Bump version to 4.41.2

Have to be careful with pre-21 devices. You have to use specific
compat loading methods with VectorDrawables or it'll crash.

.gitignore

@@ -8,7 +8,6 @@ gen/
 *.iml
 out
 tests
-lint.xml
 local.properties
 ant.properties
 .DS_Store

AndroidManifest.xml

@@ -174,6 +174,22 @@
 
     </activity>
 
+    <activity android:name=".stickers.StickerPackPreviewActivity"
+              android:theme="@style/TextSecure.LightNoActionBar"
+              android:launchMode="singleTask"
+              android:noHistory="true"
+              android:windowSoftInputMode="stateHidden"
+              android:configChanges="touchscreen|keyboard|keyboardHidden|orientation|screenLayout|screenSize">
+        <intent-filter>
+            <action android:name="android.intent.action.VIEW" />
+            <category android:name="android.intent.category.DEFAULT" />
+            <category android:name="android.intent.category.BROWSABLE" />
+            <data android:scheme="sgnl"
+                  android:host="addstickers" />
+        </intent-filter>
+    </activity>
+
+
     <activity android:name=".ConversationListActivity"
               android:label="@string/app_name"
               android:launchMode="singleTask"
@@ -318,6 +334,12 @@
               android:windowSoftInputMode="stateUnchanged"
               android:configChanges="touchscreen|keyboard|keyboardHidden|orientation|screenLayout|screenSize"/>
 
+    <activity android:name=".stickers.StickerManagementActivity"
+              android:launchMode="singleTask"
+              android:theme="@style/TextSecure.LightTheme"
+              android:windowSoftInputMode="stateUnchanged"
+              android:configChanges="touchscreen|keyboard|keyboardHidden|orientation|screenLayout|screenSize"/>
+
      <activity android:name=".DeviceActivity"
                android:label="@string/AndroidManifest__linked_devices"
                android:configChanges="touchscreen|keyboard|keyboardHidden|orientation|screenLayout|screenSize"/>
@@ -579,11 +601,13 @@
               android:authorities="org.thoughtcrime.securesms.database.attachment"
               android:exported="false" />
 
-    <provider
-              android:name="androidx.work.impl.WorkManagerInitializer"
-              android:authorities="${applicationId}.workmanager-init"
-              android:exported="false"
-              tools:node="remove" />
+    <provider android:name=".database.DatabaseContentProviders$Sticker"
+              android:authorities="org.thoughtcrime.securesms.database.sticker"
+              android:exported="false" />
+
+    <provider android:name=".database.DatabaseContentProviders$StickerPack"
+              android:authorities="org.thoughtcrime.securesms.database.stickerpack"
+              android:exported="false" />
 
