Android 0.2.0: new assembly wrapper & WorkManager remote signatures

.dockerignore

@@ -0,0 +1,8 @@
+.git
+.gradle
+build
+out
+.idea
+.DS_Store
+*.iml
+.android-docker/

.gitattributes

@@ -0,0 +1 @@
+*.jpg binary

.github/workflows/CI.yml

@@ -12,23 +12,43 @@ on:
 
 jobs:
   android:
+    name: ${{ matrix.name }}
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Gradle (Java 17)
+            java: '17'
+            run-script: false
+          - name: Docker Harness (Java 21)
+            java: '21'
+            run-script: true
+    env:
+      TRANSLOADIT_KEY: ${{ secrets.TRANSLOADIT_KEY }}
+      TRANSLOADIT_SECRET: ${{ secrets.TRANSLOADIT_SECRET }}
+      ANDROID_SDK_E2E: "true"
 
     steps:
       - uses: actions/checkout@v4
-      - name: set up JDK 19
+      - name: Set up JDK ${{ matrix.java }}
         uses: actions/setup-java@v4
         with:
-          java-version: '19'
-          distribution: 'adopt'
+          java-version: ${{ matrix.java }}
+          distribution: 'temurin'
           cache: gradle
 
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
       - name: Build with Gradle
+        if: ${{ matrix.run-script == false }}
         run: ./gradlew assemble
       - name: Run Tests
+        if: ${{ matrix.run-script == false }}
         run: ./gradlew check
+      - name: Run Dockerized Check
+        if: ${{ matrix.run-script == true }}
+        run: ./scripts/test-in-docker.sh check
 
   slack-on-failure:
     needs: [android]

.gitignore

@@ -16,6 +16,7 @@ out/
 # Gradle files
 .gradle/
 build/
+.android-docker/
 
 # Local configuration file (sdk path, etc)
 local.properties
@@ -54,3 +55,4 @@ google-services.json
 freeline.py
 freeline/
 freeline_project_description.json
+.env

.vscode/android-sdk.code-workspace

@@ -0,0 +1,8 @@
+{
+	"folders": [
+		{
+			"path": ".."
+		}
+	],
+	"settings": {}
+}

CHANGELOG.md

@@ -1,42 +1,71 @@
-### 0.0.10 / 2024-03-20
+# Changelog
+
+## 0.2.0 / TO BE RELEASED
+
+Below 1.0 SemVer allows us to make breaking changes, and we have shipped a number of them in this release, please review carefully.
+
+- **Breaking:** Removed dependency on the Java SDK's deprecated `AsyncAssembly` API and introduced a new `AndroidAssembly` wrapper built on the modern SSE-based workflow
+- **Breaking:** SharedPreferences backing resumable uploads now uses `transloadit_android_sdk_urls` (previously typo’d `tansloadit_android_sdk_urls`). Existing persisted tus entries will need manual migration if backward compatibility is required.
+- **Breaking:** Building the SDK now requires JDK 17+. Published AARs still target Java 11 bytecode so consuming apps can desugar on older toolchains.
+- Upgrade dependency to `com.transloadit.sdk:transloadit:2.2.4` to align with the latest Java SDK release and pick up the simplified SSE handling.
+- Keep the Android Docker and CI parity harness aligned with the Java SDK release that ships the stabilized SSE behaviour, ensuring both suites exercise the same SSE fixtures.
+- Default `AndroidAssembly` callbacks to the Android main thread and add opt-in APIs for background/custom executors.
+- Added `pauseUploadsSafely`/`resumeUploadsSafely` helpers and an optional WorkManager integration (`AndroidAssemblyWorkConfig` + `AndroidAssemblyUploadWorker`) to persist resumable uploads in the background.
+- Added a runnable Kotlin WorkManager sample (`examples/…/WorkManagerSample.kt`) and matching E2E test to showcase background uploads with the new API surface, including external signature-provider usage.
+- Added `AndroidAssemblyListener` to replace the old `AssemblyProgressListener`
+- Updated samples, documentation, and tests to use the new asynchronous API
+- Added environment-aware Docker tests plus live assembly integration coverage
+
+## 0.1.0 / 2025-10-15
+
+- Added support for external signature generation to improve security ([#19](https://github.com/transloadit/android-sdk/issues/19))
+  - New constructors in `AndroidTransloadit` accepting `SignatureProvider` instead of secret
+  - Enables secure signature generation on backend servers instead of embedding secrets in APK
+  - Prevents secret extraction through APK decompilation
+  - Added comprehensive documentation and examples for signature injection
+  - Added unit tests for signature provider functionality
+- Adopted `com.transloadit.sdk:transloadit:2.1.0` and tus-java-client 0.5.1 to match java-sdk
+- Added Docker-based test harness for reproducible local builds
+
+## 0.0.10 / 2024-03-20
 
 - 0.0.9 has been published without AAR files, this release ships them.
 
-### 0.0.9 / 2024-03-20
+## 0.0.9 / 2024-03-20
 
 - Updated dependency for Transloadit Java SDK to 1.0.0
 - This update includes the updated signature authentication method, which is now required for all requests.
 
-### 0.0.8 / 2023-07-17
+## 0.0.8 / 2023-07-17
 
 - Changing method signatures including Activity to Context in order to make the SDKs usage more flexible.
 - This is considered as not breaking, as a Activity is a Context, and the SDK will still work as before.
 
