease-x86_64/tildefriends out/androidrelease-x86/tildefriends $(RAW_FILES) out/apk/res.apk
+out/apk/TildeFriends-release.fdroid.unsigned.apk: out/apk/classes.dex out/androidrelease/tildefriends out/androidrelease-armv7a/tildefriends out/androidrelease-x86_64/tildefriends out/androidrelease-x86/tildefriends $(RAW_FILES) out/apk/res.fdroid.apk
+
+$(BUNDLETOOL):
+	@echo [curl] $(BUNDLETOOL_URL) TO $@
+	@curl -q -L --create-dirs -o $@ $(BUNDLETOOL_URL)
+
+out/TildeFriends.aab: out/apk/classes.dex $(filter-out %debug%, $(ANDROID_TARGETS)) $(RAW_FILES) out/apk/res.apk src/android/AndroidManifest.xml $(BUNDLETOOL)
+	@rm -rf out/aab/staging/
+	@mkdir -p out/aab/staging
+	@$(ANDROID_BUILD_TOOLS)/aapt2 link --proto-format -o out/aab/temporary.apk -I $(ANDROID_PLATFORM)/android.jar --manifest src/android/AndroidManifest.xml -R out/res/layout_activity_main.xml.flat -R out/res/drawable_icon.xml.flat --auto-add-overlay
+	@unzip out/aab/temporary.apk -d out/aab/staging/
+	@mkdir -p out/aab/staging/root/deps
+	@mkdir -p out/aab/staging/classes
+	@mkdir -p out/aab/staging/dex
+	@mkdir -p out/aab/staging/manifest
+	@mv out/aab/staging/AndroidManifest.xml out/aab/staging/manifest/AndroidManifest.xml
+	@cp out/apk/classes.dex out/aab/staging/dex/
+	@rm -fv out/base.zip
+	@cp -r out/apk-arm-release/lib/ out/aab/staging/
+	@cp -r out/apk-x86-release/lib/ out/aab/staging/
+	@cp -r apps/ out/aab/staging/root/
+	@rm -rf out/aab/staging/root/apps/welcome*
+	@cp -r core/ out/aab/staging/root/
+	@cp -r deps/prettier/ out/aab/staging/root/deps/
+	@cp -r deps/lit/ out/aab/staging/root/deps/
+	@cp -r deps/codemirror/ out/aab/staging/root/deps/
+	@cd out/aab/staging/; zip -r ../base.zip *; cd ../../../
+	@java -jar $(BUNDLETOOL) build-bundle --overwrite --config=src/android/BundleConfig.json --modules=out/aab/base.zip --output=$@
+	@jarsigner -keystore .keys/android.jks $@ androidKey -storepass android
+
+aab: out/TildeFriends.aab
+.PHONY: aab
+
+out/TildeFriends.apks: out/TildeFriends.aab $(BUNDLETOOL)
+	@java -jar $(BUNDLETOOL) build-apks --bundle out/TildeFriends.aab --overwrite --output $@ --ks .keys/android.jks --ks-key-alias androidKey --ks-pass pass:android
+
+aabgo: out/TildeFriends.apks $(BUNDLETOOL)
+	@java -jar $(BUNDLETOOL) install-apks --apks out/TildeFriends.apks
+	@adb shell am start com.unprompted.tildefriends/.TildeFriendsActivity
 
 out/apk/TildeFriends-arm-%.unsigned.apk:
 	@mkdir -p $(dir $@) out/apk-arm-$(BUILD_TYPE)/lib/arm64-v8a/ out/apk-arm-$(BUILD_TYPE)/lib/armeabi-v7a/
 	@echo "[aapt] $@"
-	@cp out/android$(BUILD_TYPE)/tildefriends out/apk-arm-$(BUILD_TYPE)/lib/arm64-v8a/tildefriends.so
-	@cp out/android$(BUILD_TYPE)-armv7a/tildefriends out/apk-arm-$(BUILD_TYPE)/lib/armeabi-v7a/tildefriends.so
-	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-arm-$(BUILD_TYPE)/lib/arm64-v8a/tildefriends.so
-	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-arm-$(BUILD_TYPE)/lib/armeabi-v7a/tildefriends.so
+	@cp out/android$(BUILD_TYPE)/tildefriends out/apk-arm-$(BUILD_TYPE)/lib/arm64-v8a/libtildefriends.so
+	@cp out/android$(BUILD_TYPE)-armv7a/tildefriends out/apk-arm-$(BUILD_TYPE)/lib/armeabi-v7a/libtildefriends.so
+	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-arm-$(BUILD_TYPE)/lib/arm64-v8a/libtildefriends.so
+	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-arm-$(BUILD_TYPE)/lib/armeabi-v7a/libtildefriends.so
 	@cp out/apk/res.apk $@.zip
 	@cp out/apk/classes.dex out/apk-arm-$(BUILD_TYPE)/
 	@cd out/apk-arm-$(BUILD_TYPE) && zip -u ../../$@.zip -q -9 -r . && cd ../../
@@ -739,16 +790,33 @@ out/apk/TildeFriends-arm-%.unsigned.apk:
 out/apk/TildeFriends-x86-%.unsigned.apk:
 	@mkdir -p $(dir $@) out/apk-x86-$(BUILD_TYPE)/lib/x86_64/ out/apk-x86-$(BUILD_TYPE)/lib/x86/
 	@echo "[aapt] $@"
-	@cp out/android$(BUILD_TYPE)-x86_64/tildefriends out/apk-x86-$(BUILD_TYPE)/lib/x86_64/tildefriends.so
-	@cp out/android$(BUILD_TYPE)-x86/tildefriends out/apk-x86-$(BUILD_TYPE)/lib/x86/tildefriends.so
-	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-x86-$(BUILD_TYPE)/lib/x86_64/tildefriends.so
-	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-x86-$(BUILD_TYPE)/lib/x86/tildefriends.so
+	@cp out/android$(BUILD_TYPE)-x86_64/tildefriends out/apk-x86-$(BUILD_TYPE)/lib/x86_64/libtildefriends.so
+	@cp out/android$(BUILD_TYPE)-x86/tildefriends out/apk-x86-$(BUILD_TYPE)/lib/x86/libtildefriends.so
+	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-x86-$(BUILD_TYPE)/lib/x86_64/libtildefriends.so
+	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-x86-$(BUILD_TYPE)/lib/x86/libtildefriends.so
 	@cp out/apk/res.apk $@.zip
 	@cp out/apk/classes.dex out/apk-x86-$(BUILD_TYPE)/
 	@cd out/apk-x86-$(BUILD_TYPE) && zip -u ../../$@.zip -q -9 -r . && cd ../../
 	@zip -u $@.zip -q -9 $(RAW_FILES)
 	@$(ANDROID_BUILD_TOOLS)/zipalign -f 4 $@.zip $@
 
