wip: multi-controller session and pad bridge changes

feat: the built-in pad can be a DualShock 4 or DualSense, its touchpad fed by the trackpads (#559 )
feat: the built-in pad's controller type switches from the session menu while Steam runs (#558 )
2026-11-09 01:59:35 -10:00 · 2026-10-14 12:16:24 -04:00 · 2026-10-11 04:21:31 +00:00 · 2026-10-11 00:12:53 -04:00 · 2026-10-11 03:24:22 +00:00 · 2026-10-10 23:20:09 -04:00
1271 changed files with 271575 additions and 820 deletions
@@ -0,0 +1,31 @@
+name: Build AAudio sink module
+
+# A quick check of tools/aaudio-sink on its own; the APK build compiles the same module into the
+# audio bundle. Runs on pushes that touch the module.
+on:
+  push:
+    paths:
+      - 'tools/aaudio-sink/**'
+      - '.github/workflows/build-aaudio-sink.yml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - name: PulseAudio 13.0 source
+        run: |
+          set -euo pipefail
+          curl -fsSL -o pa.tar.gz https://github.com/pulseaudio/pulseaudio/archive/refs/tags/v13.0.tar.gz
+          mkdir -p pa13 && tar -xzf pa.tar.gz -C pa13 --strip-components=1
+      - name: Build
+        run: |
+          set -euo pipefail
+          export NDK="${ANDROID_NDK_LATEST_HOME:-${ANDROID_NDK_HOME:-$ANDROID_NDK_ROOT}}"
+          tools/aaudio-sink/build.sh "$PWD/pa13" "$PWD/out"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: audio-sink-modules
+          path: out/*.so
@@ -0,0 +1,101 @@
+name: Build desktop package (KDE Plasma)
+
+# The desktop the app installs into its Linux runtime on first use: KDE Plasma as SteamOS's desktop
+# mode has it, the closure of tools/desktop-kde/seeds.txt over Arch Linux ARM minus what the runtime
+# already carries, plus tools/desktop-kde/overlay (tools/desktop-kde/build.sh), every package
+# signature-checked. Published as a release in Droid-Deck/DroidDeck-Components with DroidDeck's
+# other components; the apk pins it in tools/desktop-kde/release.env (tag, sha256, size). A
+# published tag is never rebuilt: the packages are Arch Linux ARM's current ones, so a rebuild
+# would not match the pinned sha256. A changed package gets a new tag (desktop-kde-r2, ...) and a
+# release.env update.
+on:
+  push:
+    paths:
+      - 'tools/desktop-kde/**'
+      - '.github/workflows/build-desktop-kde.yml'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to publish as (e.g. desktop-kde-r1); empty = artifact only'
+        required: false
+        default: ''
+
+permissions:
+  contents: write
+
+jobs:
+  kwin:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build KWin with nested desktop scaling
+        run: |
+          sudo apt-get update -qq && sudo apt-get install -y -qq zstd xz-utils gpgv patch binutils >/dev/null
+          bash tools/desktop-kde/build-kwin.sh out/kwin
+      - uses: actions/upload-artifact@v4
+        with:
+          name: desktop-kde-kwin
+          retention-days: 7
+          path: out/kwin/
+  build:
+    needs: kwin
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: desktop-kde-kwin
+          path: out/kwin
+      - uses: actions/create-github-app-token@v2
+        id: components-token
+        if: github.event_name == 'workflow_dispatch' && inputs.tag != ''
+        with:
+          app-id: ${{ vars.DROIDDECK_CI_APP_ID }}
+          private-key: ${{ secrets.DROIDDECK_CI_APP_KEY }}
+          owner: Droid-Deck
+          repositories: DroidDeck-Components
+      - name: Refuse a published tag
+        if: github.event_name == 'workflow_dispatch' && inputs.tag != ''
+        env:
+          GH_TOKEN: ${{ steps.components-token.outputs.token }}
+        run: |
+          if gh release view '${{ inputs.tag }}' -R Droid-Deck/DroidDeck-Components >/dev/null 2>&1; then
+            echo "::error::${{ inputs.tag }} is already published, and published tags are never replaced: use a new tag"
+            exit 1
+          fi
+      - name: Build
+        run: |
+          set -euo pipefail
+          sudo apt-get update -qq && sudo apt-get install -y -qq zstd xz-utils gpgv >/dev/null
+          KDE_KWIN_OVERRIDE="$PWD/out/kwin" tools/desktop-kde/build.sh out
+          cp out/kwin/desktop-kde.kwin.txt out/
+          echo "size $(stat -c %s out/desktop-kde.tar.zst) sha256 $(cat out/desktop-kde.sha256)"
+      # The package itself too, briefly: enough to try a build on a device before publishing it.
+      - uses: actions/upload-artifact@v4
+        with:
+          name: desktop-kde
+          retention-days: 7
+          compression-level: 0
+          path: |
+            out/desktop-kde.tar.zst
+            out/desktop-kde.packages.txt
+            out/desktop-kde.kwin.txt
+            out/desktop-kde.sha256
+      - name: Publish
+        if: github.event_name == 'workflow_dispatch' && inputs.tag != ''
+        env:
+          GH_TOKEN: ${{ steps.components-token.outputs.token }}
+          GH_REPO: Droid-Deck/DroidDeck-Components
+        run: |
+          set -euo pipefail
+          TAG='${{ inputs.tag }}'
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "::error::$TAG is already published in DroidDeck-Components, and published tags are never replaced: use a new tag"
+            exit 1
+          fi
+          gh release create "$TAG" --latest=false --prerelease=false --title "$TAG" \
+            --notes "KDE Plasma desktop package for DroidDeck's Linux runtime ($GITHUB_REPOSITORY tools/desktop-kde, $GITHUB_SHA). size $(stat -c %s out/desktop-kde.tar.zst), sha256 $(cat out/desktop-kde.sha256). desktop-kde.packages.txt lists the signature-checked Arch Linux ARM packages it was built from." \
+            out/desktop-kde.tar.zst out/desktop-kde.sha256 out/desktop-kde.packages.txt out/desktop-kde.kwin.txt
+          gh release edit "$TAG" --latest=false --prerelease=false
@@ -0,0 +1,48 @@
+name: Build gamescope (patched)
+
+# The runtime's own gamescope (Arch Linux ARM's 3.16.29 package) rebuilt with the patches under
+# tools/gamescope/patches, in an Arch Linux ARM container on an arm64 runner, then published as a
+# release asset the apk build fetches (tools/gamescope/release.env names the tag and sha). The
+# hosted runtime image is never changed: the apk stages the binary over /usr/local/bin.
+on:
+  push:
+    paths:
+      - 'tools/gamescope/**'
+      - '.github/workflows/build-gamescope.yml'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to publish as (e.g. gamescope-3.16.29-p1); empty = artifact only'
+        required: false
+        default: ''
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build in Arch Linux ARM
+        run: |
+          set -euo pipefail
+          docker run --rm -v "$PWD:/work" -w /work menci/archlinuxarm:base-devel bash tools/gamescope/build-in-arch.sh
+          sudo chown -R "$(id -u):$(id -g)" .
+      - uses: actions/upload-artifact@v4
+        with:
+          name: gamescope-patched
+          path: |
+            gamescope.tzst
+            gamescope.tzst.sha256
+      - name: Publish
+        if: github.event_name == 'workflow_dispatch' && inputs.tag != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh release create "${{ inputs.tag }}" --latest=false --prerelease=false --title "${{ inputs.tag }}" --notes "gamescope 3.16.29 with tools/gamescope/patches; staged by the apk over /usr/local/bin/gamescope. sha256 $(cut -d' ' -f1 gamescope.tzst.sha256)" gamescope.tzst gamescope.tzst.sha256 || gh release upload "${{ inputs.tag }}" gamescope.tzst gamescope.tzst.sha256 --clobber
+          # A component the apk fetches by tag, never something users install: it must not
+          # become the repo's Latest release or appear as a pre-release, also when re-uploaded.
+          gh release edit "${{ inputs.tag }}" --latest=false --prerelease=false
@@ -0,0 +1,758 @@
+name: Build APK
+run-name: ${{ github.event_name == 'pull_request' && format('building pr {0} on {1}', github.event.pull_request.number, github.event.pull_request.head.sha) || format('building {0} on {1}', github.ref_name, github.sha) }}
+
+on:
+  push:
+    branches: [ main ]
+    paths-ignore:
+      - '**/*.md'
+      - 'LICENSE'
+      - '.gitignore'
+  pull_request:
+    branches: [ main ]
+    types: [ opened, synchronize, reopened, ready_for_review ]
+    paths-ignore:
+      - '**/*.md'
+      - 'LICENSE'
+      - '.gitignore'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  # Replace older builds only for the same PR. Each push/dispatch gets its own group so one main
+  # build cannot cancel another before it signs and publishes.
+  group: build-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  PRELOAD_CACHE_VERSION: v3
+
+jobs:
+  build:
+    name: Build APK
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    outputs:
+      variants: ${{ steps.variants.outputs.list }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+
+      - name: Check co-authors
+        if: github.event_name == 'pull_request'
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin main
+          base=$(git merge-base origin/main HEAD)
+          messages=$(git log --format=%B "$base..HEAD")
+          messages+=$'\n'"$(jq -r '.pull_request.title, (.pull_request.body // "")' "$GITHUB_EVENT_PATH")"
+          if grep -Eiq '^[[:space:]]*Co-authored-by:.*(Claude|Anthropic|OpenAI|ChatGPT|GPT|Copilot|Cursor|Gemini|Codex|Devin|Windsurf|Codeium|Amazon Q|Tabnine|Cody|\[bot\])' <<<"$messages"; then
+            echo "::error::AI and bot identities cannot be co-authors; remove the Co-authored-by trailer."
+            exit 1
+          fi
+
+      - name: The packages a signed build ships as
+        id: variants
+        run: echo "list=$(awk '!/^#/ && NF { print $1 }' tools/release/variants.txt | jq -R . | jq -sc .)" >> "$GITHUB_OUTPUT"
+
+      - name: No private key in the tree
+        run: |
+          set -euo pipefail
+          keys=$(git ls-files | grep -iE '\.(jks|keystore|p12|pfx|pk8|pem|key)$' | grep -vx 'keystore/testkey.p12' || true)
+          if [ -n "$keys" ]; then
+            echo "::error::a private key is committed - remove it from the history and make a new one: $keys"
+            exit 1
+          fi
+
+      - name: Version bumps are isolated
+        if: github.event_name == 'pull_request'
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin main
+          base=$(git merge-base origin/main HEAD)
+          diff=$(git diff -U0 "$base..HEAD" -- app/build.gradle)
+          grep -Eq '^[+-][[:space:]]*version(Code|Name)[[:space:]]' <<<"$diff" || exit 0
+          other_files=$(git diff --name-only "$base..HEAD" | grep -v '^app/build.gradle$' || true)
+          other_gradle=$(grep -E '^[+-]' <<<"$diff" | grep -Ev '^(---|\+\+\+)' | grep -Ev '^[+-][[:space:]]*version(Code|Name)[[:space:]]' || true)
+          if [[ -n "$other_files" || -n "$other_gradle" ]]; then
+            echo "::error::versionCode/versionName changes must be isolated in their own PR"
+            echo "A version PR may only change the versionCode/versionName lines in app/build.gradle." >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+
+      - name: Merge onto main, or say what conflicts
+        if: github.event_name == 'pull_request'
+        run: |
+          set -uo pipefail
+          git config user.name "ci"
+          git config user.email "[email protected]"
+          git fetch --no-tags origin main
+          BASE=$(git rev-parse --short origin/main)
+          HEAD=$(git rev-parse --short HEAD)
+          if git merge --no-ff --no-edit origin/main >/tmp/merge.out 2>&1; then
+            {
+              echo "###  Mergeable"
+              echo
+              echo "\`$HEAD\` merges cleanly onto main (\`$BASE\`). What follows was built from the merged result."
+            } > /tmp/pr-merge.md
+            cat /tmp/pr-merge.md >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          FILES=$(git diff --name-only --diff-filter=U)
+          if [ -z "$FILES" ]; then
+            {
+              echo "### ERROR: Could not merge onto main (\`$BASE\`)"
+              echo
+              echo '```'
+              cat /tmp/merge.out
+              echo '```'
+            } > /tmp/pr-merge.md
+            cat /tmp/pr-merge.md >> "$GITHUB_STEP_SUMMARY"
+            echo "::error::git could not merge main: $(head -3 /tmp/merge.out | tr '\n' ' ')"
+            exit 1
+          fi
+          {
+            echo "### ERROR: Not mergeable - conflicts with main (\`$BASE\`)"
+            echo
+            echo "Files that conflict:"
+            echo
+            for f in $FILES; do echo "- \`$f\`"; done
+            echo
+            echo "Each conflicting hunk, as git leaves it: \`<<<<<<< HEAD\` is this pull request, \`>>>>>>> origin/main\` is main."
+            echo
+            for f in $FILES; do
+              echo "<details><summary><code>$f</code></summary>"
+              echo
+              echo '```'
+              awk '/^<<<<<<< /{p=1} p{print} /^>>>>>>> /{p=0}' "$f" | head -300
+              echo '```'
+              echo "</details>"
+              echo
+            done
+            echo "Not built: rebase or merge main into the branch and push again."
+          } > /tmp/pr-merge.md
+          cat /tmp/pr-merge.md >> "$GITHUB_STEP_SUMMARY"
+          git merge --abort || true
+          echo "::error::the pull request conflicts with main: $(echo $FILES | tr '\n' ' ')"
+          exit 1
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - uses: gradle/actions/setup-gradle@v4
+        with:
+          cache-cleanup: on-success
+
+      - name: Resolve the runner's NDK
+        run: |
+          NDK="${ANDROID_NDK_LATEST_HOME:-${ANDROID_NDK_HOME:-$ANDROID_NDK_ROOT}}"
+          VERSION=$(sed -n 's/^Pkg.Revision *= *//p' "$NDK/source.properties")
+          echo "NDK_VERSION=$VERSION" >> "$GITHUB_ENV"
+
+      - name: Set the APK build label
+        id: build-label
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          BUILD_REF: ${{ github.ref_name }}
+          BUILD_SHA: ${{ github.sha }}
+        run: |
+          if [[ -n "$(git status --porcelain)" ]]; then
+            tree_state=dirty
+          else
+            tree_state=clean
+          fi
+          echo "DROIDDECK_BUILD_TREE_STATE=$tree_state" >> "$GITHUB_ENV"
+          if [[ -n "$PR_NUMBER" ]]; then
+            label="pr${PR_NUMBER} at ${PR_HEAD_SHA:0:7}"
+          else
+            label="${BUILD_REF} at ${BUILD_SHA:0:7}"
+          fi
+          echo "label=$label" >> "$GITHUB_OUTPUT"
+          echo "DROIDDECK_SOURCE_COMMIT=${PR_HEAD_SHA:-$BUILD_SHA}" >> "$GITHUB_ENV"
+          echo "DROIDDECK_PR_NUMBER=${PR_NUMBER:-0}" >> "$GITHUB_ENV"
+          echo "Build: \`$label\`" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Cache the preloads
+        id: preloads
+        uses: actions/cache@v4
+        with:
+          path: app/src/main/assets/linuxfs
+          key: preloads-${{ env.PRELOAD_CACHE_VERSION }}-${{ hashFiles('app/src/main/cpp/fakeinput_steam.cpp', 'tools/linuxfs/preload/*.c', 'tools/linuxfs/build-x86-preloads.sh', 'tools/linuxfs/fex/*', 'tools/linuxfs/clipboard/*.c', 'tools/linuxfs/ssbs/*.c', 'tools/proot/fastpath/*.c', 'tools/linuxfs/overlay/usr/local/bin/*', 'tools/linuxfs/overlay/usr/bin/**', 'tools/linuxfs/desktop/*', 'tools/gamescope/release.env', 'tools/wlroots/release.env', 'tools/linuxfs/uruntime.env', 'tools/linuxfs/licenses/*', 'tools/mangoapp/*', 'tools/msitools/**', 'tools/linuxfs/debian-image.env') }}
+
+      - name: Build libfakeinput.so and libblsession.so (glibc aarch64)
+        if: steps.preloads.outputs.cache-hit != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq gcc-aarch64-linux-gnu g++-aarch64-linux-gnu >/dev/null
+          D=app/src/main/assets/linuxfs
+          mkdir -p "$D"
+          aarch64-linux-gnu-g++ -shared -fPIC -O2 -Wall -Wno-attributes -Wno-nonnull-compare \
+            -pthread -std=c++17 -static-libstdc++ -static-libgcc -Wl,--exclude-libs,ALL \
+            -o "$D/libfakeinput.so" app/src/main/cpp/fakeinput_steam.cpp -ldl
+          aarch64-linux-gnu-strip --strip-unneeded "$D/libfakeinput.so"
+          aarch64-linux-gnu-gcc -shared -fPIC -O2 -Wall -pthread \
+            -o "$D/libblsession.so" tools/linuxfs/preload/*.c -ldl
+          aarch64-linux-gnu-strip --strip-unneeded "$D/libblsession.so"
+          aarch64-linux-gnu-gcc -shared -fPIC -O2 -Wall -pthread \
+            -o "$D/libblfastpath.so" tools/proot/fastpath/fastpath.c -ldl
+          aarch64-linux-gnu-strip --strip-unneeded "$D/libblfastpath.so"
+          aarch64-linux-gnu-gcc -shared -fPIC -O2 -Wall -nostdlib -ffreestanding -fno-stack-protector \
+            -fno-tree-loop-distribute-patterns -Wl,-z,defs -o "$D/libblaudit.so" tools/proot/fastpath/audit.c
+          aarch64-linux-gnu-strip --strip-unneeded "$D/libblaudit.so"
+          # Force-SSBS adapter, preloaded into a game's Wine only when the game asks for it.
