dtourolle
a116325991
QNN's Hexagon stub loads libcdsprpc.so, a vendor library, and from API 31 an app's linker namespace refuses a vendor library its manifest does not name. QNN then fails to create its device - QNN_DEVICE_ERROR_INVALID_CONFIG, before it reaches the DSP - and every model ran on the CPU on 0.22.0: AI denoise took 30-131 s a photograph on the tablet. The same engine code ran on the HTP from adb's shell, whose namespace has no such rule, which is what hid it. With the declaration the app's probe chose the Hexagon on the tablet and compiled every model for it. Not required, so a device without the library still installs and runs on the CPU. A test holds the line in the manifest.
227 lines
12 KiB
XML
227 lines
12 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
DarkRoom Android manifest.
|
|
|
|
Deliberately minimal: this packages the viewer for on-device testing (spike
|
|
S2 needs Adreno and Mali hardware, which no emulator represents). Nothing
|
|
here is a distribution manifest yet. The library grid needs no storage
|
|
permission, because it reads through SAF, which grants per-tree at runtime
|
|
(ARCH §6.9); the one storage permission declared is for importing from a
|
|
camera card, which is read by path.
|
|
|
|
Minimal is not the same as empty, and the entries below that are not the
|
|
activity are the difference. A manifest is the only place a component can be
|
|
declared: an intent filter is how the system learns this app is worth
|
|
offering for a photograph, and a provider is how it learns the class exists
|
|
at all. Neither can be moved into code (FR-PLAT-AND-6).
|
|
-->
|
|
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
|
|
package="paris.tourolle.darkroom">
|
|
|
|
<!-- Everything the app does with a server needs this: Login Flow v2, the
|
|
WebDAV listing, thumbnail and image fetches. Without it Android refuses
|
|
socket creation outright, and the failure is invisible — no panic to
|
|
catch, no log line, just a worker thread that stops. Storage is the
|
|
separate case: the library and album folders need no permission
|
|
here, because SAF grants per-tree at runtime (ARCH §6.9). -->
|
|
<uses-permission android:name="android.permission.INTERNET" />
|
|
<!-- Read before deciding whether a sync may run: FR-NC-6 gates background
|
|
work on unmetered-and-charging, which means knowing the network type. -->
|
|
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
|
|
|
|
<!-- FR-CAT-10: importing from a camera card. The importer reads the card
|
|
as files, and "all files access" is what makes an SD card or a USB
|
|
card reader readable by path on API 30 and up (see Cards.java). It is
|
|
granted on a system settings page, not a dialog; the import page
|
|
sends the user there when it is missing. READ_EXTERNAL_STORAGE is the
|
|
same thing for API 28 and 29, and means nothing above them; on 29 it
|
|
reads by path only with requestLegacyExternalStorage, which is why
|
|
<application> carries that flag.
|
|
|
|
Google Play limits MANAGE_EXTERNAL_STORAGE to a short list of app
|
|
kinds. DarkRoom is not distributed through Play. -->
|
|
<uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" />
|
|
<uses-permission
|
|
android:name="android.permission.READ_EXTERNAL_STORAGE"
|
|
android:maxSdkVersion="29" />
|
|
|
|
<!-- Vulkan 1.1 is what wgpu needs; the API 28 floor is where support is
|
|
dependable (NFR-COMPAT-1). Marked required so an unsupported device
|
|
fails at install rather than at first frame. -->
|
|
<uses-feature
|
|
android:name="android.hardware.vulkan.version"
|
|
android:version="0x00401000"
|
|
android:required="true" />
|
|
|
|
<!-- One name covers both icon generations, which is the point of the
|
|
`anydpi-v26` qualifier: @mipmap/ic_launcher resolves to the adaptive
|
|
icon at res/mipmap-anydpi-v26/ic_launcher.xml on API 26 and up, and to
|
|
the density-matched ic_launcher.png below that. Since minSdk is 28 the
|
|
PNGs are only ever reached by tooling, but they cost little and aapt2
|
|
wants a real drawable behind the name. `roundIcon` is deliberately
|
|
absent: it predates adaptive icons and a launcher that reads it would
|
|
also be one that ignores the XML, which no device here is.