+out/apk/TildeFriends-%.fdroid.unsigned.apk:
+	@mkdir -p $(dir $@) out/apk-fdroid-$(BUILD_TYPE)/lib/x86_64/ out/apk-fdroid-$(BUILD_TYPE)/lib/x86/ out/apk-fdroid-$(BUILD_TYPE)/lib/arm64-v8a/ out/apk-fdroid-$(BUILD_TYPE)/lib/armeabi-v7a/
+	@echo "[aapt] $@"
+	@cp out/android$(BUILD_TYPE)-x86_64/tildefriends out/apk-fdroid-$(BUILD_TYPE)/lib/x86_64/libtildefriends.so
+	@cp out/android$(BUILD_TYPE)-x86/tildefriends out/apk-fdroid-$(BUILD_TYPE)/lib/x86/libtildefriends.so
+	@cp out/android$(BUILD_TYPE)/tildefriends out/apk-fdroid-$(BUILD_TYPE)/lib/arm64-v8a/libtildefriends.so
+	@cp out/android$(BUILD_TYPE)-armv7a/tildefriends out/apk-fdroid-$(BUILD_TYPE)/lib/armeabi-v7a/libtildefriends.so
+	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-fdroid-$(BUILD_TYPE)/lib/x86_64/libtildefriends.so
+	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-fdroid-$(BUILD_TYPE)/lib/x86/libtildefriends.so
+	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-fdroid-$(BUILD_TYPE)/lib/arm64-v8a/libtildefriends.so
+	@$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip out/apk-fdroid-$(BUILD_TYPE)/lib/armeabi-v7a/libtildefriends.so
+	@cp out/apk/res.fdroid.apk $@.zip
+	@cp out/apk/classes.dex out/apk-fdroid-$(BUILD_TYPE)/classes.dex
+	@cd out/apk-fdroid-$(BUILD_TYPE) && zip -u ../../$@.zip -q -9 -r . && cd ../../
+	@zip -u $@.zip -q -9 $(RAW_FILES)
+	@$(ANDROID_BUILD_TOOLS)/zipalign -f 4 $@.zip $@
+
 out/%.apk: out/apk/%.unsigned.apk
 	@echo "[apksigner] $(notdir $@)"
 	@$(ANDROID_BUILD_TOOLS)/apksigner sign --ks .keys/android.jks --ks-key-alias androidKey --ks-pass pass:android --key-pass pass:android --min-sdk-version $(ANDROID_MIN_SDK_VERSION) --out $@ $<
@@ -761,6 +829,11 @@ out/%.zopfli.apk: out/%.apk
 release-apk: out/TildeFriends-arm-release.zopfli.apk out/TildeFriends-x86-release.zopfli.apk
 .PHONY: release-apk
 
+apkgo: out/TildeFriends-arm-debug.apk
+	@adb install -r $<
+	@adb shell am start com.unprompted.tildefriends/.TildeFriendsActivity
+.PHONY: apkgo
+
 releaseapkgo: out/TildeFriends-arm-release.apk
 	@adb install -r $<
 	@adb shell am start com.unprompted.tildefriends/.TildeFriendsActivity
@@ -862,7 +935,7 @@ clean:
 	rm -rf $(BUILD_DIR)
 .PHONY: clean
 