+          aarch64-linux-gnu-gcc -shared -fPIC -O2 -Wall -pthread \
+            -o "$D/libssbs.so" tools/linuxfs/ssbs/ssbs_adapter.c -ldl
+          aarch64-linux-gnu-strip --strip-unneeded "$D/libssbs.so"
+          mkdir -p "$D/usr/local/bin"
+          aarch64-linux-gnu-gcc -O2 -Wall -Wextra -o "$D/usr/local/bin/droiddeck-clipboard" tools/linuxfs/clipboard/clipboard.c -ldl
+          aarch64-linux-gnu-strip --strip-unneeded "$D/usr/local/bin/droiddeck-clipboard"
+          for script in tools/linuxfs/overlay/usr/local/bin/droiddeck-* tools/linuxfs/overlay/usr/local/bin/steam-compatibility; do
+            install -Dm644 "$script" "$D/usr/local/bin/$(basename "$script")"
+          done
+          for f in tools/linuxfs/overlay/usr/bin/* tools/linuxfs/overlay/usr/bin/steamos-polkit-helpers/*; do
+            [ -f "$f" ] && install -Dm644 "$f" "$D/${f#tools/linuxfs/overlay/}"
+          done
+          if [ -f tools/gamescope/release.env ]; then
+            . tools/gamescope/release.env
+            gh release download "${GAMESCOPE_TAG}" -R "${GAMESCOPE_REPO:-${GITHUB_REPOSITORY}}" -p gamescope.tzst -O gamescope.tzst
+            echo "${GAMESCOPE_SHA256}  gamescope.tzst" | sha256sum -c -
+            tar --use-compress-program=unzstd -xf gamescope.tzst -C "$D"
+            test -f "$D/usr/local/bin/gamescope"
+            rm gamescope.tzst
+          fi
+          . tools/linuxfs/uruntime.env
+          curl -fsSL --retry 3 -o uruntime "https://github.com/VHSgunzo/uruntime/releases/download/${URUNTIME_VERSION}/${URUNTIME_ASSET}"
+          echo "${URUNTIME_SHA256}  uruntime" | sha256sum -c -
+          install -Dm644 uruntime "$D/usr/local/lib/droiddeck/uruntime"
+          install -Dm644 tools/linuxfs/licenses/uruntime-LICENSE "$D/usr/local/share/licenses/uruntime/LICENSE"
+          rm uruntime
+          M="$D/usr/local/lib/mangoapp"
+          mkdir -p "$M" mango-pkgs
+          grep -v '^#' tools/mangoapp/packages.txt | while read -r sum url; do
+            [ -n "$url" ] || continue
+            curl -fsSL --retry 3 -o mango-pkgs/pkg.tar.zst "$url"
+            echo "$sum  mango-pkgs/pkg.tar.zst" | sha256sum -c -
+            tar --use-compress-program=unzstd -xf mango-pkgs/pkg.tar.zst -C mango-pkgs
+            rm mango-pkgs/pkg.tar.zst
+          done
+          install -m644 mango-pkgs/usr/bin/mangoapp "$M/mangoapp"
+          for so in libfmt.so.10 libspdlog.so.1.13 libglfw.so.3 libtraceevent.so.1; do
+            cp -L "mango-pkgs/usr/lib/$so" "$M/$so"
+          done
+          # Ours, not the package's: GPU memory without tracefs (tools/mangoapp/libtracefs-shim.c).
+          aarch64-linux-gnu-gcc -shared -fPIC -O2 -Wall -Wl,-soname,libtracefs.so.1 \
+            -o "$M/libtracefs.so.1" tools/mangoapp/libtracefs-shim.c
+          aarch64-linux-gnu-strip --strip-unneeded "$M/libtracefs.so.1"
+          install -Dm644 tools/mangoapp/mangoapp "$D/usr/local/bin/mangoapp"
+          rm -rf mango-pkgs
+          ls -l "$M"
+          # The Windows components installer's tools (tools/msitools/packages.txt).
+          T="$D/usr/local/lib/droiddeck-msitools"
+          mkdir -p "$T" msi-pkgs
+          grep -v '^#' tools/msitools/packages.txt | while read -r sum url; do
+            [ -n "$url" ] || continue
+            curl -fsSL --retry 3 -o msi-pkgs/pkg.tar.xz "$url"
+            echo "$sum  msi-pkgs/pkg.tar.xz" | sha256sum -c -
+            tar -xJf msi-pkgs/pkg.tar.xz -C msi-pkgs
+            rm msi-pkgs/pkg.tar.xz
+          done
+          install -m644 msi-pkgs/usr/bin/msiinfo "$T/msiinfo"
+          install -m644 msi-pkgs/usr/bin/cabextract "$T/cabextract"
+          # 7-Zip (the full build with its format plugin) opens installer .exe wrappers.
+          install -m644 msi-pkgs/usr/lib/7zip/7z "$T/7z"
+          install -m644 msi-pkgs/usr/lib/7zip/7z.so "$T/7z.so"
+          for so in libmsi-1.0.so.0 libgsf-1.so.114 libgcab-1.0.so.0; do
+            cp -L "msi-pkgs/usr/lib/$so" "$T/$so"
+          done
+          for f in NOTICE GPL-2 GPL-3 LGPL-2.1 7zip-License 7zip-unRarLicense; do
+            install -Dm644 "tools/msitools/licenses/$f" "$D/usr/local/share/licenses/droiddeck-msitools/$f"
+          done
+          rm -rf msi-pkgs
+          ls -l "$T"
+          install -Dm644 tools/linuxfs/desktop/droiddeck-desktop "$D/usr/local/bin/droiddeck-desktop"
+          install -Dm644 tools/linuxfs/desktop/droiddeck-gpu "$D/usr/local/bin/droiddeck-gpu"
+          install -Dm644 tools/linuxfs/desktop/droiddeck-desktop-gpu "$D/usr/local/bin/droiddeck-desktop-gpu"
+          install -Dm644 tools/linuxfs/desktop/kwin_wayland_wrapper "$D/usr/local/bin/kwin_wayland_wrapper"
+          install -Dm644 tools/linuxfs/desktop/firefox-droiddeck.js "$D/usr/lib/firefox/defaults/pref/droiddeck.js"
+          ls -lR "$D"
+
+      # The Debian 11 image the preloads are compiled in comes from a release on this repo
+      # (published once by ci-debian-image.yml, pinned in tools/linuxfs/debian-image.env): the
+      # public registry mirrors rate-limit the shared runner addresses and failed builds on a
+      # busy evening. Only if that download fails is the image pulled, with retries.
+      - name: Fetch the Debian image the preloads build in
+        if: steps.preloads.outputs.cache-hit != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          . tools/linuxfs/debian-image.env
+          image=public.ecr.aws/docker/library/debian:bullseye
+          if gh release download "$DEBIAN_IMAGE_TAG" -R "$GITHUB_REPOSITORY" -p "$DEBIAN_IMAGE_ASSET" -O /tmp/debian-image.tar.zst \
+             && { [ -z "$DEBIAN_IMAGE_SHA256" ] || echo "$DEBIAN_IMAGE_SHA256  /tmp/debian-image.tar.zst" | sha256sum -c -; }; then
+            zstd -dc /tmp/debian-image.tar.zst | docker load
+            rm -f /tmp/debian-image.tar.zst
+          else
+            echo "::warning::the hosted Debian image could not be fetched; pulling from the registry instead"
+            for attempt in 1 2 3 4 5; do
+              docker pull "$image" && break
+              [ "$attempt" -lt 5 ] || { echo "::error::could not pull $image after $attempt attempts"; exit 1; }
+              echo "pull attempt $attempt failed (registry busy?); retrying in $((attempt * 30)) s"
+              sleep $((attempt * 30))
+            done
+          fi
+          docker image ls "$image"
+
+      - name: Build the x86 preloads FEX guests load (glibc 2.31)
+        if: steps.preloads.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          docker run --rm -v "$PWD:/src" -w /src public.ecr.aws/docker/library/debian:bullseye bash -c '
+            set -euo pipefail
+            printf "deb http://archive.debian.org/debian bullseye main\ndeb http://archive.debian.org/debian-security bullseye-security main\n" > /etc/apt/sources.list
+            apt-get -o Acquire::Check-Valid-Until=false update -qq
+            DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends gcc g++ gcc-multilib g++-multilib binutils >/dev/null
+            tools/linuxfs/build-x86-preloads.sh app/src/main/assets/linuxfs
+          '
+          sudo chown -R "$(id -u):$(id -g)" app/src/main/assets/linuxfs
+          ls -l app/src/main/assets/linuxfs/x86_64 app/src/main/assets/linuxfs/i386
+
+      - name: Bundle the droiddeck-esync packs
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          if [ -f tools/droiddeck-esync/release.env ]; then
+            . tools/droiddeck-esync/release.env
+            gh release download "$SYNC_BUNDLE_TAG" -R "$SYNC_BUNDLE_REPO" -p "$SYNC_BUNDLE_ASSET" -O sync-bundle.tzst
+            echo "$SYNC_BUNDLE_SHA256  sync-bundle.tzst" | sha256sum -c -
+            mkdir -p app/src/main/assets/droiddeck-esync
+            tar --use-compress-program=unzstd -xf sync-bundle.tzst -C app/src/main/assets/droiddeck-esync
+            rm sync-bundle.tzst
+            gh release download "$SYNC_BUNDLE_TAG" -R "$SYNC_BUNDLE_REPO" -p index.json -O sync-index.json
+            revoked=$(python3 -c 'import json, sys; print(" ".join(p["id"] for p in json.load(open(sys.argv[1]))["packs"] if p.get("revoked") is True))' sync-index.json)
+            for id in $revoked; do
+              if [ -e "app/src/main/assets/droiddeck-esync/packs/$id.tzst" ]; then
+                echo "::warning::$SYNC_BUNDLE_ASSET carries revoked pack $id; it is left out of the APK (point tools/droiddeck-esync/release.env at a newer bundle)"
+                rm -f "app/src/main/assets/droiddeck-esync/packs/$id.tzst"
+              fi
+            done
+            rm sync-index.json
+            test -f app/src/main/assets/droiddeck-esync/index.json
+            test -f app/src/main/assets/droiddeck-esync/index.json.sig
+            ls -lR app/src/main/assets/droiddeck-esync
+          fi
+
+      - name: Cache PulseAudio 13.0 source
+        id: pa-src
+        uses: actions/cache@v4
+        with:
+          path: pa13
+          key: pulseaudio-src-13.0
+      - name: Fetch PulseAudio 13.0 source
+        if: steps.pa-src.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          curl -fsSL -o pa.tar.gz https://github.com/pulseaudio/pulseaudio/archive/refs/tags/v13.0.tar.gz
+          mkdir -p pa13 && tar -xzf pa.tar.gz -C pa13 --strip-components=1 && rm pa.tar.gz
+      # DirectAudio - the game driver (one set per Wine audio interface), the Android-side helper and
+      # the Steam client's sinks - comes from a pinned release of The412Banner/directaudio, checksummed,
+      # exactly like gamescope; nothing compiled for audio is kept in this repo.
+      - name: Fetch DirectAudio (tools/directaudio/release.env)
+        run: tools/directaudio/fetch.sh "$PWD" "$PWD/sink-out"
+      - name: Build the AAudio sink into the audio bundle
+        run: |
+          set -euo pipefail
+          export NDK="${ANDROID_NDK_LATEST_HOME:-${ANDROID_NDK_HOME:-$ANDROID_NDK_ROOT}}"
+          tools/aaudio-sink/build.sh "$PWD/pa13" "$PWD/sink-out"
+          rm -rf pa-bundle && mkdir -p pa-bundle
+          tar --use-compress-program=unzstd -xf app/src/main/assets/pulseaudio.tzst -C pa-bundle
+          test ! -f pa-bundle/modules/arm64/module-aaudio-sink.so
+          install -m755 sink-out/module-aaudio-sink.so pa-bundle/modules/arm64/module-aaudio-sink.so
+          install -m755 sink-out/module-directaudio-native-sink.so pa-bundle/modules/arm64/module-directaudio-native-sink.so
+          (cd pa-bundle && tar --use-compress-program='zstd -19' -cf ../pulseaudio.tzst .)
+          mkdir -p app/build/prepared-assets
+          mv pulseaudio.tzst app/build/prepared-assets/pulseaudio.tzst
+          tar --use-compress-program=unzstd -tf app/build/prepared-assets/pulseaudio.tzst | grep -c '\.so$'
+          rm -rf pa-bundle sink-out
+      - name: Cache proot
+        id: proot
+        uses: actions/cache@v4
+        with:
+          path: |
+            app/src/main/jniLibs/arm64-v8a/libproot.so
+            app/src/main/jniLibs/arm64-v8a/libproot-loader.so
+          key: proot-${{ env.NDK_VERSION }}-${{ hashFiles('tools/proot/**') }}
+      - name: Build proot
+        if: steps.proot.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          export NDK="${ANDROID_NDK_LATEST_HOME:-${ANDROID_NDK_HOME:-$ANDROID_NDK_ROOT}}"
+          tools/proot/build.sh app/src/main/jniLibs/arm64-v8a
+
+      - name: Check the preloads
+        run: |
+          set -euo pipefail
+          bash tools/linuxfs/check-preloads.sh app/src/main/assets/linuxfs
+
+      # The store download engines (app/src/main/rust/stores) are Rust, built by Gradle's
+      # buildRustStores task through cargo-ndk. rustup and cargo are on the runner image; the Android
+      # target and cargo-ndk are added here. Cache = cargo registry + cargo-ndk + the crate's target
+      # tree, keyed on the rustc version and Cargo.lock, so a source-only change rebuilds this crate
+      # on top of the cached dependency objects, and a lockfile change still starts from the
+      # previous objects (restore-keys).
+      - name: Rust toolchain for the store engines (aarch64-linux-android)
+        id: rust
+        run: |
+          set -euo pipefail
+          rustup target add aarch64-linux-android
+          echo "rustc=$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+          rustc -V; cargo -V
+
+      - name: Cache cargo registry and the store engines' target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            ~/.cargo/bin/cargo-ndk
+            app/src/main/rust/stores/target
+          key: stores-${{ steps.rust.outputs.rustc }}-${{ hashFiles('app/src/main/rust/stores/Cargo.lock') }}
+          restore-keys: |
+            stores-${{ steps.rust.outputs.rustc }}-
+
+      - name: cargo-ndk
+        run: |
+          set -euo pipefail
+          command -v cargo-ndk >/dev/null || cargo install cargo-ndk --locked
+          cargo ndk --version
+
+      - name: Cache the CMake build tree
+        uses: actions/cache@v4
+        with:
+          path: |
+            app/.cxx
+            app/build/intermediates/cxx
+          key: cxx-${{ env.NDK_VERSION }}-${{ hashFiles('app/src/main/cpp/**') }}
+          restore-keys: |
+            cxx-${{ env.NDK_VERSION }}-
+
+      - name: Build
+        id: build
+        env:
+          DROIDDECK_BUILD_LABEL: ${{ steps.build-label.outputs.label }}
+          SGDB_API_KEY: ${{ secrets.SGDB_API_KEY }}
+        run: |
+          set -o pipefail
+          python3 tools/release/runtime_inputs.py record
+          ./gradlew assembleRelease --console=plain -PndkVersion="$NDK_VERSION" 2>&1 | tee /tmp/build.log
+          python3 tools/release/check_session_assets.py app/build/outputs/apk/release/app-release.apk
+          python3 tools/release/runtime_inputs.py apk app/build/outputs/apk/release/app-release.apk
+
+      - name: Check the store engines' library
+        # The exports Kotlin binds must be in the apk's libdroiddeckstores.so, or the stores fail on
+        # the device with an UnsatisfiedLinkError instead of here. The lockfile check is the
+        # reproducibility guard: cargo must not have had to re-resolve anything.
+        run: |
+          set -euo pipefail
+          NDK="${ANDROID_NDK_LATEST_HOME:-${ANDROID_NDK_HOME:-$ANDROID_NDK_ROOT}}"
+          python3 tools/release/check_android_libraries.py app/build/outputs/apk/release/app-release.apk \
+            --readelf "$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-readelf"
+          git diff --stat -- app/src/main/rust/stores/Cargo.lock
+          git diff --exit-code -- app/src/main/rust/stores/Cargo.lock \
+            || { echo "::error::Cargo.lock changed during the build; commit the regenerated lockfile (uploaded as stores-cargo-lock)"; exit 1; }
+
+      - name: Store engines host unit tests
+        # The crate's #[test] functions are pure host-side logic (manifest parsing, chunk plans,
+        # assembly from a cache, hashes), so a plain `cargo test` on the runner's own architecture
+        # runs them; the Android build above compiles none of them. Informational on this first
+        # run - the point is to learn whether they pass - and bounded so a hang can never hold
+        # the apk. Make it blocking once it is known green.
+        timeout-minutes: 10
+        continue-on-error: true
+        run: |
+          cd app/src/main/rust/stores
+          cargo test --locked 2>&1 | tail -60
+
+      - name: Upload the regenerated Cargo.lock
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: stores-cargo-lock
+          path: app/src/main/rust/stores/Cargo.lock
+          if-no-files-found: ignore
+
+      - name: Steam import and game environment tests
+        run: python3 -m unittest discover -s tools/tests -p 'test_*.py'
+
+      - name: Unit tests
+        run: ./gradlew testReleaseUnitTest --console=plain -PndkVersion="$NDK_VERSION"
+
+      - name: Sign with the testkey (v1 + v2 + v3)
+        run: |
+          set -euo pipefail
+          APK=$(find app/build/outputs/apk -name '*.apk' | head -1)
+          TOOLS=$(find "$ANDROID_HOME/build-tools" -maxdepth 1 -type d | sort -V | tail -1)
+          "$TOOLS/zipalign" -p -f 4 "$APK" "$APK.aligned"
+          "$TOOLS/apksigner" sign \
+            --ks keystore/testkey.p12 --ks-type PKCS12 --ks-pass pass:android \
+            --ks-key-alias testkey --key-pass pass:android \
+            --v1-signing-enabled true --v2-signing-enabled true --v3-signing-enabled true \
+            --out "$APK" "$APK.aligned"
+          rm -f "$APK.aligned" "$APK.idsig"
+
+      - name: Check the signature
+        run: |
+          set -euo pipefail
+          APK=$(find app/build/outputs/apk -name '*.apk' | head -1)
+          APKSIGNER=$(find "$ANDROID_HOME/build-tools" -name apksigner | sort -V | tail -1)
+          "$APKSIGNER" verify --min-sdk-version 21 --verbose --print-certs "$APK" | tee /tmp/sig.txt
+          unzip -l "$APK" | grep -qE 'META-INF/.*\.(SF|RSA|DSA)$' \
+            || { echo "::error::apk carries no JAR signature files"; exit 1; }
+          for scheme in "v1 scheme (JAR signing): true" "v2 scheme (APK Signature Scheme v2): true" \
+                        "v3 scheme (APK Signature Scheme v3): true"; do
+            grep -qF "$scheme" /tmp/sig.txt || { echo "::error::apk is not signed with $scheme"; exit 1; }
+          done
+          grep -qi "CN=Android, OU=Android, O=Android" /tmp/sig.txt \
+            || { echo "::error::apk is not signed with the AOSP testkey"; exit 1; }
+
+      - name: Report on the pull request
+        if: always() && github.event_name == 'pull_request'
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          BUILD_OUTCOME: ${{ steps.build.outcome }}
+          SAME_REPO: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+        run: |
+          set -uo pipefail
+          MARK="<!-- droiddeck-pr-build -->"
+          {
+            echo "$MARK"
+            echo "## Build of this pull request"
+            echo
+            [ -f /tmp/pr-merge.md ] && cat /tmp/pr-merge.md
+            echo
+            case "$BUILD_OUTCOME" in
+              success)
+                echo "###  Build passed"
+                echo
+                echo "The \`droiddeck-apk\` artifact is [on this run]($RUN_URL), signed with the public test key."
+                echo
+                if [ "$SAME_REPO" = true ]; then
+                  echo "A release-signed tester build that installs over Stable or Preview is being published now and will appear in DroidDeck's **Test builds** list. Label the PR \`no-test-build\` to skip that."
+                else
+                  echo "**Maintainer:** add the \`publish-test\` label to publish a release-signed tester build that installs over Stable or Preview and appears in DroidDeck's **Test builds** list. The label is removed automatically after publishing."
