From d5b1bab5775a0d41ec8c4012240caa373d425491 Mon Sep 17 00:00:00 2001 From: mrambossek Date: Sun, 2 Aug 2026 10:36:49 +0200 Subject: [PATCH] app: stop the autorun upload pointing at a listener that is gone MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "upload failed: HTTP 400 client sent an HTTP request to an HTTPS server" is a TLS listener rejecting cleartext, and the cleartext was ours: REPORT_UPLOAD_URL was http://89.185.109.150:443/report, which used to be the adb-beacon receiver holding 0.0.0.0:443 in plaintext. Disabling that receiver and giving 443 to echolot-server left this posting plain HTTP at a TLS port. Blanked rather than repointed. The endpoint existed so an unattended run could be collected without adb, and autorun reports are now read straight off the device with `run-as cat` — so it was buying nothing and emitting an alarming error for a debugging convenience. Deliberately not aimed at /v1/runs either: that is the consent-gated upload, and a debugging shortcut must not be able to satisfy it by accident. The message says what happened instead of implying something broke. Co-Authored-By: Claude Opus 5 --- echolot-app/app/build.gradle.kts | 12 ++++++++++-- .../src/main/kotlin/app/echo_lot/app/RunViewModel.kt | 8 +++++++- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/echolot-app/app/build.gradle.kts b/echolot-app/app/build.gradle.kts index 8ebcfb0..e20507b 100644 --- a/echolot-app/app/build.gradle.kts +++ b/echolot-app/app/build.gradle.kts @@ -34,8 +34,16 @@ android { versionName = appVersionName // Automation: `adb shell am start -n app.echo_lot.app/.MainActivity --ez autorun true` // runs a measurement immediately and POSTs the report here (dev collection endpoint). - buildConfigField("String", "REPORT_UPLOAD_URL", "\"http://89.185.109.150:443/report\"") - buildConfigField("String", "REPORT_UPLOAD_SECRET", "\"D4OmG5gGJsElqVVbtYIZbR\"") + // Empty: the collection endpoint this pointed at was the adb-beacon receiver, which held + // 0.0.0.0:443 in cleartext. That service is gone and echolot-server owns 443 with TLS, so + // posting plaintext there now fails as "client sent an HTTP request to an HTTPS server" — + // an alarming error for a debugging convenience that is no longer needed, since autorun + // reports are read straight off the device with `run-as cat`. + // + // Deliberately not repointed at /v1/runs. That is the consent-gated upload, and a + // debugging shortcut must not be able to satisfy it by accident. + buildConfigField("String", "REPORT_UPLOAD_URL", "\"\"") + buildConfigField("String", "REPORT_UPLOAD_SECRET", "\"\"") // The bare SemVer, without the debug build's "-dev" suffix stripped away by the server's // parser anyway — sent to servers so they can apply their compatibility window. buildConfigField("String", "APP_SEMVER", "\"$appVersionName\"") diff --git a/echolot-app/app/src/main/kotlin/app/echo_lot/app/RunViewModel.kt b/echolot-app/app/src/main/kotlin/app/echo_lot/app/RunViewModel.kt index a1d905c..2e29888 100644 --- a/echolot-app/app/src/main/kotlin/app/echo_lot/app/RunViewModel.kt +++ b/echolot-app/app/src/main/kotlin/app/echo_lot/app/RunViewModel.kt @@ -165,7 +165,13 @@ class RunViewModel(app: Application) : AndroidViewModel(app) { if (devUpload) { state = state.copy(currentStep = "uploading report") val r = withContext(Dispatchers.IO) { ReportUploader.upload(doc) } - status = if (r.ok) "uploaded ✓ ${r.detail}" else "upload failed: ${r.detail}" + status = when { + r.ok -> "uploaded ✓ ${r.detail}" + // Not a failure worth alarming about: the dev collection endpoint is simply + // not configured, and the run is on the device either way. + r.detail.startsWith("no upload URL") -> "run complete — read it with adb" + else -> "upload failed: ${r.detail}" + } } if (archived != null && settings.autoUpload) { state = state.copy(currentStep = "uploading to server")