-dist: release-apk iosrelease-ipa $(if $(HAVE_WIN), out/winrelease/tildefriends.standalone.exe) default.nix
+dist: release-apk iosrelease-ipa $(if $(HAVE_WIN), out/winrelease/tildefriends.standalone.exe)
 	@echo [archive] dist/tildefriends-$(VERSION_NUMBER).tar.xz
 	@rm -rf out/tildefriends-$(VERSION_NUMBER)
 	@mkdir -p dist/ out/tildefriends-$(VERSION_NUMBER)
@@ -893,6 +966,7 @@ dist: release-apk iosrelease-ipa $(if $(HAVE_WIN), out/winrelease/tildefriends.s
 	@cp out/tildefriends-release.ipa dist/TildeFriends-$(VERSION_NUMBER).ipa
 	@test $(HAVE_WIN) && echo "[cp] tildefriends-$(VERSION_NUMBER).exe"
 	@test $(HAVE_WIN) && cp out/winrelease/tildefriends.standalone.exe dist/tildefriends-$(VERSION_NUMBER).exe
+	@cp out/TildeFriends.aab dist/TildeFriends-$(VERSION_NUMBER).aab
 .PHONY: dist
 
 dist-test: dist
@@ -913,3 +987,6 @@ prettier:
 docs:
 	@doxygen
 .PHONY: docs
+
+fdroid: out/apk/TildeFriends-release.fdroid.unsigned.apk
+.PHONE: fdroid

core/index.html

@@ -25,6 +25,14 @@
 			max-height: 100%;
 		"
 	>
+		<noscript>
+			<div class="w3-container">
+				<div class="w3-panel w3-red w3-padding w3-card-4">
+					<h1>TildeFriends requires JavaScript.</h1>
+					<p>It looks like JavaScript is disabled or unsupported.  This isn't going to work.</p>
+				</div>
+			</div>
+		</noscript>
 		<tf-navigation></tf-navigation>
 		<div id="content" class="hbox" style="flex: 1 0; overflow: auto">
 			<div

metadata/en-US/full_description.txt

@@ -0,0 +1,3 @@
+Tilde Friends is both a peer-to-peer social network client, participating in
+Secure Scuttlebutt, as well as a platform for writing and running web
+applications.

metadata/en-US/short_description.txt

@@ -0,0 +1 @@
+A tool for making and sharing

metadata/en-US/title.txt

@@ -0,0 +1 @@
+Tilde Friends

src/android/AndroidManifest.xml

@@ -1,15 +1,14 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
 	package="com.unprompted.tildefriends"
-	android:versionCode="21"
+	android:versionCode="22"
 	android:versionName="0.0.21-wip">
 	<uses-sdk android:minSdkVersion="24" android:targetSdkVersion="34"/>
 	<uses-permission android:name="android.permission.INTERNET"/>
 	<application
 		android:label="Tilde Friends"
 		android:usesCleartextTraffic="true"
-		android:debuggable="true"
-		android:extractNativeLibs="true">
+		android:debuggable="false">
 		<meta-data android:name="android.max_aspect" android:value="2.1"/>
 		<activity
 			android:name=".TildeFriendsActivity"
@@ -21,5 +20,10 @@
 				<category android:name="android.intent.category.LAUNCHER"/>
 			</intent-filter>
 		</activity>
+		<service
+			android:name=".TildeFriendsSandboxService"
+			android:exported="false"
+			android:isolatedProcess="true"
+			android:process=":sandbox"/>
 	</application>
 </manifest>

src/android/BundleConfig.json

@@ -0,0 +1,5 @@
+{
+	"optimizations" : {
+		"uncompress_native_libraries" : {}
+	}
+}

src/android/build.xml

@@ -0,0 +1,6 @@
+<project>
+	<target name="clean"></target>
+	<target name="release">
+		<echo>Creating ../../../out/apk/TildeFriends-release.fdroid.unsigned.apk for release.</echo>
+	</target>
+</project>

src/android/com/unprompted/tildefriends/TildeFriendsActivity.java

@@ -3,15 +3,18 @@ package com.unprompted.tildefriends;
 import android.app.Activity;
 import android.app.AlertDialog;
 import android.app.DownloadManager;
+import android.content.ComponentName;
 import android.content.DialogInterface;
 import android.content.Intent;
+import android.content.ServiceConnection;
 import android.net.Uri;
 import android.os.Bundle;
-import android.os.CountDownTimer;
 import android.os.Environment;
+import android.os.IBinder;
+import android.os.Parcel;
+import android.os.ParcelFileDescriptor;
+import android.os.RemoteException;
 import android.os.StrictMode;
-import android.os.SystemClock;
-import android.os.strictmode.Violation;
 import android.util.Base64;
 import android.util.Log;
 import android.view.KeyEvent;
@@ -29,19 +32,13 @@ import android.webkit.WebChromeClient;
 import android.webkit.WebResourceRequest;
 import android.webkit.WebView;
 import android.webkit.WebViewClient;
-import android.widget.Button;
 import android.widget.TextView;
 import android.widget.Toast;
-import java.io.BufferedInputStream;
 import java.io.BufferedReader;
 import java.io.File;
-import java.io.FileInputStream;
 import java.io.FileOutputStream;
-import java.io.OutputStream;
 import java.io.FileReader;
-import java.io.InputStream;
-import java.lang.Process;
-import java.lang.Thread;
+import java.io.OutputStream;
 import java.nio.file.FileSystems;
 import java.nio.file.Paths;
 import java.nio.file.StandardWatchEventKinds;
@@ -51,17 +48,30 @@ import java.nio.file.WatchService;
 import java.util.concurrent.TimeUnit;
 
 public class TildeFriendsActivity extends Activity {
+	static TildeFriendsActivity s_activity;
 	TildeFriendsWebView web_view;
 	String base_url;
-	Process process;
+	String port_file_path;
 	Thread thread;
+	Thread server_thread;
+	ServiceConnection service_connection;
 
 	private ValueCallback<Uri[]> upload_message;
 	private final static int FILECHOOSER_RESULT = 1;
 	private float touch_down_y;
 
