release.py rewrites each crate's `version = "..."` in Cargo.toml but never
touched Cargo.lock, so the lock kept the previous version. The first
`cargo build` in CI then rewrote the lock to match, dirtying the working tree —
and get_build_version()'s `git describe --dirty` stamped every artifact
"X.Y.Z-dirty" (that's why the v1.1.0 KPM/Ports/etc. modules report 1.1.0-dirty).
Two layers so it cannot recur:
- release.py now runs `cargo update --offline --workspace` for both lockfiles
after the Cargo.toml bump, so the release commit carries a matching lock.
- The Rust build steps (activator, zygisk cdylib, lsposed probe) pass --locked,
so a drifted lock fails the build loudly instead of silently rewriting it.
Also commits the now-synced 1.1.0 lockfiles.
Two related changes that ship together because they touch the same
build-script + docs surface and were verified together on-device.
16 KiB alignment
- zygisk/build.rs: pass `-Wl,-z,max-page-size=16384` to lld so the
cdylib's LOAD segments line up on 16 KiB pages. NDK r28+ already
does this by default, but the flag keeps r27 builds compatible.
- lsposed/native/build.rs: new file, same flag, for libvpnhide_checks.so.
- docs/development.md: bumped the NDK requirement to r28+ and noted
the 16 KiB rationale.
Verified via `llvm-readelf -l`: both libvpnhide_zygisk.so and
libvpnhide_checks.so now show `Align 0x4000` on every LOAD segment.
Unified build entry points
- kmod/build.py replaces kmod/build-zip.py. Single script that
auto-detects whether to build natively (we're inside the DDK image
or `--kdir` was passed) or to spawn `ghcr.io/ylarod/ddk-min` via
podman/docker. CI uses the same script with `--inside-container`.
- zygisk/build-zip.py renamed to zygisk/build.py for symmetry; logic
unchanged.
- kmod/BUILDING.md rewritten — local build is now one command:
`./kmod/build.py --kmi android14-6.1` (or `--all`). The old
hand-rolled podman/docker recipes are gone.
- .github/workflows/ci.yml updated to call the new entry points.
The DDK image tag in CI now has a comment pointing at
`DDK_IMAGE_TAG` in kmod/build.py as the source of truth.
- README.{md,en.md}, kmod/README.md, zygisk/README.md, docs/releasing.md,
scripts/build_lib.py: reference updates.
- README.en.md: also fixes a "bacame" typo and tightens the Windows
zygisk-build note (the aux.rs / libgit2 issue is still real).
Verified end-to-end on Pixel 8 Pro (husky, android14-6.1, Android 16):
APK installs, kmod + zygisk modules load, all 26 self-checks PASS in
Enforcing, 22/26 PASS in Permissive (the same 4 by-design FAILs as
before — kmod doesn't cover those paths in Permissive).
Follow-up to #83. Five small fixes I caught while reviewing:
- build_lib: spell out the stdlib-only invariant in the module docstring.
build-version.py is called from app/build.gradle.kts on every Gradle
build, so adding pip/uv deps here would break the APK build.
- build_lib: drop unused get_python_exe() (no callers anywhere).
- build_lib: add version_sort_key() and use it in zygisk and kmod for
NDK / clang auto-detection. The previous lexicographic sorted() picked
the wrong directory when major versions span different digit widths
(e.g. 100.0.0 < 25.0.1, clang-r9 sorting after clang-r498344b).
zygisk/build-zip.sh used `sort -V` before the python port, so this is
a regression fix; kmod is a new safety net (DDK containers ship one
clang today, but auto-detect should still be correct).
- kmod/build-zip.py: drop the manual mtime check before `make strip`.
The check only watched vpnhide_kmod.c, so edits to the Makefile,
kernel headers, or .config wouldn't trigger a rebuild. Let make's own
dependency tracking decide.
- build_lib: minor cleanup — hoist `import subprocess` to the top of
the module instead of importing it inside get_build_version().