     <receiver android:name=".service.BootReceiver">
         <intent-filter>

ReproducibleBuilds.md

@@ -0,0 +1,287 @@
+# Reproducible Builds
+
+
+## TL;DR
+
+You can just use these [instructions](https://signal.org/blog/reproducible-android/) from the official announcement at Open Whisper Systems's blog:
+```
+# Clone the Signal Android source repository
+$ git clone https://github.com/signalapp/Signal-Android.git && cd Signal-Android
+
+# Check out the release tag for the version you'd like to compare
+$ git checkout v[the version number]
+
+# Build using the Docker environment
+$ docker run --rm -v $(pwd):/project -w /project whispersystems/signal-android:1.3 ./gradlew clean assembleRelease
+
+# Verify the APKs
+$ python3 apkdiff/apkdiff.py build/outputs/apks/project-release-unsigned.apk path/to/SignalFromPlay.apk
+```
+
+Note that the instructions above use a pre-built Signal Docker image from [Docker Hub](https://hub.docker.com/u/whispersystems/). If you wish to compile the image yourself, continue reading the longer version below.
+
+
+***
+
+
+## Introduction
+
+Since version 3.15.0 Signal for Android has supported reproducible builds. This is achieved by replicating the build environment as a Docker image. You'll need to build the image, run a container instance of it, compile Signal inside the container and finally compare the resulted APK to the APK that is distributed in the Google Play Store.
+
+The command line parts in this guide are written for Linux but with some little modifications you can adapt them to macOS (OS X) and Windows. In the following sections we will use `3.15.2` as an example Signal version. You'll just need to replace all occurrences of `3.15.2` with the version number you are about to verify.
+
+
+## Setting up directories
+
+First let's create a new directory for this whole reproducible builds project. In your home folder (`~`), create a new directory called `reproducible-signal`.
+```
+user@host:$ mkdir ~/reproducible-signal
+```
+
+Next create another directory inside `reproducible-signal` called `apk-from-google-play-store`.
+```
+user@host:$ mkdir ~/reproducible-signal/apk-from-google-play-store
+```
+
+We will use this directory to share APKs between the host OS and the Docker container.
+
+Finally create one more directory inside `reproducible-signal` called `image-build-context`.
+```
+user@host:$ mkdir ~/reproducible-signal/image-build-context
+```
+
+This directory will be used later to build our Docker image.
+
+
+## Getting the Google Play Store version of Signal APK
+
+To compare the APKs we of course need a version of Signal from the Google Play Store.
+
+First make sure that the Signal version you want to verify is installed on your Android device. You'll need `adb` for this part.
+
+Plug your device to your computer and run this command to pull the APK from the device:
+
+```
+user@host:$ adb pull $(adb shell pm path org.thoughtcrime.securesms | grep /base.apk | awk -F':' '{print $2}') ~/reproducible-signal/apk-from-google-play-store/Signal-$(adb shell dumpsys package org.thoughtcrime.securesms | grep versionName | awk -F'=' '{print $2}').apk
+```
+
+This will pull a file into `~/reproducible-signal/apk-from-google-play-store/` with the name `Signal-<version>.apk`
+
+Alternatively, you can do this step-by-step:
+
+```
+user@host:$ adb shell pm path org.thoughtcrime.securesms
+```
+This will output something like:
+```
+package:/data/app/org.thoughtcrime.securesms-aWRzcGlzcG9wZA==/base.apk
+```
+
+The output will tell you where the Signal APK is located in your device. (In this example the path is `/data/app/org.thoughtcrime.securesms-aWRzcGlzcG9wZA==/base.apk`)
+
+Now using this information, pull the APK from your device to the `reproducible-signal/apk-from-google-play-store` directory you created before:
+```
+user@host:$ adb pull \
+              /data/app/org.thoughtcrime.securesms-aWRzcGlzcG9wZA==/base.apk \
+              ~/reproducible-signal/apk-from-google-play-store/Signal-3.15.2.apk
+```
+
+We will use this APK in the final part when we compare it with the self-built APK from GitHub.
+
+## Identifying the ABI
+
+Since v4.37.0, the APKs have been split by ABI, the CPU architecture of the target device. Google play will serve the correct one to you for your device.
+
+To identify which ABIs the google play APK supports, we can look inside the APK, which is just a zip file:
+
+```
+user@host:$ unzip -l ~/reproducible-signal/apk-from-google-play-store/Signal-*.apk | grep lib/
+```
+
+Example:
+
+```
+  1214348  00-00-1980 00:00   lib/armeabi-v7a/libconscrypt_jni.so
+   151980  00-00-1980 00:00   lib/armeabi-v7a/libcurve25519.so
+  4164320  00-00-1980 00:00   lib/armeabi-v7a/libjingle_peerconnection_so.so
+    13948  00-00-1980 00:00   lib/armeabi-v7a/libnative-utils.so
+  2357812  00-00-1980 00:00   lib/armeabi-v7a/libsqlcipher.so
+```
+
+As there is just one sub directory of `lib/` called `armeabi-v7a`, that is your ABI. Make a note of that for later. If you see more than one subdirectory of `lib/`:
+
+```
+  1214348  00-00-1980 00:00   lib/armeabi-v7a/libconscrypt_jni.so
+   151980  00-00-1980 00:00   lib/armeabi-v7a/libcurve25519.so
+  4164320  00-00-1980 00:00   lib/armeabi-v7a/libjingle_peerconnection_so.so
+    13948  00-00-1980 00:00   lib/armeabi-v7a/libnative-utils.so
+  2357812  00-00-1980 00:00   lib/armeabi-v7a/libsqlcipher.so
+  2111376  00-00-1980 00:00   lib/x86/libconscrypt_jni.so
+   201056  00-00-1980 00:00   lib/x86/libcurve25519.so
+  7303888  00-00-1980 00:00   lib/x86/libjingle_peerconnection_so.so
+     5596  00-00-1980 00:00   lib/x86/libnative-utils.so
+  3977636  00-00-1980 00:00   lib/x86/libsqlcipher.so
+```
+
+Then that means you have the `universal` APK.
+
+## Installing Docker
+
+Install Docker by following the instructions for your platform at https://docs.docker.com/engine/installation/
+
+Your platform might also have its own preferred way of installing Docker. E.g. Ubuntu has its own Docker package (`docker.io`) if you do not want to follow Docker's instructions.
+
+In the following sections we will assume that your Docker installation works without issues. So after installing, please make sure that everything is running smoothly before continuing.
+
+
+## Building a Docker image for Signal
+
+#### Grabbing the `Dockerfile`
+