+	static {
+		Log.w("tildefriends", "Calling system.loadLibrary().");
+		System.loadLibrary("tildefriends");
+		Log.w("tildefriends", "system.loadLibrary() completed.");
+	}
+
+	public static native int tf_server_main(String files_dir, String apk_path, String out_port_file_path);
+	public static native int tf_sandbox_main(int pipe_fd);
+
 	@Override
 	protected void onCreate(Bundle savedInstanceState) {
+		s_activity = this;
 		StrictMode.setVmPolicy(new StrictMode.VmPolicy.Builder()
 			.detectLeakedClosableObjects()
 			.penaltyLog()
@@ -76,7 +86,7 @@ public class TildeFriendsActivity extends Activity {
 		Log.w("tildefriends", String.format("getPackageResourcePath() is %s", getPackageResourcePath().toString()));
 		Log.w("tildefriends", String.format("nativeLibraryDir is %s", getApplicationInfo().nativeLibraryDir));
 
-		String port_file_path = getFilesDir().toString() + "/port.txt";
+		port_file_path = getFilesDir().toString() + "/port.txt";
 		new File(port_file_path).delete();
 		base_url = "http://127.0.0.1:12345/";
 
@@ -134,17 +144,15 @@ public class TildeFriendsActivity extends Activity {
 		thread.start();
 
 		set_status("Starting server...");
-		String exe = getApplicationInfo().nativeLibraryDir + "/tildefriends.so";
-		ProcessBuilder builder = new ProcessBuilder(exe, "run", "-z", getPackageResourcePath().toString(), "-a", "out_http_port_file=" + port_file_path, "-p", "0");
-		Log.w("tildefriends", "files = " + getFilesDir().toString());
-		Log.w("tildefriends", "exe = " + exe);
-		builder.directory(getFilesDir());
-		builder.inheritIO();
-		try {
-			process = builder.start();
-		} catch (java.io.IOException e) {
-			Log.w("tildefriends", "IOException starting process: " + e.toString());
-		}
+		server_thread = new Thread(new Runnable() {
+			@Override
+			public void run() {
+				Log.w("tildefriends", "Calling tf_server_main.");
+				int result = tf_server_main(getFilesDir().toString(), getPackageResourcePath().toString(), port_file_path);
+				Log.w("tildefriends", "tf_server_main returned " + result + ".");
+			}
+		});
+		server_thread.start();
 
 		web_view.getSettings().setJavaScriptEnabled(true);
 		web_view.getSettings().setDatabaseEnabled(true);
@@ -266,13 +274,8 @@ public class TildeFriendsActivity extends Activity {
 	@Override
 	protected void onDestroy()
 	{
-		if (process != null) {
-			Log.w("tildefriends", "Killing process.");
-			process.destroyForcibly();
-			Log.w("tildefriends", "Process killed.");
-			process = null;
-		}
 		super.onDestroy();
+		s_activity = null;
 	}
 
 	@Override
@@ -374,4 +377,49 @@ public class TildeFriendsActivity extends Activity {
 		web_view.setVisibility(View.VISIBLE);
 		text_view.setVisibility(View.GONE);
 	}
+
+	public static void start_sandbox(int pipe_fd) {
+		Log.w("tildefriends", "starting service with fd: " + pipe_fd);
+		Intent intent = new Intent(s_activity, TildeFriendsSandboxService.class);
+		s_activity.service_connection = new ServiceConnection() {
+			@Override
+			public void onBindingDied(ComponentName name) {
+				Log.w("tildefriends", "onBindingDied");
+			}
+
+			@Override
+			public void onNullBinding(ComponentName name) {
+				Log.w("tildefriends", "onNullBinding");
+			}
+
+			@Override
+			public void onServiceConnected(ComponentName name, IBinder binder) {
+				Log.w("tildefriends", "onServiceConnected");
+				Parcel data = Parcel.obtain();
+				ParcelFileDescriptor pfd = ParcelFileDescriptor.adoptFd(pipe_fd);
+				data.writeParcelable(pfd, 0);
+				try {
+					binder.transact(TildeFriendsSandboxService.START_CALL,  data, null, IBinder.FLAG_ONEWAY);
+				} catch (RemoteException e) {
+					Log.w("tildefriends", "RemoteException");
+				} finally {
+					data.recycle();
+				}
+			}
+
+			@Override
+			public void onServiceDisconnected(ComponentName name) {
+				Log.w("tildefriends", "onServiceDisconnected");
+			}
+		};
+		s_activity.bindService(intent, s_activity.service_connection, BIND_AUTO_CREATE);
+	}
+
+	public static void stop_sandbox() {
+		Log.w("tildefriends", "stop_sandbox");
+		if (s_activity.service_connection != null) {
+			s_activity.unbindService(s_activity.service_connection);
+			s_activity.service_connection = null;
+		}
+	}
 }