+                fi
+                echo
+                echo "Fallback: [open **PR Release Publish**]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/workflows/pr-release-publish.yml) on \`main\` and enter PR \`$PR\`."
+                ;;
+              failure)
+                echo "### ERROR: Build failed"
+                echo
+                echo "The compiler's errors ([full log]($RUN_URL)):"
+                echo
+                echo '```'
+                { grep -E '^e: |^w: .*error|error:|CMake Error|fatal error|ninja: error|FAILED|What went wrong|Execution failed for task|Unresolved reference|Type mismatch|Unresolved' /tmp/build.log 2>/dev/null \
+                  | sed -e 's#file:///home/runner/work/[^/]*/[^/]*/##' -e 's#/home/runner/work/[^/]*/[^/]*/##' \
+                  | grep -v '^w: ' | awk '!seen[$0]++' | head -80; } || true
+                echo '```'
+                echo
+                echo "<details><summary>What went wrong (Gradle)</summary>"
+                echo
+                echo '```'
+                awk '/^\* What went wrong/{p=1} /^\* Try:/{p=0} p{print}' /tmp/build.log 2>/dev/null | head -60
+                echo '```'
+                echo "</details>"
+                ;;
+              skipped|cancelled)
+                echo "###  Not built"
+                echo
+                echo "The build did not run (see above, or [the run]($RUN_URL))."
+                ;;
+            esac
+            echo
+          } > /tmp/pr-report.md
+          cat /tmp/pr-report.md >> "$GITHUB_STEP_SUMMARY"
+          ID=$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR}/comments" --paginate --jq ".[] | select(.body | startswith(\"$MARK\")) | .id" | head -1 || true)
+          if [ -n "$ID" ]; then
+            gh api -X PATCH "repos/${GITHUB_REPOSITORY}/issues/comments/${ID}" -F body=@/tmp/pr-report.md >/dev/null
+          else
+            gh api -X POST "repos/${GITHUB_REPOSITORY}/issues/${PR}/comments" -F body=@/tmp/pr-report.md >/dev/null
+          fi
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: droiddeck-apk
+          path: app/build/outputs/apk/release/*.apk
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0
+
+  sign:
+    needs: build
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: read
+      actions: read
+    uses: ./.github/workflows/sign.yml
+    with:
+      environment: signing-main
+      variants: ${{ needs.build.outputs.variants }}
+    secrets: inherit
+
+  # Each signed main build as a prerelease of the public Droid-Deck/DroidDeck-CI (main-<sha>, the
+  # last KEEP kept), where anyone can download it without a GitHub account, then a post in the
+  # Discord's builds channel linking to it. The release is made with a token of the org's
+  # "DroidDeck CI Publisher" app (installed on DroidDeck-CI only, Contents: write): its ID in the
+  # DROIDDECK_CI_APP_ID variable, its private key in the DROIDDECK_CI_APP_KEY secret.
+  # DISCORD_BUILDS_WEBHOOK is the channel's webhook URL.
+  announce:
+    needs: [build, sign]
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+    env:
+      CI_REPO: Droid-Deck/DroidDeck-CI
+      KEEP: 10
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: droiddeck-signed-*
+          merge-multiple: true
+          path: signed
+
+      - uses: actions/create-github-app-token@v2
+        id: ci-token
+        with:
+          app-id: ${{ vars.DROIDDECK_CI_APP_ID }}
+          private-key: ${{ secrets.DROIDDECK_CI_APP_KEY }}
+          owner: Droid-Deck
+          repositories: DroidDeck-CI
+
+      # What this build is, for the top of the release notes: the merged PR's title and the first
+      # paragraph of its description, or the commit's subject for a push made without a PR.
+      - name: Describe the change
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          pr=$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" \
+            --jq '[.[] | select(.merged_at != null and .base.ref == "main")] | first // empty')
+          if [ -n "$pr" ]; then
+            number=$(jq -r .number <<<"$pr")
+            title=$(jq -r .title <<<"$pr")
+            merged=$(jq -r '.merged_at[:10]' <<<"$pr")
+            summary=$(jq -r '.body // ""' <<<"$pr" | tr -d '\r' | { grep -v '^🤖' || true; } |
+              awk '!p && /^#/ { next } NF { p = 1; print; next } p { exit }' | head -n 6 | cut -c1-400)
+            {
+              echo "**Merged to main** - [PR #$number]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/pull/$number): $title (merged $merged)"
+              if [ -n "$summary" ]; then
+                echo
+                echo "$summary"
+              fi
+            } > notes-head.md
+          else
+            subject=$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA" --jq '.commit.message | split("\n")[0]')
+            echo "**Pushed to main** without a PR - $subject" > notes-head.md
+          fi
+          cat notes-head.md
+
+      - name: Publish to DroidDeck-CI
+        id: publish
+        env:
+          GH_TOKEN: ${{ steps.ci-token.outputs.token }}
+        run: |
+          set -euo pipefail
+          tag=main-${GITHUB_SHA::7}
+          cat signed/SHA256SUMS-*.txt > signed/SHA256SUMS.txt
+          rm signed/SHA256SUMS-*.txt
+          notes="$(cat notes-head.md)
+
+          Signed build of $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/commit/$GITHUB_SHA - in main, not yet in a DroidDeck release; for testing.
+          Commit: $GITHUB_SHA
+          VersionCode: $(sed -n 's/^ *versionCode \([0-9][0-9]*\)$/\1/p' app/build.gradle)
+          Each apk installs over a DroidDeck release and keeps its data. \`standard\` is the normal app; the others are the same app under another package name, installed beside it.
+
+          SHA-256:
+          \`\`\`
+          $(cat signed/SHA256SUMS.txt)
+          \`\`\`"
+          gh release delete "$tag" -R "$CI_REPO" --yes --cleanup-tag 2>/dev/null || true
+          gh release create "$tag" -R "$CI_REPO" --target main --prerelease \
+            --title "main ${GITHUB_SHA::7}" --notes "$notes" signed/*
+          # Keep the newest main builds by publication time. GitHub App releases can share createdAt.
+          gh release list -R "$CI_REPO" -L 200 --json tagName,publishedAt \
+            --jq '[.[] | select(.tagName | startswith("main-"))] | sort_by(.publishedAt) | reverse | .['"$KEEP"':][] | .tagName' |
+            while IFS= read -r old; do
+              # Never remove this run's release, even if the API returns an unexpected ordering.
+              if [ "$old" = "$tag" ]; then
+                continue
+              fi
+              # Another main publish may have removed the same old release concurrently.
+              if ! gh release delete "$old" -R "$CI_REPO" --yes --cleanup-tag 2>/dev/null; then
+                if gh release view "$old" -R "$CI_REPO" >/dev/null 2>&1; then
+                  echo "::error::Could not delete old release $old"
+                  exit 1
+                fi
+              fi
+            done
+          published=$(gh release view "$tag" -R "$CI_REPO" --json tagName,assets)
+          jq -e --arg tag "$tag" '.tagName == $tag and (.assets | length) > 0' <<< "$published" >/dev/null
+          url="$GITHUB_SERVER_URL/$CI_REPO/releases/tag/$tag"
+          apk=$(cd signed && ls DroidDeck-*.apk | awk 'length(a) == 0 || length($0) < length(a) { a = $0 } END { print a }')
+          echo "release=$url" >> "$GITHUB_OUTPUT"
+          echo "apk=$GITHUB_SERVER_URL/$CI_REPO/releases/download/$tag/$apk" >> "$GITHUB_OUTPUT"
+          echo "Published $url"
+
+      - name: Post to Discord
+        env:
+          WEBHOOK: ${{ secrets.DISCORD_BUILDS_WEBHOOK }}
+          GH_TOKEN: ${{ github.token }}
+          RELEASE: ${{ steps.publish.outputs.release }}
+          APK: ${{ steps.publish.outputs.apk }}
+        run: |
+          set -euo pipefail
+          if [ -z "$WEBHOOK" ]; then
+            echo "::notice::No DISCORD_BUILDS_WEBHOOK secret; nothing posted"
+            exit 0
+          fi
+          commit=$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA")
+          subject=$(jq -r '.commit.message | split("\n")[0]' <<<"$commit")
+          # A merge commit's subject is "Merge pull request #N from ..."; its body's first line is
+          # the PR's title, which says more.
+          title=$(jq -r '.commit.message | split("\n") | map(select(length > 0)) | .[1] // ""' <<<"$commit")
+          pr=$(sed -n 's/^Merge pull request #\([0-9]*\).*/\1/p' <<<"$subject")
+          if [ -n "$pr" ]; then
+            what="[#$pr]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/pull/$pr): ${title:-$subject}"
+          else
+            what="[\`${GITHUB_SHA::7}\`]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/commit/$GITHUB_SHA): $subject"
+          fi
+          get=$(printf 'Download: [standard APK](<%s>) · [all variants](<%s>)' "$APK" "$RELEASE")
+          content=$(printf '**New signed build** `main-%s`\n%s\n%s' "${GITHUB_SHA::7}" "$what" "$get")
+          jq -n --arg content "$content" '{content: $content, allowed_mentions: {parse: []}}' |
+            curl -fsS -H 'Content-Type: application/json' -d @- "$WEBHOOK" -o /dev/null
+          echo "Posted: $content"
+
+  catalog:
+    needs: announce
+    if: ${{ always() && github.event_name != 'pull_request' && github.ref == 'refs/heads/main' && needs.announce.result != 'skipped' }}
+    uses: ./.github/workflows/update-catalog.yml
+    secrets: inherit
@@ -0,0 +1,55 @@
+name: Publish the CI Debian image
+
+# Pulls the Debian 11 image the x86 preloads build in, once, and publishes it as a release asset
+# on this repo so build.yml never depends on a registry mirror's rate limit. Run it again (with a
+# new tag) only to refresh the image; tools/linuxfs/debian-image.env names the one builds use.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to publish to (a new -rN tag for a refresh; builds pin the one in tools/linuxfs/debian-image.env)'
+        required: true
+        default: 'ci-debian-bullseye-r2'
+      replace:
+        description: 'Overwrite the asset if the release already has one (changes its checksum: re-pin it in debian-image.env)'
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Pull, save and publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+          REPLACE: ${{ inputs.replace }}
+        run: |
+          set -euo pipefail
+          image=public.ecr.aws/docker/library/debian:bullseye
+          # A published image is pinned by checksum in the build; never replace one by accident.
+          if [ "$REPLACE" != true ] && gh release view "$TAG" -R "$GITHUB_REPOSITORY" --json assets -q '.assets[].name' 2>/dev/null | grep -qx debian-bullseye.tar.zst; then
+            echo "::error::$TAG already carries debian-bullseye.tar.zst; publish to a new tag, or set replace and re-pin tools/linuxfs/debian-image.env"
+            exit 1
+          fi
+          for attempt in 1 2 3 4 5 6; do
+            docker pull "$image" && break
+            [ "$attempt" -lt 6 ] || { echo "::error::could not pull $image"; exit 1; }
+            echo "pull attempt $attempt failed (registry busy?); retrying in $((attempt * 30)) s"
+            sleep $((attempt * 30))
+          done
+          docker image inspect "$image" --format 'image id {{.Id}} created {{.Created}}'
+          docker save "$image" | zstd -19 -T0 -o debian-bullseye.tar.zst
+          sha256sum debian-bullseye.tar.zst | tee SHA256SUMS
+          ls -l debian-bullseye.tar.zst
+          if ! gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release create "$TAG" -R "$GITHUB_REPOSITORY" --title "CI Debian 11 image ($TAG)" --latest=false \
+              --notes "The debian:bullseye image build.yml compiles the x86 preloads in (glibc 2.31), saved with docker save and compressed with zstd. Pulled from public.ecr.aws/docker/library/debian:bullseye on $(date -u +%Y-%m-%d); image id $(docker image inspect "$image" --format '{{.Id}}'). Pinned in tools/linuxfs/debian-image.env."
+          fi
+          gh release upload "$TAG" -R "$GITHUB_REPOSITORY" debian-bullseye.tar.zst SHA256SUMS --clobber
+          { echo "Published \`$TAG\`:"; echo; echo '```'; cat SHA256SUMS; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
@@ -0,0 +1,78 @@
+name: PR Release Cleanup
+run-name: remove PR #${{ github.event.pull_request.number }}'s test build
+
+# A merged or closed PR's test build leaves DroidDeck-CI, so the app's Updates page stops offering it
+# (a merged fix is in the next Preview). pull_request_target for the publisher app's secrets; nothing
+# from the PR is checked out or run.
+on:
+  pull_request_target:
+    types: [ closed ]
+    branches: [ main ]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: pr-release-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+  queue: max
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check the current PR state
+        id: state
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          state=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" --jq .state)
+          echo "closed=$([ "$state" = closed ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+      # A token of the org's "DroidDeck CI Publisher" app, as build.yml's announce job uses.
+      - uses: actions/create-github-app-token@v2
+        if: ${{ steps.state.outputs.closed == 'true' }}
+        id: ci-token
+        with:
+          app-id: ${{ vars.DROIDDECK_CI_APP_ID }}
+          private-key: ${{ secrets.DROIDDECK_CI_APP_KEY }}
+          owner: Droid-Deck
+          repositories: DroidDeck-CI
+      - name: Delete the test build
+        if: ${{ steps.state.outputs.closed == 'true' }}
+        env:
+          GH_TOKEN: ${{ steps.ci-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          found=0
+          for tag in "pr-$PR_NUMBER" "pr-$PR_NUMBER.0"; do
+            if gh release view "$tag" -R Droid-Deck/DroidDeck-CI >/dev/null 2>&1; then
+              gh release delete "$tag" -R Droid-Deck/DroidDeck-CI --yes --cleanup-tag
+              echo "Deleted $tag"
+              found=1
+            fi
+          done
+          [ "$found" = 1 ] || echo "No test build for PR #$PR_NUMBER"
+
+      - uses: actions/checkout@v4
+        if: ${{ steps.state.outputs.closed == 'true' }}
+        with:
+          ref: main
+          persist-credentials: false
+      - name: Retire the Discord PR announcement
+        if: ${{ steps.state.outputs.closed == 'true' }}
+        env:
+          WEBHOOK: ${{ secrets.DISCORD_PR_BUILDS_WEBHOOK }}
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: python3 tools/release/pr_discord.py retire
+
+  catalog:
+    needs: cleanup
+    if: ${{ always() }}
+    uses: ./.github/workflows/update-catalog.yml
+    secrets: inherit
@@ -0,0 +1,341 @@
+name: PR Release Publish
+run-name: "sign PR #${{ github.event_name == 'pull_request_target' && github.event.pull_request.number || github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number || inputs.pr_number }} with the release key"
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: Open pull request number
+        required: true
+        type: string
+  pull_request_target:
+    types: [labeled]
+    branches: [main]
+  # A PR from a branch of this repo is signed on its own after each green build: only people who
+  # can push here can change it. A fork's PR waits for a maintainer's publish-test label.
+  workflow_run:
+    workflows: [Build APK]
+    types: [completed]
+
+permissions:
+  actions: read
+  contents: read
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: pr-release-${{ github.event_name == 'pull_request_target' && github.event.pull_request.number || github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number || inputs.pr_number }}
+  cancel-in-progress: false
+  queue: max
+
+jobs:
+  authorize:
+    if: >-
+      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') ||
+      (github.event_name == 'pull_request_target' && github.event.label.name == 'publish-test') ||
+      (github.event_name == 'workflow_run' && github.event.workflow_run.event == 'pull_request' &&
+       github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.head_repository.full_name == github.repository &&
+       github.event.workflow_run.pull_requests[0] != null)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    outputs:
+      pr_number: ${{ steps.gate.outputs.pr_number }}
+      run_id: ${{ steps.gate.outputs.run_id }}
+      head_sha: ${{ steps.gate.outputs.head_sha }}
+      base_sha: ${{ steps.gate.outputs.base_sha }}
+      version_code: ${{ steps.gate.outputs.version_code }}
+      label: ${{ steps.gate.outputs.label }}
+      skip: ${{ steps.gate.outputs.skip }}
+      automatic: ${{ steps.gate.outputs.automatic }}
+      variants: ${{ steps.variants.outputs.list }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      # Every variant a main build ships, so a PR build can be tried under any of them.
+      - name: The packages a signed build ships as
+        id: variants
+        run: echo "list=$(awk '!/^#/ && NF { print $1 }' tools/release/variants.txt | jq -R . | jq -sc .)" >> "$GITHUB_OUTPUT"
+      - name: Check the requester, PR, and build
+        id: gate
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          REQUESTER: ${{ github.actor }}
+          PR_NUMBER: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.number || github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number || inputs.pr_number }}
+          BUILT_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          set -euo pipefail
+          [[ "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]] || { echo "::error::Invalid PR number '$PR_NUMBER'"; exit 1; }
+          # The automatic path stands down quietly, never failing: a draft, a PR labelled
+          # no-test-build, or a build that a later push has already overtaken.
+          skip() { echo "::notice::Not publishing PR #$PR_NUMBER: $1"; echo "skip=true" >> "$GITHUB_OUTPUT"; exit 0; }
+          if [ "$EVENT_NAME" = workflow_run ]; then
+            echo "automatic=true" >> "$GITHUB_OUTPUT"
+            pr=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER")
+            [ "$(jq -r .state <<<"$pr")" = open ] || skip "it is not open"
+            [ "$(jq -r .draft <<<"$pr")" = false ] || skip "it is a draft"
+            [ "$(jq -r .base.ref <<<"$pr")" = main ] || skip "it does not target main"
+            [ "$(jq -r .head.repo.full_name <<<"$pr")" = "$GITHUB_REPOSITORY" ] || skip "it comes from a fork"
+            jq -e 'any(.labels[]; .name == "no-test-build")' <<<"$pr" >/dev/null && skip "it is labelled no-test-build"
+            [ "$(jq -r .head.sha <<<"$pr")" = "$BUILT_SHA" ] || skip "a newer push is building"
+          fi
+          if [ "$EVENT_NAME" = pull_request_target ]; then
+            permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$REQUESTER/permission" --jq .permission)
+            case "$permission" in
+              admin|maintain|write) ;;
+              *) echo "::error::@$REQUESTER does not have permission to publish release-signed test builds"; exit 1 ;;
+            esac
+          fi
+          pr=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER")
+          jq -e '.state == "open" and .draft == false and .base.ref == "main"' <<<"$pr" >/dev/null ||
+            { echo "::error::PR #$PR_NUMBER must be open, ready for review, and target main"; exit 1; }
+          head=$(jq -r '.head.sha' <<<"$pr")
+          base=$(jq -r '.base.sha' <<<"$pr")
+
+          # The label is often added while the PR's build is still running, or just after a push
+          # before it has started: wait for the latest build of the head commit to finish (a PR
+          # build takes about 4 minutes) rather than fail and need the label added again.
