This wallet is primarily a signature device. Its purpose is not to be an all-in-one app for every possible Gajumaru feature. It is also not intended to integrate directly with every major app that is integrated with the Gajumaru.

Scope

GajuMobile covers the bare minimum features necessary to interact with the Gajumaru and, specifically, support functionality that can be expressed via GRIDS.

App-specific functionality (direct integration with a DEX or other type of exchange, interpretation of NFTs, transaction history tracking, etc.) are outside of scope for GajuMobile.

Other applications can be linked to by GajuMobile, and other applications can form Gajumaru transactions that GajuMobile can then be prompted to sign through GRIDS, whether over the LAN or WAN.

Project rules

GajuMobile (whether on Android, iOS, or Pine) is not permitted to include any foreign dependencies, where "foreign" is defined as any libraries coming from outside the Gajumaru project itself. As we cannot escape Android, at a minimum, we are forced to trust that Android itself is trustworthy, and as Jetpack Compose and Kotlin are now part of the core definition, those must be trusted as well.

I don't like it, and my opinions are objectively correct, but this is the baseline scope of trust we must accept. At least it is well defined.

This project is not permitted to use Kotlin for most primitive operations due to basic language, build and runtime constraints imposed by the (ridiculous) language definition. For this reason primitives that provide the functionality found in Hakuzaru and supporting Erlang libraries have been ported in self-contained plain-Java libraries provided by the gm-java project. In general gm-java is written in such a way that fragments of old object memory is not left scattered across the heap awaiting GC, and what garbage there is that might be sensitive can be zeroed before leaving scope (yes, that was pretty annoying to achieve in Java, and it is actually impossible to achieve in Kotlin).

Android provides a number of facilities to achieve some memory isolation, however, and these facilities must be used. As most of the facilities that are of greatest interest to us in the wallet context did not exist prior to Android 14, that is the oldest version we may currently support. Hopefully we can retire that version sooner than later, and absolutely must retire support for Android 14 once it leaves the official support window.

It would be entirely possible to augment this project to work on older Android phones, and this may even be a good idea because it would make GajuMobile a more inclusive platform. The method to support that would be to build a second, parallel project with support for legacy devices instead, though, rather than force this project to maintain support for more fallback security mechanisms and platform detection than it already is forced to.

Reasoning

Kotlin is a rats' nest of antisensical decisions and techniques designed by smart people for consumption by less smart people. This results in a so-called "expressive" mess of language featuritis that can't decide what paradigm it lives in, so it lives in them all while achieving none of them.

It is impossible to tell from the code alone what is actually going to happen in the runtime, or even understand what is going to happen in the potentially limitless number of pre-compilation steps based on what files are even included in a given module, much less pin down a truly deterministic build profile if external dependencies are included. This is the primary reason for the "no foreign deps" rule.

Terms

This program is dual-licensed: 1) Under the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version (AGPL-3.0-or-later). (See LICENSE file.)

Under a commercial/proprietary license available directly from QPQ AG. If you wish to use this software outside the strict constraints of the AGPLv3 (e.g. within a closed-source or proprietary product), you must purchase a commercial license from QPQ AG.

Authors:

Craig Everett craigeverett@qpq.swiss

SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-QPQ-Commercial