fix(security): disable backup, exclude ssh_known_hosts, remove legacy storage flag

Author: JamGmilk

.github/workflows/ci.yml

@@ -76,44 +76,3 @@ jobs:
           name: debug-apk
           path: app/build/outputs/apk/debug/app-debug.apk
           retention-days: 5
-
-  build-release:
-    name: Build Release APK
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/'))
-    needs: [lint]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up JDK
-        uses: actions/setup-java@v5
-        with:
-          java-version: ${{ env.JAVA_VERSION }}
-          distribution: 'temurin'
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-cleanup: 'never'
-
-      - name: Fix gradlew permissions
-        run: chmod +x ./gradlew
-
-      - name: Decode keystore
-        run: echo "${{ secrets.RELEASE_KEYSTORE_BASE64 }}" | base64 -d > release.jks
-
-      - name: Build release APK
-        run: ./gradlew assembleRelease --no-daemon --parallel
-        env:
-          RELEASE_STORE_FILE: release.jks
-          RELEASE_STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
-          RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
-          RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
-
-      - name: Upload release APK
-        uses: actions/upload-artifact@v7
-        with:
-          name: release-apk
-          path: app/build/outputs/apk/release/app-release.apk
-          retention-days: 30

app/src/main/AndroidManifest.xml

@@ -11,15 +11,14 @@
 
     <application
         android:name=".di.FuwaGitApplication"
-        android:allowBackup="true"
+        android:allowBackup="false"
         android:dataExtractionRules="@xml/data_extraction_rules"
         android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.FuwaGit"
-        android:requestLegacyExternalStorage="true"
         tools:targetApi="33">
         <activity
             android:name=".MainActivity"

app/src/main/res/xml/backup_rules.xml

@@ -3,4 +3,6 @@
     <!-- Exclude sensitive credential data and master key wrapping info from older API backup -->
     <exclude domain="file" path="credential_data.json"/>
     <exclude domain="sharedpref" path="credential_key_store.xml"/>
+    <!-- Exclude SSH known hosts (contains server fingerprints) -->
+    <exclude domain="file" path="ssh_known_hosts"/>
 </full-backup-content>

app/src/main/res/xml/data_extraction_rules.xml

@@ -4,10 +4,14 @@
         <!-- Exclude sensitive credential data and master key wrapping info from cloud backup -->
         <exclude domain="file" path="credential_data.json"/>
         <exclude domain="sharedpref" path="credential_key_store.xml"/>
+        <!-- Exclude SSH known hosts (contains server fingerprints) -->
+        <exclude domain="file" path="ssh_known_hosts"/>
     </cloud-backup>
     <device-transfer>
         <!-- Exclude sensitive credential data and master key wrapping info from device-to-device transfer -->
         <exclude domain="file" path="credential_data.json"/>
         <exclude domain="sharedpref" path="credential_key_store.xml"/>
+        <!-- Exclude SSH known hosts (contains server fingerprints) -->
+        <exclude domain="file" path="ssh_known_hosts"/>
     </device-transfer>
 </data-extraction-rules>