+          run_id=
+          for attempt in $(seq 1 60); do
+            latest=$(gh run list -R "$GITHUB_REPOSITORY" --workflow build.yml \
+              --event pull_request --commit "$head" \
+              --json databaseId,headSha,status,conclusion,createdAt,attempt -L 100 |
+              jq -c --arg head "$head" '[.[] | select(.headSha == $head)] |
+                sort_by([.createdAt, .attempt]) | last // empty')
+            if [[ -n "$latest" && $(jq -r .status <<<"$latest") == completed ]]; then
+              conclusion=$(jq -r .conclusion <<<"$latest")
+              [[ "$conclusion" == success ]] || { echo "::error::The latest PR build is not green ($conclusion)"; exit 1; }
+              run_id=$(jq -r .databaseId <<<"$latest")
+              break
+            fi
+            status=not-started
+            [[ -z "$latest" ]] || status=$(jq -r .status <<<"$latest")
+            echo "Waiting for the PR build of ${head:0:7} to finish ($status)"
+            sleep 30
+          done
+          [[ -n "$run_id" ]] || { echo '::error::The PR build did not finish within 30 minutes'; exit 1; }
+          # GitHub leaves a run's pull_requests empty when its head is in a fork, so the build is
+          # tied to this PR by its head repository, branch and commit instead.
+          run=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$run_id")
+          jq -e --arg head "$head" --arg repo "$(jq -r .head.repo.full_name <<<"$pr")" --arg ref "$(jq -r .head.ref <<<"$pr")" '
+            .event == "pull_request" and .head_sha == $head and .conclusion == "success" and
+            .head_repository.full_name == $repo and .head_branch == $ref
+          ' <<<"$run" >/dev/null ||
+            { echo "::error::Build run $run_id is not a green build of PR #$PR_NUMBER at ${head:0:7}"; exit 1; }
+
+          sdk=${ANDROID_HOME:-${ANDROID_SDK_ROOT:-}}
+          tools=$(find "$sdk/build-tools" -mindepth 1 -maxdepth 1 -type d | sort -V | tail -1)
+          # A PR build is made from the PR merged onto main, so it must install over main's own
+          # build. main is what this job checked out; no release has to exist or be marked latest.
+          main_code=$(sed -n 's/^[[:space:]]*versionCode[[:space:]][[:space:]]*\([0-9][0-9]*\)[[:space:]]*$/\1/p' app/build.gradle)
+          [[ "$main_code" =~ ^[0-9]+$ ]] || { echo "::error::No numeric versionCode in main's app/build.gradle"; exit 1; }
+          mkdir -p "$RUNNER_TEMP/pr"
+          gh run download "$run_id" -R "$GITHUB_REPOSITORY" -n droiddeck-apk -D "$RUNNER_TEMP/pr"
+          mapfile -t apks < <(find "$RUNNER_TEMP/pr" -type f -name '*.apk')
+          [[ ${#apks[@]} == 1 ]] || { echo '::error::Expected one PR APK'; exit 1; }
+          package_line() {
+            "$tools/aapt" dump badging "$1" | sed -n "s/^package: name='\\([^']*\\)' versionCode='\\([^']*\\)'.*/\\1 \\2/p"
+          }
+          candidate=$(package_line "${apks[0]}")
+          [[ "$candidate" =~ ^com\.droiddeck\.launcher\ [0-9]+$ && ${candidate##* } -ge $main_code ]] || {
+            echo "::error::PR package/versionCode '$candidate' cannot install over main (versionCode $main_code)"; exit 1;
+          }
+
+          current=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER")
+          jq -e --arg head "$head" --arg base "$base" '
+            .state == "open" and .draft == false and .base.ref == "main" and
+            .head.sha == $head and .base.sha == $base
+          ' <<<"$current" >/dev/null ||
+            { echo "::error::PR #$PR_NUMBER moved on while its build was checked; publish again"; exit 1; }
+          {
+            echo "pr_number=$PR_NUMBER"
+            echo "run_id=$run_id"
+            echo "head_sha=$head"
+            echo "base_sha=$base"
+            echo "version_code=${candidate##* }"
+            echo "label=PR.$PR_NUMBER-${head:0:7}"
+          } >> "$GITHUB_OUTPUT"
+
+  sign:
+    needs: authorize
+    uses: ./.github/workflows/sign.yml
+    with:
+      environment: signing-main
+      variants: ${{ needs.authorize.outputs.variants }}
+      run_id: ${{ needs.authorize.outputs.run_id }}
+      label: ${{ needs.authorize.outputs.label }}
+      artifact: droiddeck-pr-signed
+    secrets: inherit
+    if: ${{ needs.authorize.outputs.skip != 'true' }}
+
+  publish:
+    needs: [authorize, sign]
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+          persist-credentials: false
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: droiddeck-pr-signed-*
+          merge-multiple: true
+          path: signed
+      # What this build is, for the top of the release notes: the PR's title and the first
+      # paragraph of its description.
+      - name: Describe the change
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ needs.authorize.outputs.pr_number }}
+        run: |
+          set -euo pipefail
+          pr=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER")
+          title=$(jq -r .title <<<"$pr")
+          summary=$(jq -r '.body // ""' <<<"$pr" | tr -d '\r' | { grep -v '^🤖' || true; } |
+            awk '!p && /^#/ { next } NF { p = 1; print; next } p { exit }' | head -n 6 | cut -c1-400)
+          {
+            echo "**Not merged** - a test build of open [PR #$PR_NUMBER]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/pull/$PR_NUMBER): $title"
+            if [ -n "$summary" ]; then
+              echo
+              echo "$summary"
+            fi
+          } > notes-head.md
+          cat notes-head.md
+      # A token of the org's "DroidDeck CI Publisher" app, as build.yml's announce job uses.
+      - uses: actions/create-github-app-token@v2
+        id: ci-token
+        with:
+          app-id: ${{ vars.DROIDDECK_CI_APP_ID }}
+          private-key: ${{ secrets.DROIDDECK_CI_APP_KEY }}
+          owner: Droid-Deck
+          repositories: DroidDeck-CI
+      - name: Publish to DroidDeck-CI
+        id: publish
+        env:
+          GH_TOKEN: ${{ steps.ci-token.outputs.token }}
+          PR_NUMBER: ${{ needs.authorize.outputs.pr_number }}
+          HEAD_SHA: ${{ needs.authorize.outputs.head_sha }}
+          BASE_SHA: ${{ needs.authorize.outputs.base_sha }}
+          VERSION_CODE: ${{ needs.authorize.outputs.version_code }}
+        run: |
+          set -euo pipefail
+          repo=Droid-Deck/DroidDeck-CI
+          tag="pr-$PR_NUMBER"
+          cat signed/SHA256SUMS-*.txt > signed/SHA256SUMS.txt
+          rm signed/SHA256SUMS-*.txt
+          notes="$(cat notes-head.md)
+
+          Source: https://github.com/$GITHUB_REPOSITORY/pull/$PR_NUMBER
+          Commit: $HEAD_SHA
+          Base: $BASE_SHA
+          VersionCode: $VERSION_CODE
+          Each apk installs over a DroidDeck release and keeps its data. \`standard\` is the normal app; the others are the same app under another package name, installed beside it.
+
+          SHA-256:
+          \`\`\`
+          $(cat signed/SHA256SUMS.txt)
+          \`\`\`"
+          first=false
+          if ! gh release view "$tag" -R "$repo" >/dev/null 2>&1; then
+            gh release create "$tag" -R "$repo" --target main --title "PR #$PR_NUMBER" --notes "$notes" --prerelease
+            first=true
+          fi
+          echo "first=$first" >> "$GITHUB_OUTPUT"
+          gh release upload "$tag" signed/* -R "$repo" --clobber
+          gh release edit "$tag" -R "$repo" --title "PR #$PR_NUMBER" --notes "$notes" --prerelease
+          # Drop the previous build's files: anything this build did not just upload.
+          keep=$(cd signed && ls | jq -R . | jq -sc .)
+          gh api "repos/$repo/releases/tags/$tag" |
+            jq -r --argjson keep "$keep" '.assets[] | select(.name as $n | $keep | index($n) | not) | .id' |
+            while IFS= read -r id; do
+              gh api --method DELETE "repos/$repo/releases/assets/$id" >/dev/null
+            done
+
+          published=$(gh release view "$tag" -R "$repo" --json tagName,assets)
+          jq -e --arg tag "$tag" '.tagName == $tag and (.assets | length) > 0' <<<"$published" >/dev/null
+          release="$GITHUB_SERVER_URL/$repo/releases/tag/$tag"
+          apk=$(cd signed && ls DroidDeck-*.apk | awk 'length(a) == 0 || length($0) < length(a) { a = $0 } END { print a }')
+          echo "release=$release" >> "$GITHUB_OUTPUT"
+          echo "apk=$GITHUB_SERVER_URL/$repo/releases/download/$tag/$apk" >> "$GITHUB_OUTPUT"
+
+      - name: Whether the PR's branch is in this repo
+        id: same-repo
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ needs.authorize.outputs.pr_number }}
+        run: |
+          head_repo=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" --jq .head.repo.full_name)
+          echo "same=$([ "$head_repo" = "$GITHUB_REPOSITORY" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+
+      - name: Clear the publish request label
+        if: ${{ github.event_name == 'pull_request_target' && steps.publish.outcome == 'success' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ needs.authorize.outputs.pr_number }}
+        run: |
+          gh api --method DELETE "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/labels/publish-test"
+
+      - name: Report the signed build on the PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ needs.authorize.outputs.pr_number }}
+          HEAD_SHA: ${{ needs.authorize.outputs.head_sha }}
+          RELEASE: ${{ steps.publish.outputs.release }}
+          APK: ${{ steps.publish.outputs.apk }}
+          SAME_REPO: ${{ steps.same-repo.outputs.same }}
+        run: |
+          set -euo pipefail
+          short=${HEAD_SHA:0:7}
+          mark='<!-- droiddeck-pr-release -->'
+          if [ "$SAME_REPO" = true ]; then
+            NEXT='Each green build of a new push is signed and published here on its own. Label the PR `no-test-build` to stop that.'
+          else
+            NEXT='Pushes to this PR do not re-sign automatically. After a new green build, a maintainer can add the `publish-test` label again.'
+          fi
+          body=$(cat <<EOF
+          $mark
+          ## Signed test build
+
+          A release-signed build of this PR at \`$short\` is ready. It installs over Stable or Preview and keeps app data.
+
+          [Download the standard APK]($APK) · [All variants and checksums]($RELEASE)
+
+          It is also available in **DroidDeck → Updates → Test builds → PR #$PR_NUMBER**.
+
+          $NEXT
+          EOF
+          )
+          comment=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --paginate --slurp | \
+            jq "[.[][] | select(.user.login == \"github-actions[bot]\") | select(.body | startswith(\"$mark\"))] | first // {}")
+          id=$(jq -r '.id // empty' <<<"$comment")
+          if [ -n "$id" ]; then
+            state=$(jq -r '.body | split("\n")[] | select(startswith("<!-- droiddeck-discord: ") and endswith(" -->"))' <<<"$comment")
+            if [ -n "$state" ]; then body=$(printf '%s\n%s' "$body" "$state"); fi
+            gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -f body="$body" >/dev/null
+          else
+            gh api -X POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" -f body="$body" >/dev/null
+          fi
+
+      - name: Update the Discord PR announcement
+        if: ${{ always() && steps.publish.outcome == 'success' }}
+        env:
+          WEBHOOK: ${{ secrets.DISCORD_PR_BUILDS_WEBHOOK }}
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ needs.authorize.outputs.pr_number }}
+          HEAD_SHA: ${{ needs.authorize.outputs.head_sha }}
+          RELEASE: ${{ steps.publish.outputs.release }}
+          APK: ${{ steps.publish.outputs.apk }}
+        run: python3 tools/release/pr_discord.py publish
+
+  catalog:
+    needs: publish
+    if: ${{ always() && needs.publish.result != 'skipped' }}
+    uses: ./.github/workflows/update-catalog.yml
+    secrets: inherit
@@ -0,0 +1,120 @@
+name: Release APKs
+run-name: release ${{ inputs.version }} from main ${{ github.sha }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version for the file names, e.g. 0.1.7
+        required: true
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  find:
+    name: find the main build
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    outputs:
+      run_id: ${{ steps.find.outputs.run_id }}
+      variants: ${{ steps.find.outputs.variants }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - id: find
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          [[ $VERSION =~ ^[0-9A-Za-z._-]+$ ]] || { echo "::error::version '$VERSION': letters, digits, . _ - only"; exit 1; }
+          name=$(sed -n 's/^ *versionName "\(.*\)"$/\1/p' app/build.gradle)
+          [[ $VERSION == "$name" || $VERSION == "$name"-* ]] || {
+            echo "::error::version '$VERSION' does not match versionName '$name' in app/build.gradle: bump versionName and versionCode first"; exit 1;
+          }
+          runs=$(gh run list -R "$GITHUB_REPOSITORY" --workflow build.yml --branch main --commit "$GITHUB_SHA" \
+                   --status success --json databaseId,event,headSha -L 20)
+          id=$(jq -r --arg sha "$GITHUB_SHA" \
+                 '[.[] | select(.headSha == $sha and (.event == "push" or .event == "workflow_dispatch"))][0].databaseId // empty' <<<"$runs")
+          if [ -z "$id" ]; then
+            echo "::error::main ${GITHUB_SHA::7} has no successful Build APK run yet: wait for it, then release"
+            exit 1
+          fi
+          variants=$(awk '!/^#/ && NF { print $1 }' tools/release/variants.txt | jq -R . | jq -sc .)
+          echo "run_id=$id" >> "$GITHUB_OUTPUT"
+          echo "variants=$variants" >> "$GITHUB_OUTPUT"
+          echo "Signing Build APK run $id (main ${GITHUB_SHA::7}) as $VERSION: $variants" >> "$GITHUB_STEP_SUMMARY"
+
+  sign:
+    needs: find
+    uses: ./.github/workflows/sign.yml
+    with:
+      environment: release
+      variants: ${{ needs.find.outputs.variants }}
+      run_id: ${{ needs.find.outputs.run_id }}
+      label: ${{ inputs.version }}
+      artifact: droiddeck-release
+    secrets: inherit
+
+  # The release is made here, from the apks this run signed, so it traces back to its Build APK run.
+  publish:
+    name: publish the release
+    needs: [find, sign]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: droiddeck-release-*
+          merge-multiple: true
+          path: out
+
+      - name: Publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+          BUILD_RUN: ${{ needs.find.outputs.run_id }}
+        run: |
+          set -euo pipefail
+          notes="docs/releases/$VERSION.md"
+          [ -f "$notes" ] || { echo "::error::$notes is missing: add the release notes first"; exit 1; }
+          if gh release view "$VERSION" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "::error::release $VERSION already exists"; exit 1
+          fi
+          # The notes' first line is the title; media paths become raw URLs at this release's tag.
+          title=$(sed -n '1s/^# *//p' "$notes")
+          [ -n "$title" ] || title="DroidDeck $VERSION"
+          raw="https://raw.githubusercontent.com/$GITHUB_REPOSITORY/$VERSION/docs/releases/media/"
+          {
+            sed '1{/^# /d;}' "$notes" | sed -E "s#(\]\(|src=\")media/#\1$raw#g"
+            echo
+            echo "---"
+            echo
+            echo "Built by [Build APK run $BUILD_RUN]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$BUILD_RUN) from \`$GITHUB_SHA\`, signed and published by [Release APKs run $GITHUB_RUN_ID]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID)."
+          } > "$RUNNER_TEMP/body.md"
+          ( cd out && cat SHA256SUMS-*.txt | sort -k2 > SHA256SUMS.txt && rm SHA256SUMS-*.txt && cat SHA256SUMS.txt )
+          gh release create "$VERSION" -R "$GITHUB_REPOSITORY" out/*.apk out/SHA256SUMS.txt \
+            --target "$GITHUB_SHA" --title "$title" --notes-file "$RUNNER_TEMP/body.md" --latest
+          echo "Published [$title]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/tag/$VERSION)" >> "$GITHUB_STEP_SUMMARY"
+
+  # A release made with this run's token fires no release event, so the in-app catalog is refreshed here.
+  catalog:
+    needs: publish
+    uses: ./.github/workflows/update-catalog.yml
+    permissions:
+      contents: read
+      pull-requests: read
+    secrets: inherit
@@ -0,0 +1,95 @@
+name: Sign APKs
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        type: string
+        required: true
+      variants:
+        description: JSON array of names from tools/release/variants.txt
+        type: string
+        required: true
+      run_id:
+        description: The Build APK run whose apk to sign; empty for the calling run's own
+        type: string
+        default: ''
+      label:
+        description: Goes in the file names (a version); empty for <branch>-<short sha>
+        type: string
+        default: ''
+      artifact:
+        type: string
+        default: droiddeck-signed
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  sign:
+    name: sign ${{ matrix.variant }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    environment: ${{ inputs.environment }}
+    strategy:
+      fail-fast: false
+      matrix:
+        variant: ${{ fromJSON(inputs.variants) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: The apk (this run's build)
+        if: inputs.run_id == ''
+        uses: actions/download-artifact@v4
+        with:
+          name: droiddeck-apk
+          path: in
+
+      - name: The apk (a main build)
+        if: inputs.run_id != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN: ${{ inputs.run_id }}
+        run: gh run download "$RUN" -R "$GITHUB_REPOSITORY" -n droiddeck-apk -D in
+
+      - name: Sign
+        env:
+          RELEASE_KEYSTORE_B64: ${{ secrets.RELEASE_KEYSTORE_B64 }}
+          RELEASE_STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
+          RELEASE_KEY_ALIAS: droiddeck
+          ENVIRONMENT: ${{ inputs.environment }}
+          VARIANT: ${{ matrix.variant }}
+          LABEL: ${{ inputs.label }}
+        run: |
+          set -euo pipefail
+          if [ -z "$RELEASE_KEYSTORE_B64" ]; then
+            echo "::error::environment '$ENVIRONMENT' has no signing key: run tools/release/make-release-key.sh once"
+            exit 1
+          fi
+          export RELEASE_KEYSTORE="$RUNNER_TEMP/release.p12"
+          ( umask 077; base64 -d <<<"$RELEASE_KEYSTORE_B64" > "$RELEASE_KEYSTORE" )
+          BUILD_TOOLS=$(ls -d "$ANDROID_HOME"/build-tools/* | sort -V | tail -n1)
+          export BUILD_TOOLS
+          [ -n "$LABEL" ] || LABEL="${GITHUB_REF_NAME//\//-}-${GITHUB_SHA::7}"
+          suffix=$(awk -v v="$VARIANT" '!/^#/ && $1 == v { print $3 }' tools/release/variants.txt)
+          [ "$suffix" = - ] && suffix=
+          apks=(in/*.apk)
+          [ ${#apks[@]} = 1 ] && [ -f "${apks[0]}" ] || { echo "::error::expected one apk in the build"; exit 1; }
+          mkdir -p out
+          out="out/DroidDeck-$LABEL$suffix.apk"
+          tools/release/sign-apk.sh "${apks[0]}" "$VARIANT" "$out"
+          ( cd out && sha256sum -- *.apk > "SHA256SUMS-$VARIANT.txt" && cat "SHA256SUMS-$VARIANT.txt" )
+          echo "- \`$(basename "$out")\` - $(cut -c1-16 "out/SHA256SUMS-$VARIANT.txt")…" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Forget the key
+        if: always()
+        run: rm -f "$RUNNER_TEMP/release.p12"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ inputs.artifact }}-${{ matrix.variant }}
+          path: out/*
+          if-no-files-found: error
@@ -0,0 +1,43 @@
+name: Update app catalog
+
+on:
+  workflow_call:
+  workflow_dispatch:
+  release:
+    types: [published, edited, deleted, unpublished]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: update-app-catalog
+  cancel-in-progress: false
+  queue: max
+
+jobs:
+  catalog:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      # Always use the current trusted generator, even when a release event points at an older tag.
