Native Android support for Finnish identity cards: in-app and system browser authentication, qualified PDF signing, and contactless NFC operation.
- Android 13+
- USB CCID smart-card reader or NFC
- JDK, Rust (aarch64-linux-android and x86_64-linux-android targets), cargo-ndk, Android SDK/NDK
Scripts/bootstrap-macos.sh # installs toolchains, sets env, installs git hooks
./gradlew check # full quality gates
./gradlew assembleDebug # debug APK
./gradlew installDebug # deploy to connected deviceRelease APK (signed with hardware identity card, PIN 2):
Scripts/build-release-apk.shadb tcpip 5555
adb shell ip -f inet addr show wlan0 # note the phone address
adb connect <phone-address>:5555The TCP listener survives until reboot or a USB-debugging toggle.
| Repository | Role |
|---|---|
| fineid-spec | Protocol behavior specification |
| refineid-core | Reusable Rust implementation |
| refineid-mono-internal | Compatibility and coverage oracle |
| RefineID-Apple | Product-behavior and UX reference |
For system-browser support via platform KeyChain, see
doc/architecture/0011-browser-authentication-boundary.md
and the AOSP design in
doc/architecture/0012-platform-keychain-external-key.md.
Build the AOSP image with the pinned Pixel 4
BUILD.md. To stage the
minimized unsigned release artifact:
Scripts/stage-aosp-prebuilt.sh./gradlew check enforces: Kotlin compiler warnings-as-errors, Android Lint,
Detekt, ktlint, rustfmt, Clippy, ShellCheck, wire-contract matching, release
bytecode logging prohibition, and no Internet permission in the release manifest.
Calendar versioning YY.M.D matching the Apple release. See
doc/architecture/0006-calendar-versioning.md
and the release process.
Never place a real PIN, CAN, PUK, certificate, card dump, APDU trace, personal identifier, or device/network identifier in source control, tests, screenshots, issues, or CI logs.
Apache License, Version 2.0.