Bundle Conscrypt security provider for Free builds

This fixes protocol and cipher errors on older versions of android
without requiring Google API/Services (which are non-free) to replace
the security provider from the OS. No changes are made to Play builds.

The value of conscryptVersion in build.gradle should be updated
regularly to keep the bundled version of conscrypt up to date (or
changed to "latest.release", which will cause issues with verifying
reproducible builds).

Fixes: #2814 (for users of free builds)

1 files changed, 9 insertions, 1 deletions

diff --git a/core/src/free/java/de/danoeh/antennapod/core/ClientConfig.java b/core/src/free/java/de/danoeh/antennapod/core/ClientConfig.java
index 824a4fae3..aff8081e2 100644
--- a/core/src/free/java/de/danoeh/antennapod/core/ClientConfig.java
+++ b/core/src/free/java/de/danoeh/antennapod/core/ClientConfig.java
@@ -1,6 +1,13 @@
 package de.danoeh.antennapod.core;
 
 import android.content.Context;
+import java.security.Security;
+
+/*
+ * If you get an error here ("package org.conscrypt does not exist"), you are probably doing a free
+ * build and didn't pass -PfreeBuild to gradle (e.g. ./gradlew assembleFreeRelease -PfreeBuild).
+ */
+import org.conscrypt.Conscrypt;
 
 import de.danoeh.antennapod.core.preferences.PlaybackPreferences;
 import de.danoeh.antennapod.core.preferences.SleepTimerPreferences;
@@ -55,6 +62,7 @@ public class ClientConfig {
     }
 
     private static void installSslProvider(Context context) {
-        // ProviderInstaller is a closed-source Google library
+        // Insert bundled conscrypt as highest security provider (overrides OS version).
+        Security.insertProviderAt(Conscrypt.newProvider(), 1);
     }
 }