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+          persist-credentials: false
+
+      - uses: actions/create-github-app-token@v2
+        id: ci-token
+        with:
+          app-id: ${{ vars.DROIDDECK_CI_APP_ID }}
+          private-key: ${{ secrets.DROIDDECK_CI_APP_KEY }}
+          owner: Droid-Deck
+          repositories: DroidDeck-CI
+
+      - name: Regenerate catalog.json
+        env:
+          SOURCE_GITHUB_TOKEN: ${{ github.token }}
+          CI_GITHUB_TOKEN: ${{ steps.ci-token.outputs.token }}
+        run: |
+          set -euo pipefail
+          python3 tools/release/update_catalog.py
@@ -0,0 +1,42 @@
+*.iml
+.gradle/
+local.properties
+.idea/
+.DS_Store
+build/
+captures/
+.externalNativeBuild/
+.cxx/
+.kotlin/
+# Built in CI from tools/linuxfs and app/src/main/cpp/fakeinput.cpp, never committed, so the two
+# copies cannot drift.
+app/src/main/assets/linuxfs/
+app/src/main/jniLibs/arm64-v8a/libproot.so
+app/src/main/jniLibs/arm64-v8a/.proot-inputs
+app/src/main/jniLibs/arm64-v8a/.proot-outputs
+app/src/main/jniLibs/arm64-v8a/libproot-loader.so
+app/src/main/jniLibs/arm64-v8a/libdirectaudiorelay.so
+# The store download engines (app/src/main/rust/stores) are cross-compiled by Gradle into
+# app/build/rustJniLibs; cargo's own build tree stays next to the crate. Neither is source.
+app/src/main/rust/stores/target/
+app/src/main/assets/droiddeck-esync/
+
+# Kotlin compiler session files (build-tool state, never source).
+.kotlin/
+
+# Signing keys never enter the repo (DroidDeck's lives in GitHub environment secrets; see
+# tools/release/make-release-key.sh). keystore/testkey.p12 is the public AOSP testkey.
+*.jks
+*.keystore
+*.p12
+*.pfx
+*.pk8
+*.pem
+!keystore/testkey.p12
+droiddeck-release-key/
+password.txt
+__pycache__/
+
+# Local signing with the release key (tools/build_local.sh); holds a password.
+.signing.env
+app/src/main/assets/directaudio/
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    Pluvia is an unofficial Steam client app for Android
+    Copyright (C) 2024  Oxters Wyzgowski
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    Pluvia  Copyright (C) 2024  Oxters Wyzgowski
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.
@@ -0,0 +1,40 @@
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="artwork/droiddeck-banner-dark.svg">
+    <img alt="DroidDeck" src="artwork/droiddeck-banner-light.svg" width="100%">
+  </picture>
+</p>
+
+DroidDeck brings the SteamOS experience to Android: Valve's Steam client in Big Picture on your Adreno handheld, with Windows games through Valve's ARM64 Proton.
+
+<p align="center"><a href="https://discord.gg/JRGAvawjsm"><img src="https://img.shields.io/badge/Discord-Join%20the%20community-5865F2?logo=discord&logoColor=white" alt="Join the DroidDeck Discord"></a></p>
+
+<p align="center"><img src="docs/releases/media/0.2.0/launch-into-steam.gif" width="80%" alt="Tapping DroidDeck on the Android home screen and landing in Steam Big Picture"></p>
+
+> Note: DroidDeck does not have a stand-alone website. Do not click on any download links from websites claiming to be the DroidDeck team. 
+
+## Requirements and install
+
+Use Android 9 or newer on a supported Adreno device (730 or newer, or 8xx). Adreno 6xx is experimental: DirectX 11 uses DXVK 2 and may run, and DirectX 12 games can still crash. Mali, Xclipse, PowerVR, and Adreno 710 are unsupported. No root is required. Allow about 3 GB for the runtime and 1.1 GB more for the desktop and emulators. Install the APK from [Releases](https://github.com/Droid-Deck/DroidDeck/releases), install the Linux runtime, then press **Play** and sign in. Steam downloads on first launch. Install **Desktop & apps** to use the desktop and emulators. The **Store** installs Linux apps and games from Flathub (ARM64 builds) with Flatpak; with additional options to install Appimages and set up scripts. **Stores** (Setup › Stores › "Show Stores in the rail") signs in to GOG, Epic Games and Amazon Games, browses their catalogs and libraries, downloads games into the Games storage and adds each one to the Steam client as a non-Steam game, so it launches through Proton like everything else; the cog on its chip row sets which tab a store opens on and the download speed tier.
+
+Before Steam launches, you must turn off **Restrict child processes** in Developer options. If this option is not available in developer settings (Android 12 and 13 devices), first launch of Steam will present a "Fix it for me" button, which will help automate the setup process.
+
+## Community
+
+Join the [DroidDeck Discord](https://discord.gg/JRGAvawjsm) for help, Preview builds, and device reports. Bug reports go in its **#bug-reports** forum; attach the zip from **Share logs** (Setup, or the session drawer) so the logs come with it.
+
+## Build
+
+Run `tools/build_local.sh` with Docker, Java 17, the Android SDK/NDK, Rust through rustup, GitHub CLI, Python 3, and `zstd` installed. It prepares the same native libraries, pinned components and audio sinks as CI, then checks the APK's assets, JNI exports and dependencies. The APK is at `app/build/outputs/apk/release/app-release.apk`. Set `DROIDDECK_PA13_SOURCE_DIR` to an existing PulseAudio 13.0 source directory to skip downloading it. Set `DROIDDECK_SIGNING_ENV` to a signing environment file to install over a release build; relative keystore paths resolve beside that file. To install on an attached device, run `tools/deploy_local.sh`.
+
+After preparation, ordinary `./gradlew :app:assembleRelease` builds can reuse the verified inputs. If native sources, component pins or staged files change, packaging stops with instructions to rerun the helper. Generated audio stays under `app/build/`; the tracked base bundle is never modified. `./gradlew -PskipRust=true :app:testDebugUnitTest` needs no native preparation. For an APK without store engines, use `DROIDDECK_SKIP_RUST=1 tools/build_local.sh`; it omits cached engine libraries too.
+
+Run the helper and preload regression suite with `bash tools/test_local.sh`. On macOS it runs in Linux through Docker, matching the helpers' runtime and CI instead of compiling Linux preloads against macOS headers.
+
+## Limits
+
+Compatibility and performance vary by device; hardware validation is limited. Desktop compositing uses software rendering. Firefox sandboxing is reduced under proot. Logs are kept app-private (`files/logs/`, the last 30 sessions); **Share logs** packs the newest session, with the stores and tool logs, into one scrubbed zip.
+
+## Credits and licence
+
+GPL-3.0. Runtime, shim, input, and controller work build on WinNative and Bannerlator (maxjivi05). LSFG frame generation is from the work of Camille LaVey and the [Eden](https://eden-emu.dev) emulator project, following [lsfg-vk](https://github.com/PancakeTAS/lsfg-vk), ported to WinNative and DroidDeck by [@maxjivi05](https://github.com/maxjivi05); it needs your own copy of [Lossless Scaling](https://store.steampowered.com/app/993090/) and ships none of its shaders. x86 AppImages, and any whose own runtime cannot unpack them, are unpacked with [uruntime](https://github.com/VHSgunzo/uruntime) by VHSgunzo (MIT), shipped unmodified with its licence. See [LICENSE](LICENSE). Steam and Proton belong to Valve Corporation; this project is not affiliated with Valve.
@@ -0,0 +1,305 @@
+plugins {
+    id 'com.android.application'
+}
+apply plugin: 'kotlin-android'
+apply plugin: 'org.jetbrains.kotlin.plugin.compose'
+
+def gitValue = { List<String> arguments ->
+    try {
+        def output = providers.exec {
+            commandLine(['git'] + arguments)
+            workingDir rootProject.projectDir
+            ignoreExitValue = true
+        }
+        output.result.get().exitValue == 0 ? output.standardOutput.asText.get().trim() : null
+    } catch (Exception ignored) {
+        null
+    }
+}
+
+def buildLabel = providers.environmentVariable('DROIDDECK_BUILD_LABEL').getOrNull()
+if (buildLabel == null || buildLabel.trim().isEmpty()) {
+    def eventName = providers.environmentVariable('GITHUB_EVENT_NAME').getOrNull()
+    def eventPath = providers.environmentVariable('GITHUB_EVENT_PATH').getOrNull()
+    if (eventName == 'pull_request_target' && eventPath) {
+        try {
+            def eventFile = layout.file(providers.provider { new File(eventPath) })
+            def eventText = providers.fileContents(eventFile).asText.get()
+            def pullRequest = new groovy.json.JsonSlurper().parseText(eventText).pull_request
+            if (pullRequest?.number && pullRequest?.head?.sha) {
+                buildLabel = "pr${pullRequest.number} at ${pullRequest.head.sha.take(7)}"
+            }
+        } catch (Exception ignored) {
+        }
+    }
+    if (buildLabel == null || buildLabel.trim().isEmpty()) {
+        def branch = providers.environmentVariable('GITHUB_REF_NAME').getOrNull()
+            ?: gitValue(['branch', '--show-current']) ?: 'local'
+        def commit = providers.environmentVariable('GITHUB_SHA').getOrNull()
+            ?.take(7) ?: gitValue(['rev-parse', '--short=7', 'HEAD']) ?: 'unknown'
+        buildLabel = "${branch} at ${commit}"
+    }
+}
+def buildOrigin = providers.environmentVariable('GITHUB_ACTIONS').getOrNull() == 'true' ? 'remote' : 'local'
+def treeState = providers.environmentVariable('DROIDDECK_BUILD_TREE_STATE').getOrNull()
+if (!(treeState in ['clean', 'dirty'])) {
+    def status = gitValue(['status', '--porcelain'])
+    treeState = status == null ? 'unknown' : (status.isEmpty() ? 'clean' : 'dirty')
+}
+buildLabel = "${buildOrigin} ${treeState} · ${buildLabel}"
+def escapedBuildLabel = buildLabel.replace('\\', '\\\\').replace('"', '\\"')
+
+// What the in-app updater compares against the published builds: the commit this build is of (a PR
+// build's head, not the merge CI makes of it), its PR, and whether CI made it at all.
+def sourceCommit = providers.environmentVariable('DROIDDECK_SOURCE_COMMIT').getOrNull()
+    ?: providers.environmentVariable('GITHUB_SHA').getOrNull() ?: gitValue(['rev-parse', 'HEAD']) ?: ''
+def prNumber = (providers.environmentVariable('DROIDDECK_PR_NUMBER').getOrNull() ?: '0').with { it.isInteger() ? it : '0' }
+def ciBuild = providers.environmentVariable('GITHUB_ACTIONS').getOrNull() == 'true'
+// The release key's certificate: a build signed with it, from CI or a computer, updates in place.
+def releaseSigner = rootProject.file('keystore/release-signer.sha256').text.trim()
+// When the source was committed, for "built 3 hours ago": fixed per commit, so it costs no rebuilds.
+def commitTime = (gitValue(['show', '-s', '--format=%ct', 'HEAD']) ?: '0').with { it.isLong() ? it : '0' }
+// The desktop package this apk installs (tools/desktop-kde/release.env): published once per tag in
+// DroidDeck-Components, pinned here with its checksum like gamescope and the esync packs, so the
+// desktop scripts in the apk always get the package they were made for.
+def desktopKde = rootProject.file('tools/desktop-kde/release.env').readLines()
+    .findAll { it.contains('=') && !it.startsWith('#') }
+    .collectEntries { def kv = it.split('=', 2); [(kv[0].trim()): kv[1].trim()] }
+def desktopRemovalSources = new groovy.json.JsonSlurper().parse(file('src/main/assets/desktop-removal/sources.json'))
+if (desktopRemovalSources.archives[desktopKde.DESKTOP_KDE_TAG] != desktopKde.DESKTOP_KDE_SHA256) {
+    throw new GradleException('Desktop removal inventories do not match the pinned archive')
+}
+if (!file('src/main/assets/desktop-removal/versions.txt').readLines().contains(desktopKde.DESKTOP_KDE_TAG)) {
+    throw new GradleException('Regenerate desktop removal inventories for ' + desktopKde.DESKTOP_KDE_TAG)
+}
+// tools/release/variants.txt as "package=suffix;...", so the updater picks the apk of the package it runs as.
+def variantSuffixes = rootProject.file('tools/release/variants.txt').readLines()
+    .findAll { it.trim() && !it.startsWith('#') }
+    .collect { def f = it.trim().split(/\s+/); "${f[1]}=${f[2] == '-' ? '' : f[2]}" }
+    .join(';')
+
+android {
+    namespace 'com.droiddeck.launcher'
+    compileSdk 34
+    // The NDK is pinned by property so CI can hand in whatever the runner already has rather than
+    // downloading a second copy; see gradle.properties.
+    ndkVersion project.findProperty('ndkVersion') ?: '27.3.13750724'
+
+    defaultConfig {
+        applicationId "com.droiddeck.launcher"
+        minSdkVersion 26
+        // 28 is not a leftover. An app on targetSdk 29+ runs in a domain that may not execute a
+        // file out of its own data directory, and this app's entire job is to exec a rootfs:
+        // proot, gamescope, the Steam client and everything it launches all live under files/.
+        targetSdkVersion 28
+        versionCode 12
+        versionName "0.3.2"
+        buildConfigField "String", "BUILD_LABEL", "\"${escapedBuildLabel}\""
+        buildConfigField "String", "SOURCE_COMMIT", "\"${sourceCommit}\""
+        buildConfigField "int", "PR_NUMBER", "${prNumber}"
+        buildConfigField "boolean", "CI_BUILD", "${ciBuild}"
+        buildConfigField "String", "RELEASE_SIGNER", "\"${releaseSigner}\""
+        buildConfigField "long", "COMMIT_TIME", "${commitTime}L * 1000L"
+        buildConfigField "String", "VARIANT_SUFFIXES", "\"${variantSuffixes}\""
+        buildConfigField "String", "SGDB_API_KEY", "\"${System.getenv("SGDB_API_KEY") ?: project.findProperty("sgdbApiKey") ?: ""}\""
+        buildConfigField "String", "DESKTOP_KDE_TAG", "\"${desktopKde.DESKTOP_KDE_TAG}\""
+        buildConfigField "String", "DESKTOP_KDE_URL", "\"https://github.com/${desktopKde.DESKTOP_KDE_REPO}/releases/download/${desktopKde.DESKTOP_KDE_TAG}/desktop-kde.tar.zst\""
+        buildConfigField "String", "DESKTOP_KDE_SHA256", "\"${desktopKde.DESKTOP_KDE_SHA256}\""
+        buildConfigField "long", "DESKTOP_KDE_SIZE", "${desktopKde.DESKTOP_KDE_SIZE}L"
+
+        ndk {
+            abiFilters 'arm64-v8a'
+        }
+        externalNativeBuild {
+            cmake {
+                arguments '-DANDROID_STL=c++_shared'
+            }
+        }
+    }
+
+    externalNativeBuild {
+        cmake {
+            path 'src/main/cpp/CMakeLists.txt'
+            version '3.22.1'
+        }
+    }
+
+    signingConfigs {
+        // AOSP testkey ([email protected]), the same key Bannerlator ships with. It is publicly
+        // known, so it proves nothing about who built the apk - what it buys is ONE stable
+        // signature: every build installs over the last one instead of asking the user to
+        // uninstall first. v1 (JAR) + v2 + v3 so every installer and Android version accepts it.
+        testkey {
+            storeFile file("${rootDir}/keystore/testkey.p12")
+            storeType "PKCS12"
+            storePassword "android"
+            keyAlias "testkey"
+            keyPassword "android"
+            enableV1Signing = true
+            enableV2Signing = true
+            enableV3Signing = true
+        }
+    }
+
+    buildTypes {
+        debug {
+            minifyEnabled false
+            signingConfig signingConfigs.testkey
+        }
+        release {
+            minifyEnabled false
+            signingConfig signingConfigs.testkey
+        }
+    }
+
+    lint {
+        // targetSdk 28 is deliberate and structural: an app on 29+ may not execute a file out of
+        // its own data directory, and executing a rootfs is the whole of what this app does. Lint
+        // fails a release build over it because Google Play will not accept an sdk that old -
+        // true, and not something this app can trade away. Every other check stays on.
+        disable 'ExpiredTargetSdkVersion'
+    }
+
+    packagingOptions {
+        resources {
+            // Kadb's Bouncy Castle artifacts repeat the same multi-release JAR manifest.
+            excludes += ['META-INF/versions/9/OSGI-INF/MANIFEST.MF']
+        }
+        jniLibs {
+            // The PulseAudio daemon is executed from the native library directory and its
+            // libraries are read out of the apk by the class loader: both want the old,
+            // uncompressed-and-extracted layout.
+            useLegacyPackaging = true
+            // Prefer the PTY helper built by this app's NDK target over Termux's prebuilt copy.
+            pickFirsts += ['**/libtermux.so']
+        }
+    }
+
+    buildFeatures {
+        compose true
+        buildConfig true
+    }
+
+    testOptions {
+        // Plain JVM tests: a stray android.util.Log call returns a default instead of throwing.
+        unitTests.returnDefaultValues = true
+        // Robolectric tests start activities whose text is now all string resources.
+        unitTests.includeAndroidResources = true
+    }
+
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_17
+        targetCompatibility JavaVersion.VERSION_17
+    }
+    kotlinOptions {
+        jvmTarget = '17'
+    }
+}
+
+// Session scripts must follow this checkout even when the native asset bundle is cached.
+// A stale local bundle can omit a newly required helper on a fresh runtime install.
+def stageSessionScripts = tasks.register('stageSessionScripts', Copy) {
+    from(rootProject.file('tools/linuxfs/overlay')) {
+        include 'usr/local/bin/droiddeck-*', 'usr/local/bin/steam-compatibility', 'usr/bin/**'
+    }
+    into(layout.projectDirectory.dir('src/main/assets/linuxfs'))
+}
+tasks.named('preBuild').configure { dependsOn(stageSessionScripts) }
+
+// Prepared audio lives under build/, so native builds never rewrite the tracked base bundle.
+// Copying into one asset root also prevents an old base bundle winning a duplicate asset merge.