src/android/com/unprompted/tildefriends/TildeFriendsSandboxService.java

@@ -0,0 +1,59 @@
+package com.unprompted.tildefriends;
+
+import android.app.Service;
+import android.content.Intent;
+import android.os.Binder;
+import android.os.IBinder;
+import android.os.Parcel;
+import android.os.ParcelFileDescriptor;
+import android.util.Log;
+
+public class TildeFriendsSandboxService extends Service {
+	public static final int START_CALL = IBinder.FIRST_CALL_TRANSACTION;
+
+	Thread thread;
+
+	public int onStartCommand(Intent intent, int flags, int start_id) {
+		Log.w("tildefriends", "TildeFriendsSandboxService: onStartCommand");
+		return super.onStartCommand(intent, flags, start_id);
+	}
+
+	public void onDestroy() {
+		Log.w("tildefriends", "TildeFriendsSandboxService: onDestroy");
+		super.onDestroy();
+	}
+
+	private void start_thread(int pipe_fd) {
+		thread = new Thread(new Runnable() {
+			@Override
+			public void run() {
+				Log.w("tildefriends", "Calling tf_sandbox_main.");
+				int result = TildeFriendsActivity.tf_sandbox_main(pipe_fd);
+				Log.w("tildefriends", "tf_sandbox_main returned " + result + ".");
+			}
+		});
+		thread.start();
+	}
+
+	@Override
+	public IBinder onBind(Intent intent) {
+		return new Binder() {
+			@Override
+			protected boolean onTransact(int code, Parcel data, Parcel reply, int flags) {
+				if (code == START_CALL) {
+					ParcelFileDescriptor pfd = data.readParcelable(ParcelFileDescriptor.class.getClassLoader(), ParcelFileDescriptor.class);
+					if (pfd != null) {
+						Log.w("tildefriends", "fd is " + pfd.getFd());
+						start_thread(pfd.detachFd());
+						try {
+							pfd.close();
+						} catch (java.io.IOException e) {
+						}
+					}
+					return true;
+				}
+				return false;
+			}
+		};
+	}
+}

src/android/com/unprompted/tildefriends/TildeFriendsWebView.java

@@ -2,7 +2,6 @@ package com.unprompted.tildefriends;
 
 import android.content.Context;
 import android.util.AttributeSet;
-import android.util.Log;
 
 public class TildeFriendsWebView extends android.webkit.WebView {
 	boolean overscrolledY = false;

src/main.c

@@ -34,6 +34,10 @@
 #include <unistd.h>
 #endif
 
+#if defined(__ANDROID__)
+#include "jni.h"
+#endif
+
 #if !defined(_countof)
 #define _countof(a) ((int)(sizeof((a)) / sizeof(*(a))))
 #endif
@@ -603,14 +607,16 @@ static int _tf_command_run(const char* file, int argc, char* argv[])
 static int _tf_command_sandbox(const char* file, int argc, char* argv[])
 {
 	bool show_usage = false;
+	int fd = STDIN_FILENO;
 
 	while (!show_usage)
 	{
 		static const struct option k_options[] = {
+			{ "fd", required_argument, NULL, 'f' },
 			{ "help", no_argument, NULL, 'h' },
 			{ 0 },
 		};
-		int c = getopt_long(argc, argv, "h", k_options, NULL);
+		int c = getopt_long(argc, argv, "f:h", k_options, NULL);
 		if (c == -1)
 		{
 			break;
@@ -622,6 +628,9 @@ static int _tf_command_sandbox(const char* file, int argc, char* argv[])
 		default:
 			show_usage = true;
 			break;
+		case 'f':
+			fd = atoi(optarg);
+			break;
 		}
 	}
 
@@ -630,6 +639,7 @@ static int _tf_command_sandbox(const char* file, int argc, char* argv[])
 		tf_printf("\nUsage: %s sandbox [options]\n\n", file);
 		tf_printf("options:\n");
 		tf_printf("  -h, --help    Show this usage information.\n");
+		tf_printf("  -f, --fd      File descriptor with which to communicate with parent process.\n");
 		return EXIT_FAILURE;
 	}
 
@@ -637,7 +647,7 @@ static int _tf_command_sandbox(const char* file, int argc, char* argv[])
 	prctl(PR_SET_PDEATHSIG, SIGHUP);
 #endif
 	tf_task_t* task = tf_task_create();
-	tf_task_configure_from_fd(task, STDIN_FILENO);
+	tf_task_configure_from_fd(task, fd);
 	_shed_privileges();
 	/* The caller will trigger tf_task_activate with a message. */
 	tf_task_run(task);
@@ -685,10 +695,6 @@ static void _startup(int argc, char* argv[])
 		}
 	}
 
-#if defined(__ANDROID__)
-	setenv("UV_USE_IO_URING", "0", 1);
-#endif
-
 	tf_mem_startup(tracking);
 	g_backtrace_state = backtrace_create_state(argv[0], 0, _backtrace_error, NULL);
 
@@ -716,7 +722,7 @@ static void _startup(int argc, char* argv[])
 	{
 		if (
 #if !defined(_WIN32)
-			signal(SIGSYS, _error_handler) == SIG_ERR ||
+			signal(SIGSYS, _error_handler) == SIG_ERR || signal(SIGABRT, _error_handler) == SIG_ERR ||
 #endif
 			signal(SIGSEGV, _error_handler) == SIG_ERR)
 		{
@@ -726,6 +732,131 @@ static void _startup(int argc, char* argv[])
 }
 
