Use system CA's & fix signing

.github/workflows/build.yaml

@@ -104,6 +104,7 @@ jobs:
         run: flutter build appbundle --release --build-number=${{ github.run_number }}
 
       - name: Sign AAB
+        id: sign_aab
         uses: r0adkll/sign-android-release@v1
         with:
           releaseDirectory: client/build/app/outputs/bundle/release
@@ -121,15 +122,18 @@ jobs:
         with:
           serviceAccountJsonPlainText: "${{ secrets.ANDROID_SERVICE_ACCOUNT_JSON }}"
           packageName: net.defguard.mobile
-          releaseFiles: client/build/app/outputs/bundle/release/app-release.aab
+          releaseFiles: ${{ steps.sign_aab.outputs.signedReleaseFile }}
           track: internal
 
+      - name: Rename AAB
+        run: cp "${{ steps.sign_aab.outputs.signedReleaseFile }}" Defguard.aab
+
       - name: Upload Android Artifact
         uses: actions/upload-artifact@v4
         if: startsWith(github.ref, 'refs/tags/')
         with:
           name: android-app
-          path: "client/build/app/outputs/bundle/release/app-release.aab"
+          path: "client/Defguard.aab"
           retention-days: 2
 
   build-android-apk:
@@ -173,6 +177,7 @@ jobs:
         run: flutter build apk --release --build-number=${{ github.run_number }}
 
       - name: Sign APK
+        id: sign_apk
         uses: r0adkll/sign-android-release@v1
         with:
           releaseDirectory: client/build/app/outputs/flutter-apk
@@ -181,12 +186,15 @@ jobs:
           keyStorePassword: "${{ secrets.ANDROID_KEYSTORE_PASSWORD }}"
           keyPassword: "${{ secrets.ANDROID_KEYSTORE_PASSWORD }}"
 
+      - name: Rename APK
+        run: cp "${{ steps.sign_apk.outputs.signedReleaseFile }}" Defguard.apk
+
       - name: Upload Android Artifact
         uses: actions/upload-artifact@v4
         if: startsWith(github.ref, 'refs/tags/')
         with:
           name: android-app-apk
-          path: "client/build/app/outputs/flutter-apk/app-release.apk"
+          path: "client/Defguard.apk"
           retention-days: 2
 
   release:

.github/workflows/lint-and-test.yaml

@@ -34,7 +34,7 @@ jobs:
           submodules: "recursive"
 
       - name: Scan code with Trivy
-        uses: aquasecurity/trivy-action@0.34.1
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: "fs"
           scan-ref: "."

.github/workflows/release.yaml

@@ -23,8 +23,8 @@ jobs:
           draft: true
           files: |
             ./artifacts/Defguard.ipa
-            ./artifacts/app-release.aab
-            ./artifacts/app-release.apk
+            ./artifacts/Defguard.aab
+            ./artifacts/Defguard.apk
 
   create-sbom:
     needs: [create-release]

.github/workflows/sbom.yaml

@@ -35,7 +35,7 @@ jobs:
           submodules: "recursive"
 
       - name: Create SBOM with Trivy
-        uses: aquasecurity/trivy-action@0.34.1
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: "fs"
           format: "spdx-json"
@@ -45,7 +45,7 @@ jobs:
           scanners: "vuln"
 
       - name: Create security advisory file with Trivy
-        uses: aquasecurity/trivy-action@0.34.1
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: "fs"
           format: "json"

client/android/app/src/main/AndroidManifest.xml

@@ -17,6 +17,7 @@
         android:enableOnBackInvokedCallback="true"
         android:allowBackup="false"
         android:fullBackupContent="false"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:dataExtractionRules="@xml/data_extraction_rules">
         <activity
             android:name=".MainActivity"

client/android/app/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config>
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>

client/lib/open/api.dart

@@ -5,6 +5,7 @@ import 'package:cookie_jar/cookie_jar.dart';
 import 'package:device_info_plus/device_info_plus.dart';
 import 'package:dio/dio.dart';
 import 'package:dio_cookie_manager/dio_cookie_manager.dart';
+import 'package:native_dio_adapter/native_dio_adapter.dart';
 import 'package:mobile/data/db/enums.dart';
 import 'package:mobile/data/proto/client_platform_info.pb.dart';
 import 'package:mobile/data/proxy/config.dart';
@@ -45,6 +46,7 @@ class _ProxyApi {
   );
 
   _ProxyApi._internal() {
+    _dio.httpClientAdapter = NativeAdapter();
     final cookieJar = CookieJar();
     _dio.interceptors.add(CookieManager(cookieJar));
     _dio.interceptors.add(TalkerDioLogger(talker: talker));

client/pubspec.lock

@@ -281,6 +281,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.15.0"
+  cronet_http:
+    dependency: transitive
+    description:
+      name: cronet_http
+      sha256: "8e77bc6f203e0bc9126e6a9092508a3435dbcb04da3b53ed1a358909385c5e0e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.8.0"
   cross_file:
     dependency: transitive
     description:
@@ -305,6 +313,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.0.2"
+  cupertino_http:
+    dependency: transitive
+    description:
+      name: cupertino_http
+      sha256: "82cbec60c90bf785a047a9525688b6dacac444e177e1d5a5876963d3c50369e8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.0"
   cupertino_icons:
     dependency: "direct main"
     description:
@@ -752,6 +768,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "4.1.2"
+  http_profile:
+    dependency: transitive
+    description:
+      name: http_profile
+      sha256: "7e679e355b09aaee2ab5010915c932cce3f2d1c11c3b2dc177891687014ffa78"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.0"
   image:
     dependency: transitive
     description:
@@ -776,6 +800,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.0.5"
+  jni:
+    dependency: transitive
+    description:
+      name: jni
+      sha256: "8706a77e94c76fe9ec9315e18949cc9479cc03af97085ca9c1077b61323ea12d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.15.2"
   js:
     dependency: transitive
     description:
@@ -920,6 +952,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "7.2.0"
+  native_dio_adapter:
+    dependency: "direct main"
+    description:
+      name: native_dio_adapter
+      sha256: "9bbfa5221fd287eb063962bbe6534290e5f87933e576fac210149fb80253b89a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.5.1"
   native_toolchain_c:
     dependency: transitive
     description:

client/pubspec.yaml

@@ -50,6 +50,7 @@ dependencies:
   cookie_jar: ^4.0.8
   dio: ^5.8.0+1
   dio_cookie_manager: ^3.2.0
+  native_dio_adapter: ^1.3.0
   flutter_native_splash: ^2.4.6
   flutter_launcher_icons: ^0.14.4
   flutter_svg: ^2.1.0