+def runtimeAssetsDir = layout.buildDirectory.dir('runtimeAssets')
+def stageRuntimeAssets = tasks.register('stageRuntimeAssets', Sync) {
+    dependsOn(stageSessionScripts)
+    from(layout.projectDirectory.dir('src/main/assets')) { exclude 'pulseaudio.tzst' }
+    from(layout.buildDirectory.dir('prepared-assets'))
+    into(runtimeAssetsDir)
+}
+android.sourceSets.main.assets.setSrcDirs([runtimeAssetsDir])
+tasks.named('preBuild').configure { dependsOn(stageRuntimeAssets) }
+
+// Unit tests and previews remain usable without Docker. Packaging an APK requires the complete
+// runtime payload prepared by the local helper or CI, with matching sources and output hashes.
+def verifyRuntimeInputs = tasks.register('verifyRuntimeInputs', Exec) {
+    // The session scripts are re-copied into the asset tree by stageSessionScripts; with parallel
+    // task execution this check once hashed a file mid-copy and failed a main build. Hash only
+    // once the staging has finished.
+    mustRunAfter(stageSessionScripts, stageRuntimeAssets)
+    workingDir rootProject.projectDir
+    commandLine 'python3', 'tools/release/runtime_inputs.py', 'verify'
+}
+tasks.configureEach { task ->
+    if (task.name in ['packageDebug', 'packageRelease']) task.dependsOn(verifyRuntimeInputs)
+}
+
+// The GOG / Epic / Amazon download engines are Rust (app/src/main/rust/stores, ported from
+// Bannerlator's bl-steam-client crate). cargo-ndk cross-compiles them for arm64-v8a into the build
+// directory, which is one more jniLibs source below: nothing compiled is committed, the same rule
+// the preloads, proot and the DirectAudio relay follow. cargo-ndk exports the NDK clang/llvm-ar as
+// the C compiler for the one C-compiling crate (ring, under rustls) - the step Bannerlator's CI
+// does by hand - and reads the NDK from ANDROID_NDK_HOME, which is set to the NDK this build pins.
+// -PskipRust=true builds without the library, for a checkout with no Rust toolchain: the stores
+// then report themselves unavailable instead of the build failing.
+def rustCrateDir = layout.projectDirectory.dir('src/main/rust/stores')
+def rustJniLibsDir = layout.buildDirectory.dir('rustJniLibs')
+def skipRust = (project.findProperty('skipRust') ?: 'false').toString().toBoolean()
+def buildRustStores = tasks.register('buildRustStores', Exec) {
+    description = 'Cross-compiles the store download engines (libdroiddeckstores.so) with cargo-ndk.'
+    onlyIf { !skipRust }
+    inputs.dir(rustCrateDir.dir('src'))
+    inputs.files(rustCrateDir.file('Cargo.toml'), rustCrateDir.file('Cargo.lock'))
+    inputs.property('ndkVersion', android.ndkVersion)
+    if (!skipRust) inputs.property('rustToolchain', providers.exec {
+        environment 'PATH', "${System.getProperty('user.home')}/.cargo/bin${File.pathSeparator}${System.getenv('PATH')}"
+        commandLine 'rustup', 'run', 'stable', 'rustc', '-Vv'
+    }.standardOutput.asText)
+    outputs.dir(rustJniLibsDir)
+    workingDir rustCrateDir
+    // The configuration cache serialises the task, so everything it needs is resolved here, not
+    // in doFirst. ~/.cargo/bin is where rustup puts cargo and cargo-ndk; an IDE-launched Gradle
+    // does not always have it on PATH.
+    def cargoBin = "${System.getProperty('user.home')}/.cargo/bin"
+    environment 'PATH', "${cargoBin}${File.pathSeparator}${System.getenv('PATH')}"
+    environment 'ANDROID_NDK_HOME', android.ndkDirectory.absolutePath
+    environment 'CARGO_TERM_COLOR', 'never'
+    if (!skipRust) environment 'RUSTC', providers.exec {
+        commandLine 'rustup', 'which', '--toolchain', 'stable', 'rustc'
+    }.standardOutput.asText.get().trim()
+    // --platform 26 = minSdkVersion: the engines link against the API 26 libc, like the C++ code.
+    // Homebrew's cargo/rustc can precede rustup on macOS and use a different sysroot, despite
+    // rustup reporting the Android target installed. Run both through the selected toolchain.
+    commandLine 'rustup', 'run', 'stable', 'cargo', 'ndk', '--target', 'arm64-v8a', '--platform', '26',
+        '--output-dir', rustJniLibsDir.get().asFile.absolutePath,
+        'build', '--release', '--locked'
+}
+// Skipping Rust must omit its library even if another build left a cached .so behind.
+if (!skipRust) android.sourceSets.main.jniLibs.srcDir(rustJniLibsDir)
+tasks.named('preBuild').configure { dependsOn(buildRustStores) }
+
+dependencies {
+    // The runtime tarball is a zstd-compressed tar.
+    implementation 'com.github.luben:zstd-jni:1.5.2-3@aar'
+    implementation 'org.apache.commons:commons-compress:1.27.1'
+    // Bannerlator's Windows components come as .tar.xz (WinComponents).
+    implementation 'org.tukaani:xz:1.10'
+    // The UI: every menu, dialog and overlay is Compose. The session's SurfaceView and the
+    // on-screen pad are Views underneath it, which is what they are in every Compose app.
+    implementation platform('androidx.compose:compose-bom:2024.02.00')
+    implementation 'androidx.compose.ui:ui'
+    implementation 'androidx.compose.material3:material3'
+    implementation 'androidx.activity:activity-compose:1.8.2'
+    // The File Manager, Bannerlator's: its icon set, image thumbnails and the coroutines it
+    // copies on. Same versions as Bannerlator so the screen stays a straight copy.
+    implementation 'androidx.compose.material:material-icons-extended'
+    implementation 'io.coil-kt:coil-compose:2.6.0'
+    implementation 'com.caverock:androidsvg-aar:1.4'
+    implementation 'org.jetbrains.kotlinx:kotlinx-coroutines-android:1.7.3'
+    // ADB-over-Wi-Fi pairing and authenticated shell client. Users still approve pairing from
+    // Android's Wireless debugging screen; DroidDeck only runs its one fixed setting command.
+    implementation 'com.flyfishxu:kadb-android:1.2.1'
+    // Android terminal view/emulator used by the in-session secondary-display Linux shell.
+    implementation 'com.termux.termux-app:terminal-view:0.118.0'
+
+    testImplementation 'junit:junit:4.13.2'
+    testImplementation 'org.robolectric:robolectric:4.16.1'
+}
@@ -0,0 +1,212 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.CHANGE_WIFI_MULTICAST_STATE" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <!-- Session logs go to Downloads so a failed run can be handed over as one folder. -->
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
+    <uses-permission android:name="android.permission.WAKE_LOCK" />
+    <!-- Store download progress and "installed" / "failed" notices (Android 13+). -->
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <!-- The session keeps running while the app is not on screen: a foreground service holds the
+         process at perceptible priority, and a high-performance WiFi lock keeps a backgrounded
+         download from being throttled to nothing by the radio's power-save. -->
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
+    <!-- Optional Wi-Fi discovery: requested only from Steam settings after an explanation. -->
+    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
+    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
+    <uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />
+    <uses-permission android:name="android.permission.VIBRATE" />
+    <!-- Ends background processes of another app that holds the Steam login. GameHub starts
+         itself with the phone via boot receivers and signs this client out seconds after every
+         login; a normal permission, and it cannot touch anything in the foreground. -->
+    <uses-permission android:name="android.permission.KILL_BACKGROUND_PROCESSES" />
+    <!-- The microphone for the Linux session, only when the user turns it on: the DirectAudio
+         relay helper opens the input stream under this uid, and PulseAudio exposes it to the
+         Steam client as DirectAudioMic. -->
+    <uses-permission android:name="android.permission.RECORD_AUDIO" />
+    <!-- Installs DroidDeck's own updates (Updates page) over itself, after the user allows it. -->
+    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
+    <!-- A paired Steam Controller, read over Bluetooth LE out of lizard mode (SteamControllerBle).
+         Granted at install below targetSdk 31; no scan, so no location. -->
+    <uses-permission android:name="android.permission.BLUETOOTH" />
+
+    <uses-feature android:name="android.hardware.vulkan.version" android:version="0x401000" android:required="true" />
+    <uses-feature android:name="android.hardware.gamepad" android:required="false" />
+
+    <application
+        android:name=".App"
+        android:localeConfig="@xml/locales_config"
+        android:allowBackup="false"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:theme="@style/AppTheme"
+        android:hardwareAccelerated="true"
+        android:largeHeap="true"
+        android:extractNativeLibs="true"
+        android:appCategory="game"
+        android:isGame="true">
+
+        <!-- A game, to the OS: Android 12+ routes the category through GameManager and the OEM
+             performance frameworks (Game Booster, Game Turbo, Game Space) key off it. Without it
+             a regular flagship runs the session under its "app" power profile - a conservative
+             governor and GPU DVFS - which is why the same chipset feels slower here than in a
+             gaming phone whose mode is on for everything. The config says what the OS may do. -->
+        <meta-data android:name="android.game_mode_config" android:resource="@xml/game_mode_config" />
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true"
+            android:screenOrientation="sensorLandscape"
+            android:configChanges="keyboard|keyboardHidden|navigation">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="droiddeck" android:host="game" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.CREATE_SHORTCUT" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="com.droiddeck.launcher.LAUNCH_GAME" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
+        </activity>
+
+        <!-- Android owns the Home key. This small translucent Home handler routes the resulting
+             Home launch either back into a running Steam session or to the regular front end.
+             Off until the user turns on "Use as a Home screen" (Setup): while it is disabled the
+             app is not a Home app at all - not offered, not in the "choose Home" list. -->
+        <activity
+            android:name=".HomeActivity"
+            android:enabled="false"
+            android:exported="true"
+            android:excludeFromRecents="true"
+            android:noHistory="true"
+            android:taskAffinity="${applicationId}.home"
+            android:screenOrientation="sensorLandscape"
+            android:theme="@android:style/Theme.Translucent.NoTitleBar">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.HOME" />
+            </intent-filter>
+        </activity>
+
+        <!--
+            A session keeps a Surface, a compositor thread and a proot tree alive; a configuration
+            change must not tear that down and rebuild it, so the activity handles them itself.
+            Landscape only: gamescope is told one output size when it starts.
+
+            Resizable, deliberately: a foldable opening or closing changes the window, and the
+            compositor re-fits the picture with bars. Declared non-resizable, the system keeps a
+            fixed-shape window instead and STRETCHES it onto the other panel - the app never sees a
+            size change, so nothing it does can help.
+        -->
+        <activity
+            android:name=".input.ControllerEditorActivity"
+            android:exported="false"
+            android:theme="@style/SessionTheme"
+            android:screenOrientation="sensorLandscape"
+            android:resizeableActivity="true"
+            android:configChanges="orientation|screenSize|screenLayout|smallestScreenSize|keyboard|keyboardHidden|navigation|uiMode|density" />
+
+        <activity
+            android:name=".files.FileManagerActivity"
+            android:exported="false"
+            android:screenOrientation="sensorLandscape"
+            android:theme="@style/AppTheme" />
+
+        <activity
+            android:name=".files.FilePickerActivity"
+            android:exported="false"
+            android:screenOrientation="sensorLandscape"
+            android:theme="@style/AppTheme" />
+
+        <!-- A store's own sign-in page (GOG, Epic Games, Amazon Games) in a WebView. -->
+        <activity
+            android:name=".stores.StoreLoginActivity"
+            android:exported="false"
+            android:screenOrientation="sensorLandscape"
+            android:theme="@style/AppTheme" />
+
+        <activity
+            android:name=".agent.AgentStartActivity"
+            android:exported="true"
+            android:excludeFromRecents="true"
+            android:noHistory="true"
+            android:permission="android.permission.DUMP"
+            android:theme="@style/SessionTheme" />
+
+        <activity
+            android:name=".SessionActivity"
+            android:exported="false"
+            android:supportsPictureInPicture="true"
+            android:launchMode="singleTask"
+            android:theme="@style/SessionTheme"
+            android:preferMinimalPostProcessing="true"
+            android:screenOrientation="sensorLandscape"
+            android:resizeableActivity="true"
+            android:configChanges="orientation|screenSize|screenLayout|smallestScreenSize|keyboard|keyboardHidden|navigation|uiMode|density" />
+
+        <!--
+            Owns the session - gamescope, the Steam client, audio - so it survives the activity
+            going away. Without it Android demotes the process as soon as the last visible
+            activity goes, and the low-memory killer reaps the guest: leaving Big Picture to
+            answer a message would come back to a dead Steam and a half-finished download.
+        -->
+        <service
+            android:name=".session.SessionService"
+            android:exported="false"
+            android:stopWithTask="false" />
+        <!-- Holds the process in the foreground while the Linux runtime downloads and unpacks. -->
+        <service
+            android:name=".runtime.RuntimeInstallService"
+            android:exported="false" />
+        <service
+            android:name=".core.WirelessAdbPairingService"
+            android:exported="false" />
+        <!-- Keeps the process alive while a store (GOG, Epic, Amazon) game downloads. -->
+        <service
+            android:name=".stores.download.StoreDownloadService"
+            android:exported="false"
+            android:foregroundServiceType="dataSync" />
+        <!-- Hands a zipped session folder to the share sheet; nothing else is exposed. -->
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.logs"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/log_share_paths" />
+        </provider>
+        <!-- The app's data folder in Android's file picker ("Open from" > DroidDeck). Only the
+             system's documents UI may bind it; apps get a file only when the user picks it. -->
+        <provider
+            android:name=".files.AppFilesProvider"
+            android:authorities="${applicationId}.documents"
+            android:exported="true"
+            android:grantUriPermissions="true"
+            android:permission="android.permission.MANAGE_DOCUMENTS">
+            <intent-filter>
+                <action android:name="android.content.action.DOCUMENTS_PROVIDER" />
+            </intent-filter>
+        </provider>
+        <provider
+            android:name=".agent.AgentBridgeProvider"
+            android:authorities="${applicationId}.agent"
+            android:exported="true"
+            android:permission="android.permission.DUMP"
+            android:grantUriPermissions="false" />
+    </application>
+</manifest>
@@ -0,0 +1,49 @@
+{
+  "archives": {
+    "lxqt-r1": "c2bb860b3b1688287451e2495be5db313ec07f8c8af501dfac2768a9f417bc86",
+    "desktop-kde-r1": "55747e75d0ec055ab7ea1e92a757f3be227cc3205bb9101f5b53cadef6318579",
+    "desktop-kde-r2": "9ba832677b498654136c69d8c8330434d17e4d53cd099acac9bde3ba429b35bf",
+    "emulators-r1": "a1f4806a9663d28f424b4cab1277e0ede80a92e69de5bc063cdc8b45af220164"
+  },
+  "desktopApplications": {
+    "ark-26.08.1-1-aarch64.pkg.tar.xz": "93e2c2b75ff20cd29b4f312ed1979ef6f27255b93232b93bfcdb31239903c1d4",
+    "breeze-6.7.5-1-aarch64.pkg.tar.xz": "1d7f4eb9d8d234caaea23621909f5233d19462c2f058afeeb54bed7b81bd03bd",
+    "breeze-gtk-6.7.5-1-any.pkg.tar.xz": "a0f59bc4fc426879c8f8a97f6dcc707fb7d1b52913da5eb7e9db83777b6957b7",
+    "breeze-icons-6.30.0-1-aarch64.pkg.tar.xz": "4bae4689032501156687a227024e56554820747644953c67fc8d2e2b6b0b045a",
+    "dolphin-26.08.1-1-aarch64.pkg.tar.xz": "fef738ab8132d3eba1156b98c116699ce0a5efcb4cb462efbacdcf4c47f79a23",
+    "firefox-157.0.1-1-aarch64.pkg.tar.xz": "d142fdb8a339a65eca7cea6a2bba5b29202386166abd9d59851d6757c9eb2163",
+    "gwenview-26.08.1-1-aarch64.pkg.tar.xz": "a9dc7d5ab73fa677905d5a57248b1b9b404b6b16e862958cc7443d387f684a47",
+    "kate-26.08.1-1-aarch64.pkg.tar.xz": "acf50710042746f243a3b219a1ae0f788e338f3dd9d75093e8bb671a618b83b6",
+    "kde-cli-tools-6.7.5-1-aarch64.pkg.tar.xz": "af466398a912a994a97fadfe46aff401d88a90d7fdce7e843dc4218098fa38ac",
+    "kde-gtk-config-6.7.5-1-aarch64.pkg.tar.xz": "ba6cb4cb01dbb3f2c247f2f6973ede3b64c0849f89340217b51dfbf11cb8cb5c",
+    "kinfocenter-6.7.5-1-aarch64.pkg.tar.xz": "f3d5416db96b50f9a5b8a284d82ae21d834a8cce646010abdd7087491c399b0b",
+    "konsole-26.08.1-1-aarch64.pkg.tar.xz": "1ecf87c0d11d620ebe4aeafb02788e0d5f4fe9019ad9c5d9f1011c43237dd5ec",
+    "kscreen-6.7.5-1-aarch64.pkg.tar.xz": "8fbaa6fedf93edeba021a5416b551663654919b27c2ee237d696ec0b0ce7d5b7",
+    "kwin-6.7.5-1-aarch64.pkg.tar.xz": "a7535710c74b90359f80306134b2b7581132cbac508dc84b7e07ef275cc8c3fe",
+    "mpv-1:0.41.0-6-aarch64.pkg.tar.xz": "6c89d00736820210a3c7f32af4cf95d155191d463f9df8bd22137c45f30a554a",
+    "plasma-desktop-6.7.5-1-aarch64.pkg.tar.xz": "b266dd42cea965b5ab1cc1ae600877e9d3bc83ec642c61fe1669c4457e641a55",
+    "plasma-integration-6.7.5-1-aarch64.pkg.tar.xz": "daa96da14d9a4d12c0d9c0341e1be6836a9a437c469d61da5e9844d51e2606cf",
+    "plasma-pa-6.7.5-1-aarch64.pkg.tar.xz": "02dbefe9d3e0069b2bb37cac2a6be18b8f0a1887c87704a0716e7a9268eadcd8",
+    "plasma-workspace-6.7.5-1-aarch64.pkg.tar.xz": "3a1455857afaa9ccf342ab6167f0f15794ee9d248b0925398ea6f62f12730a86",
+    "spectacle-1:6.7.5-1-aarch64.pkg.tar.xz": "0c9837412ea6119edef18bcb0a8fceb74634cb35be0ca78b3e1dd1ff2443866e",
+    "systemsettings-6.7.5-1-aarch64.pkg.tar.xz": "b02b6a726857d5125c92d1ec95379216c7a3bc1f187a3b46e88c0d056b29ce70",
+    "xdg-desktop-portal-kde-6.7.5-1-aarch64.pkg.tar.xz": "2c57d17d34d577023eb9cd7b0fca1ba9163549afe60450f6271aa148af099ef2"
+  },
+  "legacyApplications": {
+    "featherpad-1.6.3-1-aarch64.pkg.tar.xz": "fcac55215815c0b712453f9bcc09abfe4b518e36025a111a7a7598ef04913f3d",
+    "labwc-0.20.2-1-aarch64.pkg.tar.xz": "bcd4cc3945165b0fdd33c0117cd7b9dfd05cf8c327326c37f3c3a27ef23ee5ca",
+    "lximage-qt-2.4.0-1-aarch64.pkg.tar.xz": "5d6bdd5472ea6bcb4b993b36df3ab7010bb2e62b36a78a649708fc9a52cb0928",
+    "lxqt-config-2.4.0-1-aarch64.pkg.tar.xz": "4b601d798fc7689ee76787dbef8c8958c02429ee60248cd99d950c919dbefba5",
+    "lxqt-panel-2.4.1-1-aarch64.pkg.tar.xz": "a141e0f8049e73f859d843510c6f45d6ed9087c990bcebf44f5f2430621024c4",
+    "lxqt-qtplugin-2.4.0-3-aarch64.pkg.tar.xz": "61c8f828be73111ee0bd5e3163b0d64c2098dd0189710a190f42be11137695cf",
+    "lxqt-runner-2.4.0-1-aarch64.pkg.tar.xz": "5afa74652a37366ea4e7774cf33379977582fbdca599cef1005ebf637cbcae4b",
+    "lxqt-session-2.4.0-2-aarch64.pkg.tar.xz": "e9c7c8a0011859029622ad202e0d3826e4e5bc8d64659031f6efa211456ff6eb",
+    "lxqt-themes-2.4.0-1-any.pkg.tar.xz": "7ea16c62a1fa70cdac13cb3f8fdcdaad299ae1f5bd514acfda671484755787bf",
+    "lxqt-wayland-session-0.4.1-1-any.pkg.tar.xz": "cd8dc11f5035469d23b6bbd937a90593402428c43de37517412aa43fe1fc6b10",
+    "papirus-icon-theme-20260801-1-any.pkg.tar.xz": "4aae3f47b800a60d6fd360e55adc581408ceaafc481c5a420a681741a3966510",
+    "pcmanfm-qt-2.4.1-1-aarch64.pkg.tar.xz": "7ec1a6b39dd0e4055b39f0e2c0549ea263d83004e1b821fb9e42f1d7f5fff0f9",
+    "qterminal-2.4.0-1-aarch64.pkg.tar.xz": "aa4adc9c9d47641b9452ec8d879038a9cb4762c3b6b5299045fac968fd0ed22d",
+    "swaybg-1.2.2-1-aarch64.pkg.tar.xz": "a26caa16ca7d581b5ca05758677058b4b60af10dc8d83e447ad6824b762b48b8",
+    "wlr-randr-0.5.0-1-aarch64.pkg.tar.xz": "58c3651c6a15dc8f95a310c7e225f759aa766be2fb3c0981a9a8b567854675b3"
+  }
+}
@@ -0,0 +1,2 @@
+desktop-kde-r1
+desktop-kde-r2
@@ -0,0 +1,54 @@
+# The app's native side: the Wayland compositor the session presents into, the adrenotools loader
+# it opens Turnip with, and one small library for the fake-input ring's memory fence.