|
|
|
|
The adaptive icon has three layers rather than two. The third,
|
|
monochrome, is what lets Android 13's themed-icon setting recolour it
|
|
instead of dropping the app out of the themed set. -->
|
|
<application
|
|
android:label="DarkRoom"
|
|
android:icon="@mipmap/ic_launcher"
|
|
android:hasCode="true"
|
|
android:allowBackup="false"
|
|
android:requestLegacyExternalStorage="true"
|
|
android:supportsRtl="true">
|
|
|
|
<!-- The DSP's RPC library, which QNN's Hexagon stub loads. From API 31
|
|
an app's linker namespace refuses a vendor library the manifest
|
|
does not name, and QNN then fails to create its device
|
|
(QNN_DEVICE_ERROR_INVALID_CONFIG) before it reaches the DSP:
|
|
every model ran on the CPU on 0.22.0. Not required, so a device
|
|
without one still installs and stays on the CPU. -->
|
|
<uses-native-library android:name="libcdsprpc.so" android:required="false" />
|
|
|
|
<!-- NativeActivity rather than a Kotlin Activity: android-activity's
|
|
glue loads libdarkroom.so and calls android_main. `android.app.lib_name`
|
|
is how it learns which library to load, and must match [lib].name.
|
|
|
|
`singleTask` because a second instance of this activity is not
|
|
survivable. The intent filters below mean another app can now
|
|
launch it while it is already running, and under the default
|
|
launch mode that starts a *second* NativeActivity — in the
|
|
caller's task, in this same process, calling android_main again.
|
|
Two Slint backends and two wgpu devices in one process is not a
|
|
degraded experience, it is a failed second launch on top of a
|
|
working first one.
|
|
|
|
What it costs, stated plainly: a share that arrives while DarkRoom
|
|
is already running brings it forward without opening the image.
|
|
The Intent goes to `onNewIntent`, and android-activity's event
|
|
stream has no variant for it (MainEvent in 0.6 stops at Destroy),
|
|
so nothing native ever sees it. Reading it would mean a Java
|
|
Activity subclass forwarding it across JNI — the same shape of
|
|
change FR-PLAT-AND-5 declined for onTrimMemory, and for the same
|
|
reason. Launched from cold, which is the ordinary case for "open
|
|
this photograph", the Intent is on getIntent() and is read. -->
|
|
<activity
|
|
android:name="android.app.NativeActivity"
|
|
android:exported="true"
|
|
android:launchMode="singleTask"
|
|
android:configChanges="orientation|keyboardHidden|screenSize|screenLayout|density|uiMode"
|
|
android:windowSoftInputMode="adjustResize">
|
|
|
|
<meta-data
|
|
android:name="android.app.lib_name"
|
|
android:value="darkroom" />
|
|
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.MAIN" />
|
|
<category android:name="android.intent.category.LAUNCHER" />
|
|
</intent-filter>
|
|
|
|
<!-- FR-PLAT-AND-6, inbound. The traceability tool reads .rs,
|
|
.slint, .wgsl and .yaml, so this is a reference and not a
|
|
tag; the tag that counts is on the test in lib.rs that
|
|
asserts these declarations are still here.
|
|
|
|
Opening a photograph from a gallery, a file manager or a
|
|
download. `android_main` reads the launch Intent through
|
|
`Intents.receive` and the named images become the browsing
|
|
list, exactly as paths on the desktop command line do.
|
|
|
|
`image/*` and not a wider match, even though it misses raws:
|
|
a provider that does not recognise `.CR3` reports it as
|
|
`application/octet-stream`, and claiming that type would put
|
|
DarkRoom in the chooser for every unidentified binary on the
|
|
device — an APK, a database, a partial download. Being absent
|
|
from one gallery's menu is a smaller failure than being
|
|
present in all of them. DNG, which providers do know as
|
|
`image/x-adobe-dng`, matches here already.
|
|
|
|
BROWSABLE is what lets a browser's finished download and a
|
|
link hand the file over; without it those routes silently do
|
|
not list the app. -->
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.VIEW" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
<category android:name="android.intent.category.BROWSABLE" />
|
|
<data android:mimeType="image/*" />
|
|
</intent-filter>
|
|
|
|
<!-- The share sheet, one photograph or a selection of them.