 #if defined(__ANDROID__)
+static JNIEnv* s_jni_env;
+
+static void _tf_service_start(int pipe_fd)
+{
+	tf_printf("_tf_service_start\n");
+	jclass c = (*s_jni_env)->FindClass(s_jni_env, "com/unprompted/tildefriends/TildeFriendsActivity");
+	jmethodID start_sandbox = (*s_jni_env)->GetStaticMethodID(s_jni_env, c, "start_sandbox", "(I)V");
+	(*s_jni_env)->CallStaticVoidMethod(s_jni_env, c, start_sandbox, pipe_fd);
+}
+
+static void _tf_service_stop()
+{
+	tf_printf("_tf_service_stop\n");
+	jclass c = (*s_jni_env)->FindClass(s_jni_env, "com/unprompted/tildefriends/TildeFriendsActivity");
+	jmethodID stop_sandbox = (*s_jni_env)->GetStaticMethodID(s_jni_env, c, "stop_sandbox", "()V");
+	(*s_jni_env)->CallStaticVoidMethod(s_jni_env, c, stop_sandbox);
+}
+
+static jint _tf_server_main(JNIEnv* env, jobject this_object, jstring files_dir, jstring apk_path, jstring out_port_file_path)
+{
+	s_jni_env = env;
+
+	tf_printf("This is tf_server_main main.\n");
+	_startup(0, (char*[]) { NULL });
+	tf_printf("That was startup.\n");
+
+	const char* files = (*env)->GetStringUTFChars(env, files_dir, NULL);
+	const char* apk = (*env)->GetStringUTFChars(env, apk_path, NULL);
+	const char* out_port_file = (*env)->GetStringUTFChars(env, out_port_file_path, NULL);
+
+	tf_printf("FILES = %s\n", files);
+	tf_printf("APK = %s\n", apk);
+	tf_printf("OUT_PORT = %s\n", out_port_file);
+
+	int result = uv_chdir(files);
+	if (result)
+	{
+		tf_printf("uv_chdir: %s\n", uv_strerror(result));
+	}
+
+	size_t port_file_arg_length = strlen(out_port_file) + strlen("out_http_port_file=") + 1;
+	char* port_file_arg = alloca(port_file_arg_length);
+	snprintf(port_file_arg, port_file_arg_length, "out_http_port_file=%s", out_port_file);
+
+	const char* args[] = {
+		"run",
+		"-z",
+		apk,
+		"-a",
+		port_file_arg,
+		"-p",
+		"0",
+	};
+
+	tf_task_set_android_service_callbacks(_tf_service_start, _tf_service_stop);
+	result = _tf_command_run(apk, _countof(args), (char**)args);
+	tf_task_set_android_service_callbacks(NULL, NULL);
+
+	(*env)->ReleaseStringUTFChars(env, files_dir, files);
+	(*env)->ReleaseStringUTFChars(env, apk_path, apk);
+	(*env)->ReleaseStringUTFChars(env, out_port_file_path, out_port_file);
+
+	tf_printf("tf_server_main finished with %d.", result);
+
+	s_jni_env = NULL;
+	return result;
+}
+
+static jint _tf_sandbox_main(JNIEnv* env, jobject this_object, int pipe_fd)
+{
+	s_jni_env = env;
+
+	tf_printf("This is tf_sandbox_main main (fd=%d).\n", pipe_fd);
+	_startup(0, (char*[]) { NULL });
+	tf_printf("That was startup.\n");
+
+	char fd[32] = { 0 };
+	snprintf(fd, sizeof(fd), "%d", pipe_fd);
+	const char* args[] = {
+		"sandbox",
+		"-f",
+		fd,
+	};
+
+	int result = _tf_command_sandbox(NULL, _countof(args), (char**)args);
+
+	tf_printf("tf_sandbox_main finished with %d.", result);
+
+	s_jni_env = NULL;
+	return result;
+}
+
+JNIEXPORT jint JNI_OnLoad(JavaVM* vm, void* reserved)
+{
+	tf_printf("JNI_Onload called.\n");
+	JNIEnv* env;
+	if ((*vm)->GetEnv(vm, (void**)&env, JNI_VERSION_1_6) != JNI_OK)
+	{
+		tf_printf("Failed to get JNI environment.\n");
+		return JNI_ERR;
+	}
+
+	tf_printf("Finding class.\n");
+	jclass c = (*env)->FindClass(env, "com/unprompted/tildefriends/TildeFriendsActivity");
+	if (!c)
+	{
+		tf_printf("Failed to find TildeFriendsActivity class.\n");
+		return JNI_ERR;
+	}
+
+	tf_printf("Registering method.\n");
+	static const JNINativeMethod methods[] = {
+		{ "tf_server_main", "(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)I", _tf_server_main },
+		{ "tf_sandbox_main", "(I)I", _tf_sandbox_main },
+	};
+	int result = (*env)->RegisterNatives(env, c, methods, (int)_countof(methods));
+	if (result != JNI_OK)
+	{
+		return result;
+	}
+
+	tf_printf("Done.\n");
+	return JNI_VERSION_1_6;
+}
+
 int main(int argc, char* argv[])
 {
 	_startup(argc, argv);

src/ssb.tests.c

@@ -16,6 +16,10 @@
 #include <time.h>
 #include <unistd.h>
 
+#if !defined(_WIN32)
+#include <sys/wait.h>
+#endif
+
 #if defined(_WIN32)
 #define WIFEXITED(x) 1
 #define WEXITSTATUS(x) (x)

src/task.c

@@ -50,6 +50,9 @@
 static JSClassID _import_class_id;
 static int _count;
 