+cmake_minimum_required(VERSION 3.22.1)
+project(droiddeck C CXX)
+
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O2 -Wno-unused-function -Wimplicit-function-declaration")
+
+# Every library the app builds is linked with 16 KB-aligned LOAD segments. A 16 KB-page kernel
+# (Android 15+ devices) refuses to load a 4 KB-only ELF; a 4 KB kernel loads a 16 KB-aligned one
+# unchanged (the alignment is a multiple of its page), so this costs nothing on today's devices
+# but a little padding in the file. Prebuilt libraries under jniLibs/ carry their own alignment.
+set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,-z,max-page-size=16384")
+set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-z,max-page-size=16384")
+
+add_subdirectory(adrenotools)
+
+# DXVK's DXBC->SPIR-V translator (zlib licence), vendored under thirdparty/dxbc from the same
+# subset upstream lsfg-vk uses. Native LSFG frame generation needs it: the Lossless Scaling
+# shader chain is DXBC in every build downloadable from Steam.
+add_subdirectory(thirdparty/dxbc)
+
+# The Win-FG chain self-identifies by two halves: the upstream tag it was copied from (hand-set,
+# UPDATE IT when re-copying) and a hash over the sources themselves, computed here, which cannot
+# rot. The compositor's frame-generation leg (waylandcomp/CMakeLists.txt) stamps both in.
+set(WINFG_UPSTREAM "v0.3.0")
+set(WINFG_CHAIN_SRC
+        framegen/winfg/framegen.cpp
+        framegen/winfg/framegen.hpp
+        framegen/winfg/record_impl.inc
+        framegen/winfg/config.hpp
+        framegen/winfg/embedded_shaders.hpp
+        framegen/winfg/winfg_engine.cpp
+)
+set(WINFG_HASH_INPUT "")
+foreach(f ${WINFG_CHAIN_SRC})
+    file(SHA256 "${CMAKE_CURRENT_SOURCE_DIR}/${f}" _h)
+    string(APPEND WINFG_HASH_INPUT "${_h}")
+endforeach()
+string(SHA256 WINFG_CHAIN_HASH_FULL "${WINFG_HASH_INPUT}")
+string(SUBSTRING "${WINFG_CHAIN_HASH_FULL}" 0 12 WINFG_CHAIN_HASH)
+message(STATUS "win-fg chain: ${WINFG_UPSTREAM} (src ${WINFG_CHAIN_HASH})")
+
+add_subdirectory(waylandcomp)
+add_library(sdnative SHARED sdnative/sdnative.c)
+target_link_libraries(sdnative log)
+
+# The device info window's Vulkan section: the phone's own driver, asked once through the system
+# loader (opened with dlopen, so a phone without Vulkan still loads the app).
+add_library(deviceinfo SHARED deviceinfo/vkinfo.c)
+target_link_libraries(deviceinfo dl)
+
+# Rebuild Termux terminal-emulator's PTY JNI helper with the app's NDK instead of carrying its
+# prebuilt libtermux.so with a redundant libstdc++.so dependency.
+add_library(termux SHARED termux/termux.c)
@@ -0,0 +1,4 @@
+[submodule "lib/linkernsbypass"]
+	path = lib/linkernsbypass
+	url = https://github.com/Pipetto-crypto/liblinkernsbypass.git
+	branch = master
@@ -0,0 +1,37 @@
+cmake_minimum_required(VERSION 3.14)
+
+if(NOT ${CMAKE_ANDROID_ARCH_ABI} STREQUAL arm64-v8a)
+	message(FATAL_ERROR "Unsupported target architecture: ${CMAKE_ANDROID_ARCH_ABI}. Please make an issue on the repo!")
+endif()
+
+project(adrenotools LANGUAGES CXX C)
+
+set(GEN_INSTALL_TARGET OFF CACHE BOOL "")
+
+add_subdirectory(lib/linkernsbypass)
+
+set(LIB_SOURCES src/bcenabler.cpp
+                src/driver.cpp
+                include/adrenotools/bcenabler.h
+                include/adrenotools/driver.h
+                include/adrenotools/priv.h)
+
+add_library(adrenotools ${LIB_SOURCES})
+
+target_include_directories(adrenotools PUBLIC include)
+target_include_directories(adrenotools PRIVATE .)
+target_compile_options(adrenotools PRIVATE -Wall -Wextra)
+target_link_libraries(adrenotools android linkernsbypass)
+
+add_subdirectory(src/hook)
+if (${BUILD_SHARED_LIBS})
+    target_link_options(adrenotools PRIVATE "-Wl,-s,--exclude-libs,liblinkernsbypass.a")
+endif()
+if (${GEN_INSTALL_TARGET})
+  configure_file(adrenotools.pc.in adrenotools.pc @ONLY)
+  install(FILES ${CMAKE_BINARY_DIR}/adrenotools.pc DESTINATION lib/pkgconfig)
+  install(TARGETS adrenotools main_hook file_redirect_hook gsl_alloc_hook hook_impl)
+  install(DIRECTORY include/
+          DESTINATION include
+          FILES_MATCHING PATTERN "*.h*")
+endif()
@@ -0,0 +1,24 @@
+BSD 2-Clause License
+
+Copyright (c) 2021, Billy Laws
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@@ -0,0 +1,30 @@
+### Adreno Tools 
+A library for applying rootless Adreno GPU driver modifications/replacements. Currently supports loading custom GPU drivers such as [turnip](https://docs.mesa3d.org/android.html#building-using-the-android-ndk),  enabling BCn textures and redirecting file operations to allow accessing shader dumps and modification of the [driver config file](https://gist.github.com/bylaws/04130932e2634d1c6a2a9729e3940d60) without root.
+
+#### Documentation
+API is documented in the `include/adrenotools` headers.
+
+#### Support
+Android 9+
+Arm64
+
+Please create an issue if support for anything else is desired.
+
+### FAQ
+
+#### Is there an example project?
+
+There is a simple bare-bones project [AdrenoToolsTest](https://github.com/darksylinc/AdrenoToolsTest) demonstrating how to get libadrenotools working.
+
+#### How do I use this to update the drivers on my phone? Where's the apk?
+
+You don't. This library is **not** for installing into Android and is **not** for end users.
+This library is aimed at other developers.
+
+Each individual app must explicitly make use of libadrenotools in order to load custom drivers into an app / game.
+
+#### How do I use this library to make \<favourite game\> use newer drivers?
+
+See previous question. It's up to the game developer to add support & use this library.
+
+You could contact them to so they add support for it; but that's out of our power.
@@ -0,0 +1,13 @@
+prefix="@CMAKE_INSTALL_PREFIX@"
+exec_prefix=${prefix}
+libdir=${exec_prefix}/lib
+includedir=${prefix}/include
+
+Name: adrenotools
+Description:
+URL:
+Version: 1.0.0
+Libs: -L${libdir} -ladrenotools
+Libs.private:          
+Requires.private:
+Cflags: -I${includedir}
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+aarch64-linux-gnu-gcc -c src/bcenabler_patch.s -o /tmp/patch.o
+aarch64-linux-gnu-objcopy -O binary -j .text /tmp/patch.o /tmp/patch.bin
+
+# Must be smaller than a single page
+bin2c -o gen/bcenabler_patch.h -n PatchRawData /tmp/patch.bin
+
+rm /tmp/patch.o
+rm /tmp/patch.bin
@@ -0,0 +1,23 @@
+/* Generated by bin2c, do not edit manually */
+
+/* Contents of file /tmp/patch.bin */
+const long int PatchRawData_size = 264;
+const unsigned char PatchRawData[264] = {
+    0x1F, 0x0C, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0xE0, 0x08, 0x80, 0x52, 0x3E, 0x00, 0x00, 0x14,
+    0x1F, 0x14, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0xE0, 0x08, 0x80, 0x52, 0x3A, 0x00, 0x00, 0x14,
+    0x1F, 0x10, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x00, 0x09, 0x80, 0x52, 0x36, 0x00, 0x00, 0x14,
+    0x1F, 0x18, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x00, 0x09, 0x80, 0x52, 0x32, 0x00, 0x00, 0x14,
+    0x1F, 0x1C, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x40, 0x09, 0x80, 0x52, 0x2E, 0x00, 0x00, 0x14,
+    0x1F, 0x20, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x60, 0x09, 0x80, 0x52, 0x2A, 0x00, 0x00, 0x14,
+    0x1F, 0x24, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0xA0, 0x09, 0x80, 0x52, 0x26, 0x00, 0x00, 0x14,
+    0x1F, 0x28, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0xC0, 0x09, 0x80, 0x52, 0x22, 0x00, 0x00, 0x14,
+    0x1F, 0x2C, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x00, 0x0A, 0x80, 0x52, 0x1E, 0x00, 0x00, 0x14,
+    0x1F, 0x30, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x20, 0x0A, 0x80, 0x52, 0x1A, 0x00, 0x00, 0x14,
+    0x1F, 0x34, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x60, 0x0A, 0x80, 0x52, 0x16, 0x00, 0x00, 0x14,
+    0x1F, 0x38, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x80, 0x0A, 0x80, 0x52, 0x12, 0x00, 0x00, 0x14,
+    0x1F, 0x3C, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0xE0, 0x0B, 0x80, 0x52, 0x0E, 0x00, 0x00, 0x14,
+    0x1F, 0x40, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x00, 0x0C, 0x80, 0x52, 0x0A, 0x00, 0x00, 0x14,
+    0x1F, 0x44, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x40, 0x0C, 0x80, 0x52, 0x06, 0x00, 0x00, 0x14,
+    0x1F, 0x48, 0x02, 0x71, 0x61, 0x00, 0x00, 0x54, 0x60, 0x0C, 0x80, 0x52, 0x02, 0x00, 0x00, 0x14,
+    0x00, 0x00, 0x80, 0x52, 0xFF, 0xFF, 0xFF, 0xFF
+};
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: BSD-2-Clause
+// Copyright © 2021 Billy Laws
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#else
+#include <stdbool.h>
+#endif
+
+#include <stdint.h>
+
+/**
+ * @brief Describes the level of BCeNabler support for a driver
+ */
+enum adrenotools_bcn_type {
+    ADRENOTOOLS_BCN_INCOMPATIBLE, //!< Driver isn't supported by BCeNabler
+    ADRENOTOOLS_BCN_BLOB, //!< Driver already supports BCn textures so BCeNabler isn't necessary
+    ADRENOTOOLS_BCN_PATCH //!< Driver can be patched with BCeNabler to support BCn textures
+};
+
+/**
+ * @brief Checks the status of BCn support in the supplied driver
+ * @param major The major part of VkPhysicalDeviceProperties::driverVersion
+ * @param minor The minor part of VkPhysicalDeviceProperties::driverVersion
+ * @param vendorId VkPhysicalDeviceProperties::vendorId
+ */
+enum adrenotools_bcn_type adrenotools_get_bcn_type(uint32_t major, uint32_t minor, uint32_t vendorId);
+
+/**
+ * @brief Patches the Adreno graphics driver to enable support for BCn compressed formats
+ * @note adrenotools_get_bcn_type MUST be checked to equal ADRENOTOOLS_BCN_PATCH before calling this
+ * @param vkGetPhysicalDeviceFormatPropertiesFn A pointer to vkGetPhysicalDeviceFormatProperties obtained through vkGetInstanceProcAddr. This is used to find the correct function to patch
+ * @return If the patching succeeded, if false the driver will be in an undefined state
+ */
+bool adrenotools_patch_bcn(void *vkGetPhysicalDeviceFormatPropertiesFn);
+
+#ifdef __cplusplus
+}
+#endif
@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: BSD-2-Clause
+// Copyright © 2021 Billy Laws
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stdbool.h>
+#include "priv.h"
+
+/**
+ * @brief Opens a new libvulkan.so instance according to `flags`
+ * @remark IMPORTANT: The app MUST be packaged w/ useLegacyPackaging = true. The reason for this is
+ * that we install the hook in hookLibDir; but this folder won't be set correctly when useLegacyPackaging == false
+ * because Android expects to read the *.so directly from the apk (instead of decompressing them into nativeLibraryDir).
+ * @param dlopenMode The dlopen mode to use when opening libvulkan
+ * @param featureFlags Which adrenotools driver features to enable
+ * @param tmpLibDir A writable directory to hold patched libraries, only used on api < 29 due to the lack of memfd support. If nullptr is passed and the API version is < 29 memfd usage will be attempted and if unsupported nullptr will be returned
+ * @param hookLibDir The directory holding the built hooks.
+ * IMPORTANT: This path MUST point to whatever `getApplicationInfo().nativeLibraryDir` (Kotlin code) returns.
+ * Failing to do so will result in this function returning a valid ptr but then the hook will fail and either the original driver is loaded as fallback, or vkEnumeratePhysicalDevices returns 0 devices.
+ * @param customDriverDir The directory to load a custom GPU driver named according to `customDriverName` from. Only used if ADRENOTOOLS_DRIVER_CUSTOM is set in `featureFlags`.
+ * IMPORTANT: This path MUST NOT be on sdcard/storage. i.e. use ANativeActivity::internalDataPath and often looks like "/data/user/0/com.example.app/files/".
+ * Otherwise you will get permission denied because dlopen() can't be done on *.so libraries that any random user or application can manipulate (which would be a security risk).
+ * @param customDriverName The soname of the custom driver to load. Only used if ADRENOTOOLS_DRIVER_CUSTOM is set in `featureFlags`
+ * @param fileRedirectDir The directory which to redirect all file accesses performed by the driver to. Only used if ADRENOTOOLS_DRIVER_FILE_REDIRECT is set in `featureFlags`
+ * @param userMappingHandle A pointer to a void* which will be set to the mapping handle if ADRENOTOOLS_DRIVER_GPU_MAPPING_IMPORT is set in `featureFlags`
+ */
+void *adrenotools_open_libvulkan(int dlopenMode, int featureFlags, const char *tmpLibDir, const char *hookLibDir, const char *customDriverDir, const char *customDriverName, const char *fileRedirectDir, void **userMappingHandle);
+
+/**
+ * @brief Imports the given CPU mapped memory range into the GSL allocator. This should then be followed by a call to vkAllocateMemory with a matching size which will return a VkDeviceMemory view over the input region
+ * @param handle Mapping handle that was returned by adrenotools_open_libvulkan
+ * @param hostPtr The host pointer to import
+ * @param size The size of the region to import
+ * @return True on success
+ */
+bool adrenotools_import_user_mem(void *handle, void *hostPtr, uint64_t size);
+
+/**
+ * @brief Maps GPU memory and imports it into the GSL allocator. This should then be followed by a call to adrenotools_mem_cpu_map to map the memory on the CPU, then finally vkAllocateMemory with a matching size
+ * @param handle Mapping handle that was returned by adrenotools_open_libvulkan
+ * @param size Pointer to a variable containing the size of the region to import, will be updated to contain the required size of the region to allocate CPU side
+ * @return true on success
+ */
+bool adrenotools_mem_gpu_allocate(void *handle, uint64_t *size);
+
+/**
+ * @brief Maps the last mapping allocated using adrenotools_mem_gpu_allocate into the given host memory region, such that vkAllocateMemory can then be called
+ * @param handle Mapping handle that was returned by adrenotools_open_libvulkan
+ * @param hostPtr A pointer to where the mapping should be mapped
+ * @param size The size of the mapping. MUST be equal to the size returned by adrenotools_mem_gpu_allocate
+ */
+bool adrenotools_mem_cpu_map(void *handle, void *hostPtr, uint64_t size);
+
+/**
+ * @note This function should be called after adrenotools_open_libvulkan and Vulkan driver init to check if the mapping import hook loaded successfully
+ * @return True if the mapping was successfully imported (or initialization succeeded)
+ */
+bool adrenotools_validate_gpu_mapping(void *handle);
+
+/**
+ * @brief Provides a way to force the GPU to run at the maximum possible clocks (thermal constraints will still be applied)
+ */
+void adrenotools_set_turbo(bool turbo);
+
+#ifdef __cplusplus
+}
+#endif
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: BSD-2-Clause
+// Copyright © 2021 Billy Laws
+
+#pragma once
+
+#include <stdint.h>
+
+/**
+ * @brief Bitfield enum of additional driver features that can be used with adrenotools_open_libvulkan
+ */
+enum {
+    ADRENOTOOLS_DRIVER_CUSTOM = 1 << 0,
+    ADRENOTOOLS_DRIVER_FILE_REDIRECT = 1 << 1,
+    ADRENOTOOLS_DRIVER_GPU_MAPPING_IMPORT = 1 << 2,
+};
+
+#define ADRENOTOOLS_GPU_MAPPING_SUCCEEDED_MAGIC 0xDEADBEEF
+
+/**
+ * @brief A replacement GPU memory mapping for use with ADRENOTOOLS_DRIVER_GPU_MAPPING_IMPORT
+ */
+struct adrenotools_gpu_mapping {
+    void *host_ptr;
+    uint64_t gpu_addr; //!< The GPU address of the mapping to import, if mapping import/init succeeds this will be set to ADRENOTOOLS_GPU_MAPPING_SUCCEEDED_MAGIC
+    uint64_t size;
+    uint64_t flags;
+};
@@ -0,0 +1,19 @@
+cmake_minimum_required(VERSION 3.14)
+
+if(NOT ${CMAKE_ANDROID_ARCH_ABI} STREQUAL arm64-v8a)
+	message(FATAL_ERROR "Unsupported target architecture: ${CMAKE_ANDROID_ARCH_ABI}. Please make an issue on the repo!")