+First you will need the `Dockerfile` for Signal Android. It comes bundled with Signal's source code. The `Dockerfile` contains instructions on how to automatically build a Docker image for Signal. You just need to run it and it builds itself.
+
+Download the `Dockerfile` to the `image-build-context` directory.
+
+```
+user@host:$ wget -O ~/reproducible-signal/image-build-context/Dockerfile_v3.15.2 \
+                    https://raw.githubusercontent.com/signalapp/Signal-Android/v3.15.2/Dockerfile
+```
+
+Note that the `Dockerfile` is specific to the Signal version you want to compare to. Again you have to adjust the URL above to match the right version. (Though sometimes the file might not be up to date, see the [Troubleshooting section](#troubleshooting))
+
+
+#### Building the image
+
+Now we have everything we need to build the Docker image for Signal. Go to the `image-build-context` directory:
+
+```
+user@host:$ cd ~/reproducible-signal/image-build-context
+```
+
+And list the contents.
+```
+user@host:$ ls
+```
+The output should look like this:
+```
+Dockerfile_v3.15.2
+```
+
+Now in this directory build the image using `Dockerfile_v3.15.2`:
+```
+user@host:$ docker build --file Dockerfile_v3.15.2 --tag signal-android .
+```
+
+(Note that there is a dot at the end of that command!)
+
+Wait a few years for the build to finish... :construction_worker:
+
+(Depending on your computer and network connection, this may take several minutes.)
+
+:calendar: :sleeping:
+
+After the build has finished, you may wish to list all your Docker images to see that it's really there:
+```
+user@host:$ docker images
+```
+Output should look something like this:
+```
+REPOSITORY          TAG                 IMAGE ID            CREATED             VIRTUAL SIZE
+signal-android      latest              c6b84450b896        46 seconds ago      2.94 GB
+ubuntu              14.04.3             8693db7e8a00        9 weeks ago         187.9 MB
+```
+
+
+## Compiling Signal inside a container
+
+Next we will run a container of the image we just built, grab Signal's source code and compile Signal.
+
+First go to the `reproducible-signal` directory:
+
+```
+user@host:$ cd ~/reproducible-signal/
+```
+
+To run a new ephemeral container with an interactive terminal session execute the following long command:
+```
+user@host:$ docker run \
+              --name signal \
+              --rm \
+              --interactive \
+              --tty \
+              --volume $(pwd)/apk-from-google-play-store:/signal-build/apk-from-google-play-store \
+              --workdir /signal-build \
+              signal-android
+```
+Now you are inside the container.
+
+Grab Signal's source code from GitHub and go to the repository directory:
+```
+root@container:# git clone https://github.com/signalapp/Signal-Android.git
+root@container:# cd Signal-Android
+```
+
+Before you can compile, you **must** ensure that you are at the right commit. In other words you **must** checkout the version you wish to verify (here we are verifying 3.15.2):
+```
+root@container:# git checkout --quiet v3.15.2
+```
+
+Now you may compile the release APK by running:
+```
+root@container:# ./gradlew clean assemblePlayRelease --exclude-task signProductionPlayRelease
+```
+This will take a few minutes :sleeping:
+
+
+#### Checking if the APKs match
+
+After the build has completed successfully we can finally compare if the APKs match. For the comparison we need of course the Google Play Store version of Signal APK which you copied to the `apk-from-google-play-store` directory in the beginning of this guide. Because we used that directory as a `--volume` parameter for our container, we can see all the files in that directory within our container.
+
+So now we can compare the APKs using the `apkdiff.py` tool.
+
+The above build step produced several APKs, one for each supported ABI and one universal one. You will need to determine the correct APK to compare.
+
+Currently, the most common ABI is `armeabi-v7a`. Other options at this time include `x86` and `universal`. In the future it will also include 64-bit options, such as `x86_64` and `arm64-v8a`.
+
+See [Identifying the ABI](#identifying-the-abi) above if you don't know the ABI of your play store APK.
+
+Once you have determined the ABI, add an `abi` environment variable. For example, suppose we determine that `armeabi-v7a` is the ABI google play has served:
+
+```
+root@container:# export abi=armeabi-v7a
+```
+
+And the diff script to compare:
+```
+root@container:# python3 apkdiff/apkdiff.py \
+                   build/outputs/apk/play/release/*play-$abi-release-unsigned*.apk \
+                   ../apk-from-google-play-store/Signal-3.15.2.apk
+```
+Output:
+```
+APKs match!
+```
+
+If you get `APKs match!`, you have successfully verified that the Google Play release matches with your own self-built version of Signal. Congratulations! Your APKs are a match made in heaven! :sparkles:
+
+If you get `APKs don't match!`, you did something wrong in the previous steps. See the [Troubleshooting section](#troubleshooting) for more info.
+
+
+## Comparing next time
+
+If the build environment (i.e. `Dockerfile`) has not changed, you don't need to build the image again to verify a newer APK. You can just [run the container again](#compiling-signal-inside-a-container).
+
+
+## Troubleshooting
+
+If you cannot get things to work, please do not open an issue or comment on an existing issue at GitHub. Instead, ask for help at https://community.signalusers.org/c/development
+
+Some common issues why things may not work:
+- some pinned packages in the `Dockerfile` are not available anymore and building of the Docker image fails
+- the Android packages in the Docker image are outdated and compiling Signal fails
+- you built the Docker image with a wrong version of the `Dockerfile`
+- you didn't checkout the correct Signal version tag with Git before compiling
+- the ABI you selected is not the correct ABI, particularly if you see an error along the lines of `Sorted manifests don't match, lib/x86/libcurve25519.so vs lib/armeabi-v7a/libcurve25519.so`.
+- this guide is outdated
+- you are in a dream
+- if you run into this issue: https://issuetracker.google.com/issues/110237303 try to add `resources.arsc` to the list of ignored files and compare again

