proomt

Search

Search posts, papers, and topics

All posts

Android5 min readintermediate

Introducing the AndroidX Security State Libraries: A Unified View of Device Security

Read on googleblog.com

Summary

AndroidX Security State (v1.1.0) and Security State Provider (v1.0.0) expose per‑component security patch levels (DSPL, PSPL, ASPL) for system, system modules, and kernel, letting apps and MDMs make context‑aware decisions and letting OEMs publish update availability via a standardized IPC.

  • Three patch‑level concepts – Device SPL (installed), Published SPL (bulletin), Available SPL (staged update) – are now queryable per component.
  • `androidx.security.state` offers synchronous DSPL checks, async ASPL queries, and CVE‑level auditing via OSV integration.
  • `androidx.security.state.provider` defines an Android IPC contract for OTA clients (Google Play, GOTA, OEMs) to expose ASPL data to third‑party apps.
  • Supplemental Patches XML lets OEMs credit back‑ported fixes without waiting for a full SPL bump; the libraries surface this as “effective” security state.

Relying on a single SPL string hides gaps in component‑level patching, especially with modular updates (Project Mainline). The new APIs give enterprises real‑time visibility into what’s actually protected, reducing false‑positive compliance checks and enabling proactive remediation.

5/10
api designsecurityarchitectureandroiddevice management

Related reading

  1. Android 17 Without the Last-Minute Scramble

    CodeName One prepared for Android 17 (API 37) by addressing platform changes proactively, including fixing version number parsing and implementing the new system-rendered location button. They also added robust PEM key parsing and explicit task removal to simplify common security operations for app developers.

    CodeName Onecodenameone.com8 min

  2. App Hardening: One Obfuscation Pipeline Across Every Port

    Codename One adds a cloud‑side hardening step that runs on the merged JAR before it is split into Android, iOS, JavaScript, and desktop binaries. It can rename symbols, encrypt string literals, and insert opaque‑predicate control‑flow guards at configurable levels (off → standard → aggressive → paranoid). The transforms are selective per platform to avoid breaking optimizers, and a mapping is kep…

    CodeName Onecodenameone.com6 min

  3. Tapjacking Protection: Rejecting Android Touches Behind an Overlay

    Codename One adds tapjacking protection to its Android runtime. It detects fully or partially obscured MotionEvents, offers four policies (OFF, REPORT, BLOCK, STRICT), can block the entire gesture, and on Android 12+ can request the system hide overlay windows. The API is exposed via `DeviceIntegrity.setTapjackingProtection` and a listener for state changes. iOS has no overlay threat, so the feat…

    CodeName Onecodenameone.com3 min

  5. SQLite Across Every Port: One Contract, One Encrypted File Format

    Codename One now ships a single, tested SQLite contract that works natively on Android, iOS, Windows, Linux, and in browsers via WebAssembly, with built‑in SQLCipher‑4 encryption supporting three key models. A conformance suite guarantees identical behavior across platforms, and migration helpers let legacy apps opt‑in. The update also adds a proper watch‑app model, DOM‑based text for JavaScript,…

    CodeName Onecodenameone.com11 min