+static tf_android_start_service_t* s_android_start_service;
+static tf_android_stop_service_t* s_android_stop_service;
+
 extern struct backtrace_state* g_backtrace_state;
 
 typedef struct _export_record_t export_record_t;
@@ -2160,3 +2163,19 @@ static JSValue _tf_task_pokeSandbox(JSContext* context, JSValueConst this_val, i
 #endif
 	return JS_NewInt32(context, WEXITSTATUS(result));
 }
+
+void tf_task_set_android_service_callbacks(tf_android_start_service_t* start_service, tf_android_stop_service_t* stop_service)
+{
+	s_android_start_service = start_service;
+	s_android_stop_service = stop_service;
+}
+
+tf_android_start_service_t* tf_task_get_android_start_service()
+{
+	return s_android_start_service;
+}
+
+tf_android_stop_service_t* tf_task_get_android_stop_service()
+{
+	return s_android_stop_service;
+}

src/task.h

@@ -333,4 +333,35 @@ char* tf_task_get_debug(tf_task_t* task);
 */
 char* tf_task_get_hitches(tf_task_t* task);
 
+/**
+** A callback used to start an Android service.
+** @param pipe_fd A file descriptor with which to communicate with the invoking
+** task.
+*/
+typedef void(tf_android_start_service_t)(int pipe_fd);
+
+/**
+** A callback used to stop an Android service.
+*/
+typedef void(tf_android_stop_service_t)();
+
+/**
+** Set Android service callbacks.
+** @param start_service Start service callback.
+** @param stop_service Stop service callback.
+*/
+void tf_task_set_android_service_callbacks(tf_android_start_service_t* start_service, tf_android_stop_service_t* stop_service);
+
+/**
+** Get the callback registered for starting an Android service.
+** @return the callback.
+*/
+tf_android_start_service_t* tf_task_get_android_start_service();
+
+/**
+** Get the callback registered for stopping an Android service.
+** @return the callback.
+*/
+tf_android_stop_service_t* tf_task_get_android_stop_service();
+
 /** @} */

src/taskstub.js.c

@@ -122,10 +122,11 @@ static JSValue _taskstub_create(JSContext* context, JSValueConst this_val, int a
 	char arg1[] = "sandbox";
 	char* command_argv[] = { _executable, arg1, 0 };
 
+	tf_android_start_service_t* start_service = tf_task_get_android_start_service();
 	JSValue result = JS_NULL;
-	if (tf_task_get_one_proc(parent))
+	if (tf_task_get_one_proc(parent) || start_service)
 	{
-		uv_os_sock_t fds[2];
+		uv_os_sock_t fds[2] = { 0 };
 		int pipe_result = uv_socketpair(SOCK_STREAM, 0, fds, 0, 0);
 		if (pipe_result)
 		{
@@ -133,7 +134,7 @@ static JSValue _taskstub_create(JSContext* context, JSValueConst this_val, int a
 		}
 
 		uv_pipe_t* pipe = tf_packetstream_get_pipe(stub->_stream);
-		memset(pipe, 0, sizeof(*pipe));
+		*pipe = (uv_pipe_t) { 0 };
 		pipe_result = uv_pipe_init(tf_task_get_loop(parent), pipe, 1);
 		if (pipe_result != 0)
 		{
@@ -145,8 +146,16 @@ static JSValue _taskstub_create(JSContext* context, JSValueConst this_val, int a
 			tf_printf("uv_pipe_open failed: %s\n", uv_strerror(pipe_result));
 		}
 
-		uv_thread_t* thread = tf_malloc(sizeof(uv_thread_t));
-		uv_thread_create(thread, _tf_taskstub_run_sandbox_thread, (void*)(intptr_t)fds[1]);
+		if (start_service)
+		{
+			start_service(fds[1]);
+		}
+		else
+		{
+			/* XXX: This is a leak. */
+			uv_thread_t* thread = tf_malloc(sizeof(uv_thread_t));
+			uv_thread_create(thread, _tf_taskstub_run_sandbox_thread, (void*)(intptr_t)fds[1]);
+		}
 
 		tf_packetstream_set_on_receive(stub->_stream, tf_task_on_receive_packet, stub);
 		tf_packetstream_start(stub->_stream);
@@ -443,7 +452,15 @@ JSValue tf_taskstub_kill(tf_taskstub_t* stub)
 	JSValue result = JS_UNDEFINED;
 	if (!tf_task_get_one_proc(stub->_owner))
 	{
-		uv_process_kill(&stub->_process, SIGKILL);
+		tf_android_stop_service_t* stop_service = tf_task_get_android_stop_service();
+		if (stop_service)
+		{
+			stop_service();
+		}
+		else
+		{
+			uv_process_kill(&stub->_process, SIGKILL);
+		}
 	}
 	else
 	{

tools/ssl-android

@@ -11,23 +11,13 @@ BUILD_DIR=out/openssl_android_build
 
 BUILD_TARGETS="x86_64 x86 arm64-v8a armeabi-v7a"
 
-rm -rf out/openssl-${OPENSSL_VERSION}
+WORK_DIR=out/openssl-${OPENSSL_VERSION}-android
+rm -rf $WORK_DIR
+cp -arf deps/openssl_src/ $WORK_DIR
 
-if [ ! -d out/openssl-${OPENSSL_VERSION} ]
-then
-    if [ ! -f out/openssl-${OPENSSL_VERSION}.tar.gz ]
-    then
-        wget https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz -O out/openssl-${OPENSSL_VERSION}.tar.gz | exit 128
-    fi
-    tar -C out/ -xzf out/openssl-${OPENSSL_VERSION}.tar.gz || exit 128
-fi
-WORK_DIR=out/openssl-${OPENSSL_VERSION}
-
-##### export ndk directory. Required by openssl-build-scripts #####
 export ANDROID_NDK_ROOT
 echo ANDROID_NDK_ROOT=$ANDROID_NDK_ROOT
 