apkdiff/apkdiff.py

@@ -1,20 +1,21 @@
-#! /usr/bin/env python
+#! /usr/bin/env python3
 
 import sys
 from zipfile import ZipFile
 
 class ApkDiff:
-
-    IGNORE_FILES = ["META-INF/CERT.RSA", "META-INF/CERT.SF", "META-INF/MANIFEST.MF"]
+    # resources.arsc is ignored due to https://issuetracker.google.com/issues/110237303
+    # May be fixed in Android Gradle Plugin 3.4
+    IGNORE_FILES = ["META-INF/MANIFEST.MF", "META-INF/SIGNAL_S.RSA", "META-INF/SIGNAL_S.SF", "resources.arsc"]
 
     def compare(self, sourceApk, destinationApk):
         sourceZip      = ZipFile(sourceApk, 'r')
         destinationZip = ZipFile(destinationApk, 'r')
 
         if self.compareManifests(sourceZip, destinationZip) and self.compareEntries(sourceZip, destinationZip) == True:
-            print "APKs match!"
+            print("APKs match!")
         else:
-            print "APKs don't match!"
+            print("APKs don't match!")
 
     def compareManifests(self, sourceZip, destinationZip):
         sourceEntrySortedList      = sorted(sourceZip.namelist())
@@ -23,23 +24,23 @@ class ApkDiff:
         for ignoreFile in self.IGNORE_FILES:
             while ignoreFile in sourceEntrySortedList: sourceEntrySortedList.remove(ignoreFile)
             while ignoreFile in destinationEntrySortedList: destinationEntrySortedList.remove(ignoreFile)
-                    
+
         if len(sourceEntrySortedList) != len(destinationEntrySortedList):
-            print "Manifest lengths differ!"
-        
+            print("Manifest lengths differ!")
+
         for (sourceEntryName, destinationEntryName) in zip(sourceEntrySortedList, destinationEntrySortedList):
             if sourceEntryName != destinationEntryName:
-                print "Sorted manifests don't match, %s vs %s" % (sourceEntryName, destinationEntryName)   
+                print("Sorted manifests don't match, %s vs %s" % (sourceEntryName, destinationEntryName))
                 return False
 
         return True
-            
+
     def compareEntries(self, sourceZip, destinationZip):
-        sourceInfoList      = filter(lambda sourceInfo: sourceInfo.filename not in self.IGNORE_FILES, sourceZip.infolist())
-        destinationInfoList = filter(lambda destinationInfo: destinationInfo.filename not in self.IGNORE_FILES, destinationZip.infolist())
-        
+        sourceInfoList      = list(filter(lambda sourceInfo: sourceInfo.filename not in self.IGNORE_FILES, sourceZip.infolist()))
+        destinationInfoList = list(filter(lambda destinationInfo: destinationInfo.filename not in self.IGNORE_FILES, destinationZip.infolist()))
+
         if len(sourceInfoList) != len(destinationInfoList):
-            print "APK info lists of different length!"
+            print("APK info lists of different length!")
             return False
 
         for sourceEntryInfo in sourceInfoList:
@@ -49,19 +50,19 @@ class ApkDiff:
                     destinationEntry = destinationZip.open(destinationEntryInfo, 'r')
 
                     if self.compareFiles(sourceEntry, destinationEntry) != True:
-                        print "APK entry %s does not match %s!" % (sourceEntryInfo.filename, destinationEntryInfo.filename)
+                        print("APK entry %s does not match %s!" % (sourceEntryInfo.filename, destinationEntryInfo.filename))
                         return False
 
                     destinationInfoList.remove(destinationEntryInfo)
                     break
-                
+
         return True
 
     def compareFiles(self, sourceFile, destinationFile):
         sourceChunk      = sourceFile.read(1024)
         destinationChunk = destinationFile.read(1024)
 
-        while sourceChunk != "" or destinationChunk != "":
+        while sourceChunk != b"" or destinationChunk != b"":
             if sourceChunk != destinationChunk:
                 return False
 
@@ -72,7 +73,7 @@ class ApkDiff:
 
 if __name__ == '__main__':
     if len(sys.argv) != 3:
-        print "Usage: apkdiff <pathToFirstApk> <pathToSecondApk>"
+        print("Usage: apkdiff <pathToFirstApk> <pathToSecondApk>")
         sys.exit(1)
 
     ApkDiff().compare(sys.argv[1], sys.argv[2])

build.gradle

@@ -11,7 +11,6 @@ buildscript {
     }
     dependencies {
         classpath 'com.android.tools.build:gradle:3.3.2'
-        classpath files('libs/gradle-witness.jar')
     }
 }
 
@@ -84,8 +83,12 @@ dependencies {
     compile 'com.google.android.exoplayer:exoplayer-core:2.9.1'
     compile 'com.google.android.exoplayer:exoplayer-ui:2.9.1'
 