|
|
SEND_MULTIPLE is declared because the sheet offers this app
|
|
for a multi-selection only if it says it accepts one, and a
|
|
culling tool that can be sent a single frame and not a burst
|
|
is the wrong way round.
|
|
|
|
ACTION_EDIT is deliberately not here. It is a promise to write
|
|
the result back to the URI it was handed, and nothing in this
|
|
app does: an edit lands in a sidecar beside the original
|
|
(FR-CAT-8). Registering for it would put DarkRoom in the "edit
|
|
with" menu and lose the user's work every time. -->
|
|
<intent-filter>
|
|
<action android:name="android.intent.action.SEND" />
|
|
<action android:name="android.intent.action.SEND_MULTIPLE" />
|
|
<category android:name="android.intent.category.DEFAULT" />
|
|
<data android:mimeType="image/*" />
|
|
</intent-filter>
|
|
</activity>
|
|
|
|
<!-- The manual (dr_ui::manual): a WebView over the copy the APK
|
|
carries in assets/manual. See ManualActivity.java for why it is
|
|
not the browser.
|
|
|
|
Not exported: nothing outside this app has a reason to start it,
|
|
and dr_ui starts it by class name, which needs no intent filter.
|
|
Its own task entry is not wanted either — it is a page over the
|
|
app, and Back returns to the photograph it was opened from.
|
|
configChanges so a rotation reflows the page rather than
|
|
reloading it at the top. -->
|
|
<activity
|
|
android:name="paris.tourolle.darkroom.ManualActivity"
|
|
android:exported="false"
|
|
android:label="DarkRoom manual"
|
|
android:theme="@style/ManualTheme"
|
|
android:configChanges="orientation|keyboardHidden|screenSize|screenLayout|uiMode" />
|
|
|
|
<!-- FR-EXP-10: the system's folder picker, for an album's folder on
|
|
this device. NativeActivity's onActivityResult is not ours, so
|
|
this activity exists only to ask and hand the answer back (see
|
|
FolderPicker.java). Translucent and without a title so nothing
|
|
of it shows but the system chooser; not exported, and started by
|
|
class name from dr_ui::saf. -->
|
|
<activity
|
|
android:name="paris.tourolle.darkroom.FolderPicker"
|
|
android:exported="false"
|
|
android:theme="@android:style/Theme.Translucent.NoTitleBar"
|
|
android:configChanges="orientation|keyboardHidden|screenSize|screenLayout|uiMode" />
|
|
|
|
<!-- FR-PLAT-AND-6, outbound. Android has refused file:// URIs
|
|
between apps since API 24 — handing one out raises
|
|
FileUriExposedException in *this* process — so an exported JPEG
|
|
reaches the share sheet as a content:// URI or not at all.
|
|
|
|
Not AndroidX's FileProvider: that is a Maven artefact, and this
|
|
build has no Gradle and no dependency resolver (docker/android/
|
|
README.md). ExportProvider does the same hundred lines against one
|
|
fixed root.
|
|
|
|
`exported="false"` with `grantUriPermissions="true"` is the whole
|
|
security model, and the two halves are not redundant. Exported
|
|
false means no app may address the provider on its own account;
|
|
the grant flag means a URI this app puts in an Intent carries a
|
|
read permission for that one file, for the lifetime of the
|
|
receiving task. Without the grant flag the share sheet opens and
|
|
every target fails with SecurityException; with `exported="true"`
|
|
instead, every app on the device could read the app's private
|
|
directory. The authority must equal ExportProvider.AUTHORITY — a
|
|
mismatch is a SecurityException in somebody else's app, so a test
|
|
in lib.rs compares the two strings. -->
|
|
<provider
|
|
android:name="paris.tourolle.darkroom.ExportProvider"
|
|
android:authorities="paris.tourolle.darkroom.exports"
|
|
android:exported="false"
|
|
android:grantUriPermissions="true" />
|
|
</application>
|
|
</manifest>
|