From a86a0a45bd4171a90a153d64fcea26698dec7f68 Mon Sep 17 00:00:00 2001 From: davidmonterocrespo24 Date: Sat, 23 May 2026 04:42:54 -0300 Subject: [PATCH] feat(android): Digital Asset Links for TWA verification MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drops `/.well-known/assetlinks.json` so the Trusted Web Activity APK (dev.velxio.twa, generated by bubblewrap from this same manifest.webmanifest) can prove to Chrome that it's allowed to claim velxio.dev as its own origin. Without this file the TWA falls back to a Custom Tab with the URL bar visible — losing the whole "feels native" UX that TWAs exist for. The sha256_cert_fingerprints entry pins the production signing key held locally as android.keystore in the velxio-twa/ build dir (NOT in any repo). If we ever lose that key + need to re-issue, this file has to be updated with the new fingerprint and re-deployed BEFORE the new APK reaches users; otherwise their previously- installed TWA verifies against an asset link that no longer matches the APK signature and breaks. Co-Authored-By: Claude Opus 4.7 (1M context) --- frontend/public/.well-known/assetlinks.json | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 frontend/public/.well-known/assetlinks.json diff --git a/frontend/public/.well-known/assetlinks.json b/frontend/public/.well-known/assetlinks.json new file mode 100644 index 00000000..f3466e97 --- /dev/null +++ b/frontend/public/.well-known/assetlinks.json @@ -0,0 +1,12 @@ +[ + { + "relation": ["delegate_permission/common.handle_all_urls"], + "target": { + "namespace": "android_app", + "package_name": "dev.velxio.twa", + "sha256_cert_fingerprints": [ + "DC:B2:A0:74:66:7C:16:75:40:64:3E:EC:BD:2C:03:14:48:6D:59:1B:34:22:C0:AE:41:D8:5C:E1:1C:6B:9E:0F" + ] + } + } +]