-    compile 'org.whispersystems:signal-service-android:2.12.8'
-    compile 'org.whispersystems:webrtc-android:M73-S1'
+    compile 'org.conscrypt:conscrypt-android:2.0.0'
+    compile 'org.signal:aesgcmprovider:0.0.3'
+
+    compile 'org.whispersystems:signal-service-android:2.13.3'
+
+    compile 'org.whispersystems:webrtc-android:M74'
 
     compile "me.leolin:ShortcutBadger:1.1.16"
     compile 'se.emilsjolander:stickylistheaders:2.7.0'
@@ -158,6 +161,7 @@ dependencies {
 }
 
 dependencyVerification {
+    configuration = '(play|website)(Debug|Release)RuntimeClasspath'
     verify = [
         'com.android.support:design:7874ad1904eedc74aa41cffffb7f759d8990056f3bbbc9264911651c67c42f5f',
         'com.android.support:preference-v14:8133c6e19233fa51e036a341e6d3f4adeead3375cebf777efced0fe154c3267e',
@@ -184,8 +188,10 @@ dependencyVerification {
         'com.google.android.gms:play-services-auth:aec9e1c584d442cb9f59481a50b2c66dc191872607c04d97ecb82dd0eb5149ec',
         'com.google.android.exoplayer:exoplayer-ui:7a942afcc402ff01e9bf48e8d3942850986710f06562d50a1408aaf04a683151',
         'com.google.android.exoplayer:exoplayer-core:b6ab34abac36bc2bc6934b7a50008162feca2c0fde91aaf1e8c1c22f2c16e2c0',
-        'org.whispersystems:signal-service-android:68a349a9e05089f33ab5a9b9fc330526f59d31e8385ff9f5b70bc4a88bd0e297',
-        'org.whispersystems:webrtc-android:1ae3716728f2581724f982f5b4ded92d7aa33edf19d0daa35529d9529f8eb3a2',
+        'org.conscrypt:conscrypt-android:400ca559a49b860a82862b22cee0e3110764bdcf7ee7c79e7479895c25cdfc09',
+        'org.signal:aesgcmprovider:6eb4422e8a618b3b76cb2096a3619d251f9e27989dc68307a1e5414c3710f2d1',
+        'org.whispersystems:signal-service-android:ac6f2c70c4111f9f982bbfc9b34063834afdce31333405bec10506a31f0961cd',
+        'org.whispersystems:webrtc-android:2f7befaa3b47a04d244a4eef7c03c2d49c1685a6f92fc505cd5f4ac7eca2dc18',
         'me.leolin:ShortcutBadger:e3cb3e7625892129b0c92dd5e4bc649faffdd526d5af26d9c45ee31ff8851774',
         'se.emilsjolander:stickylistheaders:a08ca948aa6b220f09d82f16bbbac395f6b78897e9eeac6a9f0b0ba755928eeb',
         'com.jpardogo.materialtabstrip:library:c6ef812fba4f74be7dc4a905faa4c2908cba261a94c13d4f96d5e67e4aad4aaa',
@@ -251,8 +257,8 @@ dependencyVerification {
         'com.android.support:interpolator:7bc7ee86a0db39a4b51956f3e89842d2bd962118d57d779eb6ed6b34ba0677ea',
         'com.android.support:support-annotations:5d5b9414f02d3fa0ee7526b8d5ddae0da67c8ecc8c4d63ffa6cf91488a93b927',
         'com.android.support.constraint:constraint-layout-solver:2cafbe356f71c208013d021f32943904798cd6459e5107f9fe27000eb5bc2aef',
-        'org.signal:signal-metadata-android:d9d798aab7ee7200373ecff8718baf8aaeb632c123604e8a41b7b4c0c97eeee1',
-        'org.whispersystems:signal-service-java:fde1a008fe42ebbf1cd35018b363135cd8fec9e690304f8917b5ffb7080fa2a5',
+        'org.signal:signal-metadata-android:02323bc29317fa9d3b62fab0b507c94ba2e9bcc4a78d588888ffd313853757b3',
+        'org.whispersystems:signal-service-java:440777f4beca894f37b86258f1493fd5c2e87df02fb9a6331f0c82b842c91012',
         'com.github.bumptech.glide:disklrucache:c1b1b6f5bbd01e2fcdc9d7f60913c8d338bdb65ed4a93bfa02b56f19daaade4b',
         'com.github.bumptech.glide:annotations:bede99ef9f71517a4274bac18fd3e483e9f2b6108d7d6fe8f4949be4aa4d9512',
         'com.nineoldandroids:library:68025a14e3e7673d6ad2f95e4b46d78d7d068343aa99256b686fe59de1b3163a',
@@ -260,25 +266,32 @@ dependencyVerification {
         'com.klinkerapps:logger:177e325259a8b111ad6745ec10db5861723c99f402222b80629f576f49408541',
         'com.google.android:flexbox:a9989fd13ae2ee42765dfc515fe362edf4f326e74925d02a10369df8092a4935',
         'org.jsoup:jsoup:abeaf34795a4de70f72aed6de5966d2955ec7eb348eeb813324f23c999575473',
-        'org.whispersystems:signal-protocol-android:b41b7c3a47b0a4ce35802474ae7c5ddc8f033d80209e98abf7ec669543b2b3ee',
-        'org.signal:signal-metadata-java:af1d0dd766b1e301ed1c44e65161084cf03e2587fe97fdd29ecbea58c6aa6930',
-        'org.whispersystems:signal-protocol-java:b08207f7e1847228f2a1f0d49e113f93c96c6ed8490be14edddd4be55b2a4a4e',
+        'org.whispersystems:signal-protocol-android:c80aac5f93114da2810e2e89437831f79fcbc8bece652f64aeab313a651cba85',
+        'org.signal:signal-metadata-java:2ce71cc4ec5dacfbaef4a265fceef61b8a09696b541994106a22a946762cbdcc',
+        'org.whispersystems:signal-protocol-java:7f6df67a963acbab7716424b01b12fa7279f18a9623a2a7c8ba7b1c285830168',
         'com.google.protobuf:protobuf-java:e0c1c64575c005601725e7c6a02cebf9e1285e888f756b2a1d73ffa8d725cc74',
-        'com.googlecode.libphonenumber:libphonenumber:183392c0565be16d3f6f86680b4106bbde6fe31a402ad21bf9823d938c0c8706',
-        'com.fasterxml.jackson.core:jackson-databind:0fb4e079c118e752cc94c15ad22e6782b0dfc5dc09145f4813fb39d82e686047',
-        'com.squareup.okhttp3:okhttp:7265adbd6f028aade307f58569d814835cd02bc9beffb70c25f72c9de50d61c4',
-        'com.madgag.spongycastle:pkix:0d9cca6991f68eb373cfad309d5268c9fc38db5efb5fe00dcccf5c973af1eca1',
-        'com.madgag.spongycastle:prov:b8c3fec3a59aac1aa04ccf4dad7179351e54ef7672f53f508151b614c131398a',
+        'com.googlecode.libphonenumber:libphonenumber:dbf4bf566d17a60044c19e282a619684e4b4abb0f9f9f24f843c55d19826ab5e',
+        'com.fasterxml.jackson.core:jackson-databind:2351c3eba73a545db9079f5d6d768347ad72666537362c8220fe3e950a55a864',
+        'com.squareup.okhttp3:okhttp:07c3d82ca7eaf4722f00b2da807dc7860f6169ae60cfedcf5d40218f90880a46',
         'org.threeten:threetenbp:f4c23ffaaed717c3b99c003e0ee02d6d66377fd47d866fec7d971bd8644fc1a7',
-        'org.whispersystems:curve25519-android:82595394422b957d4a5b5f1b27b75ba25cf6dc4db4d312418ca38cd6fff279ca',
+        'org.whispersystems:curve25519-android:b502bcf83efe001f09a7a9efda6f0fa772c43ed5924e97816296ed3503caa092',
         'com.fasterxml.jackson.core:jackson-annotations:45d32ac61ef8a744b464c54c2b3414be571016dd46bfc2bec226761cf7ae457a',
-        'com.fasterxml.jackson.core:jackson-core:a2bebaa325ad25455b02149c67e6052367a7d7fc1ce77de000eed284a5214eac',
-        'com.squareup.okio:okio:734269c3ebc5090e3b23566db558f421f0b4027277c79ad5d176b8ec168bb850',
-        'com.madgag.spongycastle:core:8d6240b974b0aca4d3da9c7dd44d42339d8a374358aca5fc98e50a995764511f',
-        'org.whispersystems:curve25519-java:7dd659d8822c06c3aea1a47f18fac9e5761e29cab8100030b877db445005f03e',
+        'com.fasterxml.jackson.core:jackson-core:d934dab0bd48994eeea2c1b493cb547158a338a80b58c4fbc8e85fb0905e105f',
+        'com.squareup.okio:okio:693fa319a7e8843300602b204023b7674f106ebcb577f2dd5807212b66118bd2',
+        'org.whispersystems:curve25519-java:0aadd43cf01d11e9b58f867b3c4f25c3194e8b0623d1953d32dfbfbee009e38d',
     ]
 }
 
