Pinakes Android v1.4.2 (debug)

Fixes a TLS trust regression on QNAP instances (#16)

Some self-hosted instances behind QNAP stopped connecting after the box's Let's Encrypt certificate was reinstalled. The server began sending a chain shaped like [leaf, intermediate, retired DST Root CA X3] — with an unrelated, expired, self-signed root appended to the end.

The chain completer walked up from the last certificate, saw that self-issued DST root, assumed the chain was already complete, and never fetched the intermediate's real issuer. Android then rejected the certificate as untrusted (the app showed "Couldn't establish a secure HTTPS connection — the server's TLS certificate isn't trusted"), even though desktop browsers connected fine because they already trust the newer ISRG root and simply ignore the junk certificate.

What changed: the completer now re-links the presented certificates starting from the leaf, drops anything not part of that path (the stray root), and resumes the AIA walk from the genuine top of the chain — reaching a root Android actually ships. Certificate and hostname validation stay strict and are still decided by the platform trust manager; dropping a stray certificate is purely structural and never introduces a trust anchor.

Verified end-to-end on an Android 15 emulator against the instance that regressed here: it now discovers the library and reports Secure connection (https).

If your instance already worked on v1.4.1, nothing here changes for you. If Android refuses an in-place update because an older debug APK used a different signature, uninstall the old Pinakes app first, then install this one.

Debug build, versionCode 12.

Pinakes Android v1.4.1 (debug)

Debug build of Pinakes Android 1.4.1 (versionCode 11).

Changes

• fix(profile): removed the misleading required-field asterisk ( *) from custom fields in the profile edit dialog. Custom fields are not enforced when editing an existing profile (the server accepts blank custom values on PATCH /me for existing members), so the asterisk falsely implied they were mandatory and contradicted the registration screen.

Requires Pinakes server v0.7.54+. Everything from 1.4.0 (configurable registration/profile fields #255, catalog search relevance) is included. Unit tests pass; debug APK attached.

Pinakes Android v1.4.0 (debug)

Debug build of Pinakes Android 1.4.0 (versionCode 10).

What's new

• Configurable + custom registration/profile fields (#255): the register and profile screens now render the server-driven field schema (built-in + custom fields), with client-side validation of required fields on registration.
• Catalog search relevance sort: relevance-ordered results with a dedicated sort state (+ unit test).
• Play Store publishing prep: store listing, privacy policy, data-safety and content-rating drafts under play-store/.

Requires

Pinakes server v0.7.54+ — that release adds the private-mode fix so the app's server discovery works even when the site is in private mode, and ships the registration/profile field schema this build consumes.

Unit tests (RegisterUiStateTest, ProfileUiStateTest, SearchSortStateTest) pass; debug APK attached.

Pinakes Android v1.3.3 (debug)

Relevance sort in catalog search

• The catalog search now offers a Relevance sort. It is auto-selected as soon as you type a query and reverts to Newest when the query is cleared; it stays hidden from the sort menu while the search box is empty.
• The app sends sort=relevance to GET /catalog/search. Results are weighted by field — identifiers, title, author, subtitle, publisher, keywords, then description — so a hit in the title or author outranks one that only appears in the description.
• Localized label added in Italian, English, German and French.

Backend requirement: weighted relevance needs the server-side support. On an older server the unknown sort value is ignored and the search falls back to Newest, so the app keeps working — it just does not rank by relevance until the backend is updated.

Debug build, versionCode 9.

Pinakes Android v1.3.2 (debug)

Addresses the remaining issues from #282.

Language filter (#282)

• The filter now uses the catalogue's real languages, fetched from /catalog/languages, instead of a hardcoded ISO list. Combining a language with a category, author or publisher (e.g. Literature + German) now returns the correct results instead of failing with no matches.

Sorting & browsing (from #25, now shipped)

• Sortable results (by title / author), sub-category filter, and a "recently added" heading on the home screen.

Debug build — install the APK below. Requires a Pinakes server on v0.7.41 or later (the /catalog/languages endpoint).

Pinakes Android v1.3.1 (debug)

Debug build 1.3.1 (versionCode 7).

Fix

• TLS: connect to instances with an incomplete certificate chain. Self-hosted servers behind a QNAP/Synology reverse proxy often serve a TLS chain that is missing an intermediate CA. Browsers fetch the missing piece automatically (via the certificate's AIA URL); the app previously did not, and failed onboarding at Discover library with "Couldn't reach that address" / "Trust anchor for certification path not found" even for a valid Let's Encrypt certificate. The app now completes the chain the same way a browser does. Validation is not weakened — the system trust store still makes the final decision.