+endif()
+
+project(linkernsbypass LANGUAGES CXX)
+
+set(SOURCES android_linker_ns.cpp
+            android_linker_ns.h
+            elf_soname_patcher.cpp
+            elf_soname_patcher.h)
+
+add_library(linkernsbypass STATIC ${SOURCES})
+
+
+target_compile_options(linkernsbypass PRIVATE -Wall -Wextra)
+target_link_libraries(linkernsbypass android dl)
+target_include_directories(linkernsbypass PUBLIC .)
@@ -0,0 +1,24 @@
+BSD 2-Clause License
+
+Copyright (c) 2021, Billy Laws
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@@ -0,0 +1,9 @@
+### Android Linker Namespace Bypass Library
+Provides access to the hidden linker namespace functionality in Android 9+ and exposes an interface for hooking libraries similar to a runtime equivalent of `LD_PRELOAD`.  
+See the `android_linker_ns.h` header for an API reference.
+
+#### Support
+Android 9+  
+Arm64  
+  
+Android 8 and arm32 could be supported with some trivial changes, feel free to open an issue if you have a use for this library on either of them.
@@ -0,0 +1,192 @@
+// SPDX-License-Identifier: BSD-2-Clause
+// Copyright © 2021 Billy Laws
+
+#include <array>
+#include <cstdio>
+#include <cstdlib>
+#include <errno.h>
+#include <dlfcn.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <android/dlext.h>
+#include <android/log.h>
+#include <android/api-level.h>
+#include <sys/mman.h>
+#include "elf_soname_patcher.h"
+#include "android_linker_ns.h"
+
+using loader_android_create_namespace_t = android_namespace_t *(*)(const char *, const char *, const char *, uint64_t, const char *, android_namespace_t *, const void *);
+static loader_android_create_namespace_t loader_android_create_namespace;
+
+static bool lib_loaded;
+
+
+/* Public API */
+bool linkernsbypass_load_status() {
+    return lib_loaded;
+}
+
+struct android_namespace_t *android_create_namespace(const char *name,
+                                                     const char *ld_library_path,
+                                                     const char *default_library_path,
+                                                     uint64_t type,
+                                                     const char *permitted_when_isolated_path,
+                                                     android_namespace_t *parent_namespace) {
+    auto caller{__builtin_return_address(0)};
+    return loader_android_create_namespace(name, ld_library_path, default_library_path, type,
+                                           permitted_when_isolated_path, parent_namespace, caller);
+}
+
+struct android_namespace_t *android_create_namespace_escape(const char *name,
+                                                            const char *ld_library_path,
+                                                            const char *default_library_path,
+                                                            uint64_t type,
+                                                            const char *permitted_when_isolated_path,
+                                                            android_namespace_t *parent_namespace) {
+    auto caller{reinterpret_cast<void *>(&dlopen)};
+    return loader_android_create_namespace(name, ld_library_path, default_library_path, type,
+                                           permitted_when_isolated_path, parent_namespace, caller);
+}
+
+android_get_exported_namespace_t android_get_exported_namespace;
+
+android_link_namespaces_all_libs_t android_link_namespaces_all_libs;
+
+android_link_namespaces_t android_link_namespaces;
+
+bool linkernsbypass_link_namespace_to_default_all_libs(android_namespace_t *to) {
+    // Creating a shared namespace with the default parent will give a copy of the default namespace that we can actually access
+    // This is needed since there is no way to access a direct handle to the default namespace as it's not exported
+    static auto defaultNs{android_create_namespace_escape("default_copy", nullptr, nullptr, ANDROID_NAMESPACE_TYPE_SHARED, nullptr, nullptr)};
+    return android_link_namespaces_all_libs(to, defaultNs);
+}
+
+void *linkernsbypass_namespace_dlopen(const char *filename, int flags, android_namespace_t *ns) {
+    android_dlextinfo extInfo{
+        .flags = ANDROID_DLEXT_USE_NAMESPACE,
+        .library_namespace = ns
+    };
+
+    return android_dlopen_ext(filename, flags, &extInfo);
+}
+
+#ifndef __NR_memfd_create
+    #if defined(__aarch64__)
+        #define __NR_memfd_create 279
+    #else
+        #error Unsupported target architecture!
+    #endif
+#endif
+
+void *linkernsbypass_namespace_dlopen_unique(const char *libPath, const char *libTargetDir, int flags, android_namespace_t *ns) {
+    static std::array<char, PATH_MAX> PathBuf{};
+
+    // Used as a unique ID for overwriting soname and creating target lib files
+    static uint16_t TargetId{};
+
+    int libTargetFd{[&] () {
+        if (libTargetDir) {
+            snprintf(PathBuf.data(), PathBuf.size(), "%s/%d_patched.so", libTargetDir, TargetId);
+            return open(PathBuf.data(), O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
+        } else {
+            // If memfd isn't supported errno will contain ENOSYS after calling
+            errno = 0;
+            int fd{static_cast<int>(syscall(__NR_memfd_create, libPath, 0))};
+            if (errno == ENOSYS || fd < 0)
+                return -1;
+            else
+                return fd;
+        }
+    }()};
+    if (libTargetFd == -1)
+        return nullptr;
+
+    // Partially overwrite soname with 3 digits (replacing lib...) with to make sure a cached so isn't loaded
+    std::array<char, 3> sonameOverwrite{};
+    snprintf(sonameOverwrite.data(), sonameOverwrite.size(), "%03u", TargetId++);
+
+    if (!elf_soname_patch(libPath, libTargetFd, sonameOverwrite.data()))
+        return nullptr;
+
+    // Load our patched library into the hook namespace
+    android_dlextinfo hookExtInfo{
+        .flags = ANDROID_DLEXT_USE_NAMESPACE | ANDROID_DLEXT_USE_LIBRARY_FD,
+        .library_fd = libTargetFd,
+        .library_namespace = ns
+    };
+
+    // Make a path that looks about right
+    snprintf(PathBuf.data(), PathBuf.size(), "/proc/self/fd/%d", libTargetFd);
+
+    return android_dlopen_ext(PathBuf.data(), flags, &hookExtInfo);
+}
+
+static void *align_ptr(void *ptr) {
+    return reinterpret_cast<void *>(reinterpret_cast<uintptr_t>(ptr) & ~(getpagesize() - 1));
+}
+
+/* Private */
+__attribute__((constructor)) static void resolve_linker_symbols() {
+    using loader_dlopen_t = void *(*)(const char *, int, const void *);
+
+    if (android_get_device_api_level() < 28)
+        return;
+
+    // ARM64 specific function walking to locate the internal dlopen handler
+    auto loader_dlopen{[]() {
+        union BranchLinked {
+            uint32_t raw;
+
+            struct {
+                int32_t offset : 26; //!< 26-bit branch offset
+                uint8_t sig : 6;  //!< 6-bit signature
+            };
+
+            bool Verify() {
+                return sig == 0x25;
+            }
+        };
+        static_assert(sizeof(BranchLinked) == 4, "BranchLinked is wrong size");
+
+        // Some devices ship with --X mapping for exexecutables so work around that
+        mprotect(align_ptr(reinterpret_cast<void *>(&dlopen)), getpagesize(), PROT_WRITE | PROT_READ | PROT_EXEC);
+
+        // dlopen is just a wrapper for __loader_dlopen that passes the return address as the third arg hence we can just walk it to find __loader_dlopen
+        auto blInstr{reinterpret_cast<BranchLinked *>(&dlopen)};
+        while (!blInstr->Verify())
+            blInstr++;
+
+        return reinterpret_cast<loader_dlopen_t>(blInstr + blInstr->offset);
+    }()};
+
+    // Protect the loader_dlopen function to remove the BTI attribute (since this is an internal function that isn't intended to be jumped indirectly to)
+    mprotect(align_ptr(reinterpret_cast<void *>(&loader_dlopen)), getpagesize(), PROT_WRITE | PROT_READ | PROT_EXEC);
+
+    // Passing dlopen as a caller address tricks the linker into using the internal unrestricted namespace letting us access libraries that are normally forbidden in the classloader namespace imposed on apps
+    auto ldHandle{loader_dlopen("ld-android.so", RTLD_LAZY, reinterpret_cast<void *>(&dlopen))};
+    if (!ldHandle)
+        return;
+
+    android_link_namespaces_all_libs = reinterpret_cast<android_link_namespaces_all_libs_t>(dlsym(ldHandle, "__loader_android_link_namespaces_all_libs"));
+    if (!android_link_namespaces_all_libs)
+        return;
+
+    android_link_namespaces = reinterpret_cast<android_link_namespaces_t>(dlsym(ldHandle, "__loader_android_link_namespaces"));
+    if (!android_link_namespaces)
+        return;
+
+    auto libdlAndroidHandle{loader_dlopen("libdl_android.so", RTLD_LAZY, reinterpret_cast<void *>(&dlopen))};
+    if (!libdlAndroidHandle)
+        return;
+
+    loader_android_create_namespace = reinterpret_cast<loader_android_create_namespace_t>(dlsym(libdlAndroidHandle, "__loader_android_create_namespace"));
+    if (!loader_android_create_namespace)
+        return;
+
+    android_get_exported_namespace = reinterpret_cast<android_get_exported_namespace_t>(dlsym(libdlAndroidHandle, "__loader_android_get_exported_namespace"));
+    if (!android_get_exported_namespace)
+        return;
+
+    // Lib is now safe to use
+    lib_loaded = true;
+}
@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: BSD-2-Clause
+// Copyright © 2021 Billy Laws
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stdint.h>
+
+// https://cs.android.com/android/platform/superproject/+/0a492a4685377d41fef2b12e9af4ebfa6feef9c2:art/libnativeloader/include/nativeloader/dlext_namespaces.h;l=25;bpv=1;bpt=1
+enum {
+  ANDROID_NAMESPACE_TYPE_REGULAR = 0,
+  ANDROID_NAMESPACE_TYPE_ISOLATED = 1,
+  ANDROID_NAMESPACE_TYPE_SHARED = 2,
+  ANDROID_NAMESPACE_TYPE_EXEMPT_LIST_ENABLED = 0x08000000,
+  ANDROID_NAMESPACE_TYPE_ALSO_USED_AS_ANONYMOUS = 0x10000000,
+  ANDROID_NAMESPACE_TYPE_SHARED_ISOLATED = ANDROID_NAMESPACE_TYPE_SHARED | ANDROID_NAMESPACE_TYPE_ISOLATED,
+};
+
+/**
+ * @brief Checks if linkernsbypass loaded successfully and is safe to use
+ * @note IMPORTANT: This should be called before any calls to the rest of the library are made
+ * @return true if loading succeeded
+ */
+bool linkernsbypass_load_status();
+
+// https://cs.android.com/android/platform/superproject/+/0a492a4685377d41fef2b12e9af4ebfa6feef9c2:art/libnativeloader/include/nativeloader/dlext_namespaces.h;l=86;bpv=1;bpt=1
+struct android_namespace_t *android_create_namespace(const char *name,
+                                                     const char *ld_library_path,
+                                                     const char *default_library_path,
+                                                     uint64_t type,
+                                                     const char *permitted_when_isolated_path,
+                                                     struct android_namespace_t *parent_namespace);
+
+struct android_namespace_t *android_create_namespace_escape(const char *name,
+                                                            const char *ld_library_path,
+                                                            const char *default_library_path,
+                                                            uint64_t type,
+                                                            const char *permitted_when_isolated_path,
+                                                            struct android_namespace_t *parent_namespace);
+
+// https://cs.android.com/android/platform/superproject/+/dcb01ef31026b3b8aeb72dada3370af63fe66bbd:bionic/linker/linker.cpp;l=3554
+typedef struct android_namespace_t *(*android_get_exported_namespace_t)(const char *);
+extern android_get_exported_namespace_t android_get_exported_namespace;
+
+// https://cs.android.com/android/platform/superproject/+/dcb01ef31026b3b8aeb72dada3370af63fe66bbd:bionic/linker/linker.cpp;l=2499
+typedef bool (*android_link_namespaces_all_libs_t)(struct android_namespace_t *, struct android_namespace_t *);
+extern android_link_namespaces_all_libs_t android_link_namespaces_all_libs;
+
+// https://cs.android.com/android/platform/superproject/+/dcb01ef31026b3b8aeb72dada3370af63fe66bbd:bionic/linker/linker.cpp;l=2473
+typedef bool (*android_link_namespaces_t)(struct android_namespace_t *, struct android_namespace_t *, const char *);
+extern android_link_namespaces_t android_link_namespaces;
+
+/**
+ * @brief Like android_link_namespaces_all_libs but links from the default namespace
+ */
+bool linkernsbypass_link_namespace_to_default_all_libs(struct android_namespace_t *to);
+
+/**
+ * @brief Loads a library into a namespace
+ * @note IMPORTANT: If `filename` is compiled with the '-z global' linker flag and RTLD_GLOBAL is supplied in `flags` the library will be added to the namespace's LD_PRELOAD list
+ * @param filename The name of the library to load
+ * @param flags The rtld flags for `filename`
+ * @param ns The namespace to dlopen into
+ */
+void *linkernsbypass_namespace_dlopen(const char *filename, int flags, struct android_namespace_t *ns);
+
+/**
+ * @brief Force loads a unique instance of a library into a namespace
+ * @param libPath The path to the library to load with hooks applied
+ * @param libTargetDir A temporary directory to hold the soname patched library at `libPath`, will attempt to use memfd if nullptr
+ * @param flags The rtld flags for `libName`
+ * @param ns The namespace to dlopen into
+ */
+void *linkernsbypass_namespace_dlopen_unique(const char *libPath, const char *libTargetDir, int flags, struct android_namespace_t *ns);
+
+#ifdef __cplusplus
+}
+#endif
@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: BSD-2-Clause
+// Copyright © 2021 Billy Laws
+
+#include <initializer_list>
+#include <cstdint>
+#include <errno.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <link.h>
+#include <elf.h>
+#include "elf_soname_patcher.h"
+
+bool elf_soname_patch(const char *libPath, int targetFd, const char *sonamePatch) {
+    struct stat libStat{};
+    if (stat(libPath, &libStat))
+        return false;
+
+    if (ftruncate(targetFd, libStat.st_size) == -1)
+        return false;
+
+    // Map the memory so we can read our elf into it
+    auto mappedLib{reinterpret_cast<uint8_t *>(mmap(nullptr, libStat.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, targetFd, 0))};
+    if (!mappedLib)
+        return false;
+
+    int libFd{open(libPath, O_RDONLY)};
+    if (libFd == false)
+        return false;
+
+    // Read lib elf into target file
+    if (read(libFd, mappedLib, libStat.st_size) != libStat.st_size)
+        return false;
+
+    // No longer needed
+    close(libFd);
+
+    auto eHdr{reinterpret_cast<ElfW(Ehdr) *>(mappedLib)};
+    auto sHdrEntries{reinterpret_cast<ElfW(Shdr) *>(mappedLib + eHdr->e_shoff)};
+
+    // Iterate over section headers to find the .dynamic section
+    for (ElfW(Half) i{}; i < eHdr->e_shnum; i++) {
+        auto &sHdr{sHdrEntries[i]};
+        if (sHdr.sh_type == SHT_DYNAMIC) {
+            auto strTab{reinterpret_cast<char *>(mappedLib + sHdrEntries[sHdr.sh_link].sh_offset)};
+            auto dynHdrEntries{reinterpret_cast<ElfW(Dyn) *>(mappedLib + sHdr.sh_offset)};
+
+            // Iterate over .dynamic entries to find DT_SONAME
+            for (ElfW(Xword) k{}; k < (sHdr.sh_size / sHdr.sh_entsize); k++) {
+                auto &dynHdrEntry{dynHdrEntries[k]};
+                if (dynHdrEntry.d_tag == DT_SONAME) {
+                    char *soname{strTab + dynHdrEntry.d_un.d_val};
+
+                    // Partially replace the old soname with the soname patch
+                    size_t charIdx{};
+                    for (; soname[charIdx] != 0 && sonamePatch[charIdx] != 0; charIdx++)
+                        soname[charIdx] = sonamePatch[charIdx];
+
+                    return true;
+                }
+            }
+        }
+    }
+
+    return false;
+}
@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: BSD-2-Clause
+// Copyright © 2021 Billy Laws
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief  Overwrites a portion of the soname in an elf by loading it into shared memory and modifying .dynstr
+ * @note   IMPORTANT: The supplied soname patch will overwrite the first strlen(sonamePatch) chars of the soname
+ * @param  elfPath Full path to the elf to patch
+ * @param  targetFd FD to use for storing the patched library
+ * @return True on success
+ */
+bool elf_soname_patch(const char *elfPath, int targetFd, const char *newSoname);
+
+#ifdef __cplusplus
+}
+#endif
@@ -0,0 +1,18 @@
+linkernsbypass_files = files(['android_linker_ns.cpp', 'android_linker_ns.h', 'elf_soname_patcher.cpp', 'elf_soname_patcher.h'])
+linkernsbypass_inc = include_directories('.')
+
+libdl_dep = cpp.find_library('dl')
+
+linkernsbypass_lib = static_library (
+    'linkernsbypass',
+    linkernsbypass_files,
+    c_args: (['-Wall', '-Wextra']),
+    cpp_args: (['-Wall', '-Wextra']),
+    include_directories: ([linkernsbypass_inc, adrenotools_inc]),
+    dependencies: ([libandroid_dep, libdl_dep])
+)
+
+# linkernsbypass_include = static_library('linkernsbypass', sources)
+# target_compile_options(['linkernsbypass', 'PRIVATE', '-Wall', '-Wextra'])
+# target_link_libraries(['linkernsbypass', 'android', 'dl'])
+# target_include_directories(['linkernsbypass', 'PUBLIC', '.'])