+def canonicalVersionCode = 490
+def canonicalVersionName = "4.41.2"
+
+def postFixSize = 10
+def abiPostFix = ['armeabi-v7a' : 1,
+                  'arm64-v8a'   : 2,
+                  'x86'         : 3,
+                  'x86_64'      : 4,
+                  'universal'   : 5]
+
 android {
     flavorDimensions "none"
     compileSdkVersion 28
@@ -290,8 +303,8 @@ android {
     }
 
     defaultConfig {
-        versionCode 474
-        versionName "4.38.0"
+        versionCode canonicalVersionCode * postFixSize
+        versionName canonicalVersionName
 
         minSdkVersion 19
         targetSdkVersion 26
@@ -312,9 +325,10 @@ android {
         buildConfigField "String", "MRENCLAVE", "\"cd6cfc342937b23b1bdd3bbf9721aa5615ac9ff50a75c5527d441cd3276826c9\""
         buildConfigField "String", "UNIDENTIFIED_SENDER_TRUST_ROOT", "\"BXu6QIKVz5MA8gstzfOgRQGqyLqOwNKHL6INkv3IHWMF\""
         buildConfigField "String[]", "LANGUAGES", "new String[]{\"" + autoResConfig().collect { s -> s.replace('-r', '_') }.join('", "') + '"}'
+        buildConfigField "int", "CANONICAL_VERSION_CODE", "$canonicalVersionCode"
 
         ndk {
-            abiFilters 'armeabi-v7a', 'x86'
+            abiFilters 'armeabi-v7a', 'arm64-v8a', 'x86', 'x86_64'
         }
 
         resConfigs autoResConfig()
@@ -323,7 +337,7 @@ android {
             abi {
                 enable true
                 reset()
-                include 'armeabi-v7a', 'x86'
+                include 'armeabi-v7a', 'arm64-v8a', 'x86', 'x86_64'
                 universalApk true
             }
         }
@@ -393,8 +407,14 @@ android {
     }
 
     android.applicationVariants.all { variant ->
-        variant.outputs.all {
-            outputFileName = outputFileName.replace(".apk", "-${variant.versionName}.apk")
+        variant.outputs.each { output ->
+            output.outputFileName = output.outputFileName.replace(".apk", "-${variant.versionName}.apk")
+            def abiName = output.getFilter("ABI") ?: 'universal'
+            def postFix = abiPostFix.get(abiName, 0)
+
+            if (postFix >= postFixSize) throw new AssertionError("postFix is too large")
+
+            output.versionCodeOverride = canonicalVersionCode * postFixSize + postFix
         }
     }
 