Verified against a real QNAP-hosted instance: discovery and login now succeed.

Install

Uninstall any previous version first if you hit a signature mismatch, then install the attached pinakes-v1.3.1-debug.apk.

Pinakes Android v1.3.0 (debug)

Debug build off main — the latest app with the Book Club integration and the insecure-HTTP onboarding option.

What's new since 1.2.1

• Book Club — the plugin now surfaces in the app (server-driven, feature-flagged): home cards, club detail, polls, RSVP, reading progress, with graceful degradation when the plugin is turned off server-side.
• "Allow insecure HTTP" onboarding opt-in (issue #16) — connect to a self-hosted instance served over plain HTTP (no TLS). Off by default; the app stays HTTPS-only unless you enable it on the "Connect your library" screen. The cleartext gate covers the API, book covers (Coil) and the in-app PDF reader, so plain HTTP is only ever used for an instance you explicitly accepted.
• Review/UX fixes: 401 → re-login handling, poll-deadline timezone correctness, empty-state refresh, snackbar de-dup, safer envelope parsing, slug URL-encoding, and more.

Verified

build-and-test green on CI; smoke-tested on an android-35 emulator (boot, authenticated catalog + Book Club load, onboarding toggle, HTTP loopback discovery 200, opt-in gate on/off).

Debug-signed APK — for testing/self-hosting, not a Play Store build.

Pinakes Android 1.2.1 (test build)

Test build of the Pinakes Android app (v1.2.1, versionCode 5).

What's in this build

• Complete Hilt dependency-injection migration (ServiceLocator removed; all 12 ViewModels @Inject-constructed).
• Cleanup: removed the dead bookId parameter from BookDetailScreen (the ViewModel reads it from SavedStateHandle).

Artifact

• pinakes-1.2.1-release-debugsigned.apk — R8 minified + resource shrinking (~9.4 MB).
• Debug-signed (CN=Android Debug): installable for testing only, NOT for the Play Store. A release keystore is needed for store distribution.

Verified

• assembleRelease builds cleanly (R8).
• On-device smoke test of the minified build: launch, onboarding, login, home shelf, catalog, and book detail all work — no R8 / serialization / Hilt runtime breakage.

Pre-release: test artifact from the feat/hilt-di branch, not yet merged to main.

Pinakes Android v1.1.1 (debug)

Pinakes Android 1.1.1 — companion app for the Pinakes ILS.

New in 1.1.1

• App icon is now the Pinakes palm (pink palm on white), replacing the generic book glyph. Proper adaptive icon (with a themed/monochrome variant for Android 13+) plus square + round legacy icons for older Android.

Everything from 1.1.0 (in-app registration, password recovery, feature-flag gating, security hardening) is included.

Install

Debug-signed APK for direct sideloading (not a Play Store build). Download pinakes-android-v1.1.1-debug.apk, enable "install from unknown sources", and open it. versionCode 3 installs over the previous build in place.

Point it at your library: enable the bundled Mobile API plugin on the server (Mobile API → Settings → enable app access), then enter your instance URL in the app.

Pinakes Android v1.1.0 (debug)

Pinakes Android 1.1.0 — companion app for the Pinakes ILS.

Point it at your library's instance URL (enable the bundled Mobile API plugin on the server, then Mobile API → Settings → enable app access) and your members can browse the catalog, check real availability, borrow & reserve, read ebooks / listen to audiobooks, and manage their loans.

New in 1.1.0

• In-app registration — create an account directly from the app, with client-side validation and the same privacy-acceptance requirement as the website.
• Password recovery — request a reset link from the login screen.
• Feature-flag gating — the UI follows each instance's settings (e.g. catalogue-only mode hides loan/reserve actions) and refreshes them on launch/login.
• Security hardening — duplicate-submit guard on registration, no account enumeration on password recovery, and the password confirmation is carried end to end.

Built against the realigned Mobile API contract shipped in Pinakes 0.7.23 (reachable plugin settings, loan-vs-reservation parity, normalised availability calendar).

Install

This is a debug-signed APK for direct sideloading (not a Play Store build). Download pinakes-android-v1.1.0-debug.apk, enable "install from unknown sources", and open it. versionCode 2 installs over the previous 1.0.0 build in place.

Debug builds permit cleartext HTTP only for loopback / the emulator; real instances must be served over HTTPS. The bearer token is stored in EncryptedSharedPreferences.