-### 0.0.7 / 2022-10-30
+## 0.0.7 / 2022-10-30
 
 - Updated dependency for Transloadit Java SDK to 0.4.4 => includes Socket-IO 4 and a security patch
 - Updated to androidx.appcompat:appcompat:1.5.1
 - Set compileSdkVersion to 31, and targetSdkVersion 31
 
-### 0.0.6 / 2022-02-03
+## 0.0.6 / 2022-02-03
 
 - Update dependency for Transloadit Java SDK to 0.4.2
 - Add Android SDK version to Transloadit-Client header
 - Updated Tus-Android to 0.1.10
 
-### 0.0.5 / 2022-01-10
+## 0.0.5 / 2022-01-10
 
 - Update dependency for Transloadit Java SDK to 0.4.1,
   this update is recommended as it contains patches for known security vulnerabilities.
 
-### 0.0.4 / 2021-02-25
+## 0.0.4 / 2021-02-25
 
 - Update dependency for Transloadit Java SDK to 0.1.6
 
-### 0.0.3 / 2018-07-18
+## 0.0.3 / 2018-07-18
 
 - Update dependency
 
-### 0.0.2 / 2018-04-07
+## 0.0.2 / 2018-04-07
 
 - Initial release

CONTRIBUTING.md

@@ -0,0 +1,48 @@
+# Contributing to the Transloadit Android SDK
+
+Thanks for your interest in contributing! This document explains how to get set up, run tests, and how releases are produced for the Android library.
+
+## Getting Started
+
+1. Fork the repository and clone your fork.
+2. Install JDK 11+ (CI currently uses JDK 19 via `actions/setup-java`).
+3. Install [Android SDK command line tools](https://developer.android.com/studio#command-tools) if you plan to run Gradle directly outside of Docker.
+4. Install [Docker](https://docs.docker.com/get-docker/) if you want to mirror the CI environment.
+5. Run `./gradlew assemble` to make sure the project builds.
+
+## Running Tests
+
+We rely on standard Gradle tasks and an optional Docker wrapper:
+
+- **Host JVM:** `./gradlew check` runs unit tests for both the library and example app.
+- **Docker (CI parity):** `./scripts/test-in-docker.sh` executes the same Gradle tasks inside the image used in CI. This is helpful before pushing changes to ensure a clean environment.
+
+End-to-end tests hit the live Transloadit API. To enable them locally, create a `.env` file with:
+
+```
+TRANSLOADIT_KEY=your-key
+TRANSLOADIT_SECRET=your-secret
+```
+
+Without these variables the integration tests are skipped automatically.
+
+## Pull Requests
+
+- Keep changes focused. For larger efforts, please open an issue first to discuss the approach.
+- Add or update tests alongside code changes.
+- Run `./gradlew check` (and optionally the docker script) before submitting the PR.
+- Provide context in the PR description, including any manual testing performed.
+
+## Publishing Releases
+
+Releases are handled by the Transloadit maintainers through the [release workflow](./.github/workflows/release.yml), which publishes artifacts to Maven Central under `com.transloadit.android:transloadit-android`.
+
+High-level checklist for maintainers:
+
+1. Update version information in `transloadit-android/src/main/resources/android-sdk-version/version.properties` and refresh `CHANGELOG.md`.
+2. Merge the release branch into `main`.
+3. Create a git tag for `main` that matches the new versions
+4. Publish a GitHub release (include the changelog). This triggers the release workflow. (via the GitHub UI, `gh release creates v1.0.1 --title "v1.0.1" --notes-file <(cat CHANGELOG.md section)`)
+5. Wait for Sonatype to sync the artifact (this can take a few hours).
+
+The required signing keys and credentials are stored as GitHub secrets. If you need access or spot an issue with the release automation, please reach out to the Transloadit team via the issue tracker or support channels.

Dockerfile

@@ -0,0 +1,33 @@
+# syntax=docker/dockerfile:1
+
+FROM eclipse-temurin:21-jdk AS base
+
+ENV ANDROID_SDK_ROOT=/opt/android-sdk
+ENV ANDROID_HOME=/opt/android-sdk
+ENV PATH=$PATH:$ANDROID_SDK_ROOT/cmdline-tools/latest/bin:$ANDROID_SDK_ROOT/platform-tools
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+       wget \
+       unzip \
+       libstdc++6 \
+       python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Android command line tools
+RUN mkdir -p $ANDROID_SDK_ROOT/cmdline-tools \
+    && cd /tmp \
+    && wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip \
+    && unzip -q commandlinetools-linux-11076708_latest.zip \
+    && mkdir -p $ANDROID_SDK_ROOT/cmdline-tools/latest \
+    && mv cmdline-tools/* $ANDROID_SDK_ROOT/cmdline-tools/latest/ \
+    && rm -rf commandlinetools-linux-11076708_latest.zip cmdline-tools
+
+# Accept licenses and install the SDK components required for unit tests
+RUN yes | sdkmanager --licenses >/dev/null \
+    && yes | sdkmanager \
+       "platforms;android-34" \
+       "build-tools;34.0.0" \
+       "platform-tools"
+
+WORKDIR /workspace