Julius Joska
e3a2378c34
Calls: `call` was missing from the known content types, so every offer was acknowledged and dropped; the call screen column now fills the width (the avatar jumped left after hang-up); a ring started from a push ends after 12 s when no offer arrives; STUN fallback when no TURN credentials. Registration: X-Sepot-Identity-Proof lets a new device reclaim an existing identity; retry backs off from 30 s to 10 min and exposes a conflict flag. Prekeys: PrekeysLow triggers a batch of 50 one-time prekeys via POST /v1/keys; the signed prekey rotates weekly, the Kyber prekey monthly. Messaging: crypto operations run serially (concurrent encrypts derived the same message key); stop() waits for in-flight deliveries (auto-lock between decrypt and persist lost messages); disappearing-message cleanup no longer overwrites fresh messages; a push wake-up reconnects stale connections; the outbox carries polls and mentions; length limits on wire input. Storage: a duress session never exposes the real identity or phrase, does not start networking and cannot touch the keystore; deleting data in a duress session leaves the real account alone; PIN guessing is throttled (5 misses, then 30 s doubling up to 15 min); the duress blob shares the salt so unlock time does not reveal which PIN was entered; iOS keychain items are this-device only; biometrics are biometric-only; screen security defaults to on and is applied after unlock; tapjacking filter in MainActivity. Tests: content types, shared-salt unwrap, duress isolation.
Šepot — Flutter client
The Šepot mobile client. See the repository README for the project overview, threat model, and license.
Quick start
flutter pub get
flutter run # against the default relay
flutter build apk --release # signed release APK (see key.properties)
Layout
| Path | Contents |
|---|---|
lib/core/ |
Crypto facade, storage (SQLCipher), relay client + transport, push, services |
lib/features/ |
Screens (onboarding, chat, contacts, groups, settings, safety…) |
lib/models/ lib/providers/ |
Data models and Riverpod providers |
lib/l10n/ |
Localization (app_*.arb, generated AppLocalizations) |
test/ integration_test/ |
Unit, storage, crypto, and on-device integration tests |
Localization
Strings are defined in lib/l10n/app_cs.arb (template) and translated into
app_en/de/ru/it.arb. After editing, run flutter gen-l10n. See the root
README for how to contribute a new language.