-##### build-function #####
 build_the_thing() {
     TOOLCHAIN=$ANDROID_NDK_ROOT/toolchains/llvm/prebuilt/linux-x86_64
     export PATH=$TOOLCHAIN/$TRIBLE/bin:$TOOLCHAIN/bin:$PATH
@@ -80,14 +70,13 @@ build_the_thing() {
         -Os
         -DOPENSSL_SMALL_FOOTPRINT"
     pwd
-    echo "./Configure $SSL_TARGET $OPTIONS $GLOBAL_OPTIONS -fuse-ld=$TOOLCHAIN/bin/ld" && \
-    ./Configure $SSL_TARGET $OPTIONS $GLOBAL_OPTIONS -fuse-ld=$TOOLCHAIN/bin/ld no-tests && \
+    echo "./Configure $SSL_TARGET $OPTIONS $GLOBAL_OPTIONS" && \
+    ./Configure $SSL_TARGET $OPTIONS $GLOBAL_OPTIONS && \
     make clean && \
     make build_generated && \
     make libcrypto.a libssl.a || exit 128
 }
 
-##### set variables according to build-tagret #####
 for build_target in $BUILD_TARGETS
 do
     echo "Building $build_target"
@@ -128,7 +117,6 @@ do
     rm -rf $DESTDIR
     build_the_thing
     popd
-#### copy libraries and includes to output-directory #####
     echo WORK_DIR=$WORK_DIR
     rm -rf deps/openssl/android/$build_target/
     mkdir -p deps/openssl/android/$build_target/usr/local/include/

tools/ssl-ios

@@ -8,21 +8,10 @@ BUILD_DIR=out/openssl_ios_build
 
 BUILD_TARGETS="ios64-xcrun iossimulator-xcrun"
 
-rm -rfv out/openssl-${OPENSSL_VERSION}
+WORK_DIR=out/openssl-${OPENSSL_VERSION}-ios
+rm -rf $WORK_DIR
+cp -arf deps/openssl_src/ $WORK_DIR
 
-if [ ! -d out/openssl-${OPENSSL_VERSION} ]
-then
-    if [ ! -f out/openssl-${OPENSSL_VERSION}.tar.gz ]
-    then
-        curl -L https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz -o out/openssl-${OPENSSL_VERSION}.tar.gz || exit 128
-    fi
-    tar -C out/ -xzf out/openssl-${OPENSSL_VERSION}.tar.gz || exit 128
-fi
-WORK_DIR=out/openssl-${OPENSSL_VERSION}
-
-##### export ndk directory. Required by openssl-build-scripts #####
-
-##### build-function #####
 build_the_thing() {
     export PATH=$TOOLCHAIN/$TRIBLE/bin:$TOOLCHAIN/bin:$PATH
     echo $PATH
@@ -33,7 +22,6 @@ build_the_thing() {
     make libcrypto.a libssl.a || exit 128
 }
 
-##### set variables according to build-tagret #####
 for build_target in $BUILD_TARGETS
 do
     echo "Building $build_target"
@@ -60,7 +48,6 @@ do
     rm -rf $DESTDIR
     build_the_thing
     popd
-#### copy libraries and includes to output-directory #####
     echo WORK_DIR=$WORK_DIR
     rm -rf deps/openssl/ios/$build_target/
     mkdir -p deps/openssl/ios/$build_target/usr/local/include/

tools/ssl-mingw64

@@ -8,19 +8,10 @@ BUILD_DIR=out/openssl_mingw64_build
 
 BUILD_TARGETS="mingw64"
 
-rm -rfv out/openssl-${OPENSSL_VERSION}
+WORK_DIR=out/openssl-${OPENSSL_VERSION}-mingw64
+rm -rf $WORK_DIR
+cp -arf deps/openssl_src/ $WORK_DIR
 
-if [ ! -d out/openssl-${OPENSSL_VERSION} ]
-then
-    if [ ! -f out/openssl-${OPENSSL_VERSION}.tar.gz ]
-    then
-        wget https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz -O out/openssl-${OPENSSL_VERSION}.tar.gz || exit 128
-    fi
-    tar -C out/ -xzf out/openssl-${OPENSSL_VERSION}.tar.gz || exit 128
-fi
-WORK_DIR=out/openssl-${OPENSSL_VERSION}
-
-##### build-function #####
 build_the_thing() {
     export GLOBAL_OPTIONS="no-trace no-asm no-threads no-md2 no-md4 no-dso no-async no-multiblock no-dgram no-filenames no-shared no-ssl3 no-engine no-dynamic-engine no-zlib no-comp no-psk no-idea no-srp no-weak-ssl-ciphers no-dtls no-egd no-tests -Os"
     echo "./Configure $SSL_TARGET $OPTIONS $GLOBAL_OPTIONS" && \
@@ -30,7 +21,6 @@ build_the_thing() {
     make libcrypto.a libssl.a || exit 128
 }
 
-##### set variables according to build-tagret #####
 for build_target in $BUILD_TARGETS
 do
     echo "Building $build_target"
@@ -47,7 +37,6 @@ do
     rm -rf $DESTDIR
     build_the_thing
     popd
-#### copy libraries and includes to output-directory #####
     echo WORK_DIR=$WORK_DIR
     rm -rf deps/openssl/$build_target/
     mkdir -p deps/openssl/$build_target/usr/local/include/