# TaigaPass Android 10 compatibility / 25 October 2026

Version 3.3.0-taiga.6, code2026102501, ru.taigalink.taigapass. Apply patches0001–0008 to upstream31d9d148f4d2cfac04cbd6b4da4c1d66ef1690d8. Public .5 corresponding-source SHA2562ef673cd8135c139e29f4980a3187cd5ab4e2c4d338e04f0cb80c05e6fd3c980 is the verified isolated preparation baseline. Never build from the dirty production checkout.

minSdk29; projectMinFullySupportedSdk31 retained. API30 uses setUserAuthenticationParameters(0, AUTH_BIOMETRIC_STRONG); API29 uses legacy validity duration -1, requiring biometric/CryptoObject per operation. User-authentication and biometric-enrollment invalidation remain enabled. Existing keys are reused. No account, database, networking, admission, endpoint, offline-cache or migration code changes. Robolectric4.17 is test-only.

The initial NewApi audit failed on the single API30 key-spec call; no suppression/baseline was introduced. After the guarded implementation: NewApi lint with all dependencies and208 tests pass (encrypted10, networking39, authentication132, startup13, menu14). Four tests execute real key-spec behavior on API29/30. Device and final APK checks remain required; source tests are not a device certificate.

Build on Hyper with build-android29-20261025.sh, existing JDK/SDK and shared build.lock. The script checks scoped encryptedstorage style, NewApi/InlinedApi and assembles release. It never signs or publishes. Use sign-release.py --version3.3.0-taiga.6 --date20261025 --source <unsigned APK> as root with the existing signing key outside source; certificate must remain a32249da6459cea9ffafbbf0e055d9664cc846df92920954f8e0d28edf8b2521.

Distribute complete corresponding source and upstream AGPL LICENSE alongside APK. Keep signing material, local.properties, .git, caches, user kits, tokens and test logs outside the archive. Public common APK must contain no employee credentials. Owner Fold6 remains .5 until explicitly updated. Never uninstall/clear accounts. Phone rollback requires same signer with increased versionCode; no data-erasing downgrade.

package-android29-20261025.py verifies all3041 regular source files against upstream plus0001–0008 and preserves six upstream screenshot-reference symlinks and the optional screenshot-reference submodule commit in its manifest. The optional screenshot fixture repository is not part of shipped native code. transfer-android29-20261025.py uses the prior pinned-host, expiring forced-command public-artifact transport, checks live index SHA, preserves static preimages and atomically publishes only exact approved files. Caddy configuration/restarts are unnecessary.