@@ -420,8 +440,9 @@ android {
         website.manifest.srcFile 'website/AndroidManifest.xml'
     }
 
-     lintOptions {
-        abortOnError false
+    lintOptions {
+        abortOnError true
+        baseline file("lint-baseline.xml")
     }
 
     testOptions {
@@ -443,8 +464,8 @@ def assembleWebsiteDescriptor = { variant, file ->
         String apkName = file.getName()
 
         String descriptor = "{" +
-                "\"versionCode\" : $project.android.defaultConfig.versionCode," +
-                "\"versionName\" : \"$project.android.defaultConfig.versionName\"," +
+                "\"versionCode\" : $canonicalVersionCode," +
+                "\"versionName\" : \"$canonicalVersionName\"," +
                 "\"sha256sum\" : \"$digest\"," +
                 "\"url\" : \"$url/$apkName\"" +
                 "}"
@@ -524,5 +545,5 @@ static def autoResConfig() {
 task qa {
   group 'Verification'
   description 'Quality Assurance. Run before pushing.'
-  dependsOn ':testPlayReleaseUnitTest', ':assemblePlayDebug'
+  dependsOn ':testPlayReleaseUnitTest', ':lintPlayRelease', ':assemblePlayDebug'
 }

buildSrc/src/main/groovy/org/whispersystems/witness/WitnessPlugin.groovy

@@ -0,0 +1,84 @@
+package org.whispersystems.witness
+
+import org.gradle.api.InvalidUserDataException
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.artifacts.Configuration
+import org.gradle.api.artifacts.ResolvedArtifact
+
+import java.security.MessageDigest
+
+class WitnessPluginExtension {
+    List verify
+    String configuration
+}
+
+class WitnessPlugin implements Plugin<Project> {
+
+    static String calculateSha256(file) {
+        MessageDigest md = MessageDigest.getInstance("SHA-256");
+        file.eachByte 4096, {bytes, size ->
+            md.update(bytes, 0, size);
+        }
+        return md.digest().collect {String.format "%02x", it}.join();
+    }
+
+    void apply(Project project) {
+        project.extensions.create("dependencyVerification", WitnessPluginExtension)
+        project.afterEvaluate {
+            project.dependencyVerification.verify.each {
+                assertion ->
+                    List  parts  = assertion.tokenize(":")
+                    String group = parts.get(0)
+                    String name  = parts.get(1)
+                    String hash  = parts.get(2)
+
+                    def artifacts = allArtifacts(project).findAll {
+                        return it.name.equals(name) && it.moduleVersion.id.group.equals(group)
+                    }
+
+                    if (artifacts.size() > 1) {
+                        throw new InvalidUserDataException("Multiple artifacts found for $group:$name, ${artifacts.size()} found")
+                    }
+
+                    ResolvedArtifact dependency = artifacts.find()
+
+                    println "Verifying " + group + ":" + name
+
+                    if (dependency == null) {
+                        throw new InvalidUserDataException("No dependency for integrity assertion found: " + group + ":" + name)
+                    }
+
+                    if (!hash.equals(calculateSha256(dependency.file))) {
+                        throw new InvalidUserDataException("Checksum failed for " + assertion)
+                    }
+            }
+        }
+
+        project.task('calculateChecksums').doLast {
+            println "dependencyVerification {"
+
+            def configurationName = project.dependencyVerification.configuration
+            if (configurationName != null) {
+                println "    configuration = '$configurationName'"
+            }
+
+            println "    verify = ["
+
+            allArtifacts(project).each {
+                dep ->
+                    println "        '" + dep.moduleVersion.id.group+ ":" + dep.name + ":" + calculateSha256(dep.file) + "',"
+            }
+
+            println "    ]"
+            println "}"
+        }
+    }
+
+    private static Set<ResolvedArtifact> allArtifacts(Project project) {
+        def configurationName = project.dependencyVerification.configuration
+        project.configurations
+                .findAll { config -> config.name =~ configurationName }
+                .collectMany { it.resolvedConfiguration.resolvedArtifacts }
+    }
+}

