Android direct test client 1.0.25+31 — corresponding source

The combined Android direct client is distributed under GPL-3.0-or-later; individual third-party licenses and full texts remain in 08_client/assets/licenses and each dependency. This archive contains client code, native source/patches, strongSwan/OpenSSL sources, the reviewed Xray tree, cached Go module source archives, Flutter runtime/plugin sources, and the Go standard runtime source. It contains no customer credentials, environment files, QA private keys/passwords or signing key.

Toolchain: Flutter 3.47.6 / Dart 3.13.5 (exact framework revision in TOOLCHAIN-flutter.json), Go1.27.1, JDK17, Android SDK36/NDK28.2.13676358, Python3.12+, make, perl. Install toolchain binaries separately. Gradle and pub package coordinates/versions are pinned by the included project and lock files; Google/Apache dependencies can be retrieved from their standard source repositories/artifact servers as directed by those coordinates. No private repository is required.

Rebuild native components following 08_client/third_party/{amneziawg,proxycore,strongswan}/README.md; use the included archives and a fresh /private/tmp build folder. Existing native build manifests identify the reviewed artifacts; after rebuilding they are regenerated and checked by Gradle. Build scripts currently select macOS host toolchain paths explicitly.

Then, from 08_client:
 flutter pub get
 flutter build apk --release --pub --flavor direct --split-per-abi --target-platform android-arm,android-arm64,android-x64 --build-name 1.0.25 --build-number 31 --android-project-arg=force-version-code-ignoring-abi=true --dart-define=API_ORIGIN=https://ssenvpn.com

An unsigned release requires your own signing key for installation. The public SSEN test signing key is intentionally not included. Do not expect identical APK signatures with a different signing key. Debug QA certificate resources are excluded from release builds. API31/33 userspace tests need a new disposable QA server and matching public CA; no old QA private key is supplied.

This archive corresponds to the direct Android 1.0.25+31 APKs signed with the same TEST30 certificate as public30. The stable embedded source URL is https://ssenvpn.com/downloads/android/1.0.25-31/ssen-vpn-1.0.25-31-corresponding-source.zip . Verify the current publication/default at https://ssenvpn.com/apps and the matching SHA256SUMS. The exact31 ARM64/API31 update from30 and vault preservation, actual verified-domain/Chrome/cold/warm/missing-app behavior were checked in an owned emulator. The manifest handles only the fixed app-opening URL; Flutter URI routing is disabled and links do not authenticate a user or transfer credentials. Every native library and DEX payload is byte-identical to public30. Only the compiled manifest/version and embedded source notice differ. Version30 can update in place with this certificate; version29 and earlier require uninstalling first. This publication repack changes only the client README, this guide and its source checksum entry. All app code, locked dependencies and dependency source archives are unchanged. Supply the three APKs, this archive and checksums together and keep earlier immutable version URLs. The private signing key is intentionally excluded; source checksums are in SOURCE-SHA256.json and dependency origins in DEPENDENCY-SOURCES.json. Physical devices, real email, China networks, store signing and other platforms remain separate.