buildSrc/src/main/resources/META-INF/gradle-plugins/witness.properties

@@ -0,0 +1 @@
+implementation-class=org.whispersystems.witness.WitnessPlugin

lint-baseline.xml

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<issues format="5" by="lint 3.3.2" client="gradle" variant="playRelease" version="3.3.2">
+
+    <issue
+        id="LintError"
+        message="Unexpected failure during lint analysis of JobManager.java (this is a bug in lint or one of the libraries it depends on)&#xA;&#xA;Stack: `NullPointerException:ClsFileImpl.getMirror(ClsFileImpl.java:343)←ClsElementImpl.getMirror(ClsElementImpl.java:159)←ClsElementImpl.getText(ClsElementImpl.java:202)←InferenceSession.argConstraints(InferenceSession.java:1817)←InferenceSession.isFunctionalTypeMoreSpecific(InferenceSession.java:1748)←InferenceSession.isFunctionalTypeMoreSpecificOnExpression(InferenceSession.java:1729)←JavaMethodsConflictResolver.isFunctionalTypeMoreSpecific(JavaMethodsConflictResolver.java:779)←JavaMethodsConflictResolver.isTypeMoreSpecific(JavaMethodsConflictResolver.java:673)`&#xA;&#xA;You can set environment variable `LINT_PRINT_STACKTRACE=true` to dump a full stacktrace to stdout.">
+        <location
+            file="src/org/thoughtcrime/securesms/jobmanager/JobManager.java"/>
+    </issue>
+
+    <issue
+        id="MissingPermission"
+        message="Call requires permission which may be rejected by user: code should explicitly check to see if permission is available (with `checkPermission`) or explicitly handle a potential `SecurityException`"
+        errorLine1="    List&lt;SubscriptionInfo> list = subscriptionManager.getActiveSubscriptionInfoList();"
+        errorLine2="                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~">
+        <location
+            file="src/org/thoughtcrime/securesms/util/dualsim/SubscriptionManagerCompat.java"
+            line="101"
+            column="35"/>
+    </issue>
+
+    <issue
+        id="ResourceType"
+        message="Expected resource of type styleable"
+        errorLine1="                drawables.getColor(1, 0xff000000);"
+        errorLine2="                                   ~">
+        <location
+            file="src/org/thoughtcrime/securesms/contacts/ContactSelectionListAdapter.java"
+            line="187"
+            column="36"/>
+    </issue>
+
+    <issue
+        id="AppLinkUrlError"
+        message="Missing URL"
+        errorLine1="        &lt;intent-filter>"
+        errorLine2="        ^">
+        <location
+            file="AndroidManifest.xml"
+            line="368"
+            column="9"/>
+    </issue>
+
+    <issue
+        id="AppLinkUrlError"
+        message="Missing URL"
+        errorLine1="        &lt;intent-filter>"
+        errorLine2="        ^">
+        <location
+            file="AndroidManifest.xml"
+            line="381"
+            column="9"/>
+    </issue>
+
+</issues>

lint.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<lint>
+
+    <!-- L10N errors -->
+    <!-- This is a runtime crash so we don't want to ship with this. -->
+    <issue id="StringFormatMatches" severity="error" />
+
+    <!-- L10N warnings -->
+    <issue id="MissingTranslation" severity="warning" />
+    <issue id="MissingQuantity" severity="warning" />
+    <issue id="ExtraTranslation" severity="warning" />
+    <issue id="ImpliedQuantity" severity="warning" />
+
+</lint>

proguard-spongycastle.pro

@@ -1,26 +0,0 @@
--keep class org.spongycastle.crypto.* {*;}
--keep class org.spongycastle.crypto.agreement.** {*;}
--keep class org.spongycastle.crypto.digests.* {*;}
--keep class org.spongycastle.crypto.ec.* {*;}
--keep class org.spongycastle.crypto.encodings.* {*;}
--keep class org.spongycastle.crypto.engines.* {*;}
--keep class org.spongycastle.crypto.macs.* {*;}
--keep class org.spongycastle.crypto.modes.* {*;}
--keep class org.spongycastle.crypto.paddings.* {*;}
--keep class org.spongycastle.crypto.params.* {*;}
--keep class org.spongycastle.crypto.prng.* {*;}
--keep class org.spongycastle.crypto.signers.* {*;}
-
--keep class org.spongycastle.jcajce.provider.asymmetric.* {*;}
--keep class org.spongycastle.jcajce.provider.asymmetric.util.* {*;}
--keep class org.spongycastle.jcajce.provider.asymmetric.dh.* {*;}
--keep class org.spongycastle.jcajce.provider.asymmetric.ec.* {*;}
-
--keep class org.spongycastle.jcajce.provider.digest.** {*;}
--keep class org.spongycastle.jcajce.provider.keystore.** {*;}
--keep class org.spongycastle.jcajce.provider.symmetric.** {*;}
--keep class org.spongycastle.jcajce.spec.* {*;}
--keep class org.spongycastle.jce.** {*;}
-
-
--dontwarn javax.naming.**

protobuf/Backups.proto

@@ -34,6 +34,11 @@ message Attachment {
     optional uint32 length       = 3;
 }
 
+message Sticker {
+    optional uint64 rowId  = 1;
+    optional uint32 length = 2;
+}
+
 message Avatar {
     optional string name   = 1;
     optional uint32 length = 2;
@@ -56,4 +61,5 @@ message BackupFrame {
     optional DatabaseVersion  version    = 5;
     optional bool             end        = 6;
     optional Avatar           avatar     = 7;
+    optional Sticker          sticker    = 8;
 }