8000 Harden pre-release privacy controls by shroominic · Pull Request #30 · shroominic/OpenGlucose · GitHub
[go: up one dir, main page]
Skip to content

Harden pre-release privacy controls - #30

Merged
shroominic merged 1 commit into
mainfrom
fix/pre-external-privacy
Aug 13, 2026
Merged

Harden pre-release privacy controls#30
shroominic merged 1 commit into
mainfrom
fix/pre-external-privacy

Conversation

@shroominic
@shroominic shroominic commented Aug 13, 2026
Copy link
Copy Markdown
Owner

Summary

Hardens the three privacy controls identified by the physical pre-external audit:

  • Removes only exact legacy Library/Caches/openhealth_<sensor-id>_<timestamp>.csv regular files at startup, alongside already-known share cache directories. Near-matches and unrelated cache entries remain untouched.
  • Migrates schema-two reversible base64 history filenames to deterministic history-<sha256>.blob names. Migration is crash-safe, verifies iOS backup exclusion, resumes interrupted states, rejects unsupported future schemas before touching history artifacts, and preserves conflicting copies while failing closed.
  • Sets flutter_blue_plus Dart/native logging to none as the first plugin call in release startup and propagates failure rather than continuing with the plugin's DEBUG-native default.

This also records the 2026-08-14 GitHub private-reporting API result and physical build-17 backup-exclusion evidence. It intentionally leaves active-session lock-screen visual verification pending because no live real sensor session was available; no ASC or device state was changed by this branch.

Acceptance criteria

  • The task has owner @shroominic and scoped acceptance criteria from the pre-external audit.
  • The three concrete privacy fixes are implemented and tested.
  • Remaining real-sensor lock-screen evidence is identified explicitly and is not claimed complete.

Change risk and impact

Risk class: R2 — changes restricted health-data persistence, startup privacy behavior, cache cleanup, and native BLE logging.

  • Public API or serialized-data impact: restricted-state schema advances from 2 to 3; cgm_ble_flutter adds disableFlutterBluePlusLogs() and advances to 1.1.0.
  • Health/personal data touched: legacy export cache files and restricted glucose-history blob filenames.
  • Sensor, BLE, permission, or platform impact: release builds disable flutter_blue_plus Dart/native logs before BLE use; no permission change.
  • AI, destructive operation, migration, or irreversible side effect: tightly matched legacy cache exports are deleted; schema-two blob names are migrated with crash recovery and fail-closed conflict preservation.
  • Dependency or release impact: crypto 3.0.7 becomes a direct app dependency; it was already present at that exact version in the lockfile transitively. No new package, network behavior, permission, or code generation is introduced.

Evidence

  • make check — passed after the final forward-schema recovery fix: formatting, analyzers, all package/app unit tests (including 193 app tests), app integration test, Android debug APK, web build, Android release-signing fail-closed guard, unsigned iOS release build, and all five native Runner tests.
  • make build behavior is covered by make check for Android, web, and unsigned iOS release builds.
  • Focused tests: flutter test --no-pub test/health_state_store_io_test.dart test/sensor_archive_export_test.dart test/privacy_release_defaults_test.dart — 50 passed.
  • BLE policy tests: flutter test --no-pub test/flutter_blue_plus_logging_test.dart — 3 passed.
  • Integration/native evidence: demo lifecycle passed; all five native iOS storage tests passed.
  • UI evidence: not applicable; this PR has no UI changes.
  • Manual review: independent diff review found the future-schema transaction-artifact edge case; the final implementation validates supported schema before recovery and tests path/byte preservation for schema 99.

Compatibility, rollout, and recovery

  • Breaking/deprecation or migration plan: schema 0/1/2 upgrades automatically to schema 3. A schema-two binary cannot locate renamed schema-three blobs and downgrade is unsupported.
  • Rollout or feature flag: startup migration and cache hygiene are automatic; BLE suppression applies only to release mode.
  • Rollback/recovery path: roll forward to a schema-three build and preserve the original app container read-only. Conflicting old/new history copies are retained for recovery rather than overwritten.
  • Release artifact/source relationship: this PR contains source and tests only 8000 ; no distribution artifact or ASC/device state was produced.

Documentation and review

  • Tests fail without the fix or cover the new behavior.
  • Compatibility, privacy, contributor/security guidance, package docs, and changelogs are updated.
  • Dependency and license/notice implications were reviewed; the existing locked crypto package is only promoted to direct use.
  • Logs, fixtures, and artifacts contain only synthetic identifiers and no sensitive values.
  • Privacy/security owner @shroominic is requested.
  • No waiver is introduced by this PR; the separate active-real-sensor lock-screen evidence remains an explicit external-release prerequisite unless the owner records a narrow, expiring waiver.

@shroominic
shroominic merged commit 2f0e317 into main Aug 13, 2026
9 checks passed
@shroominic
shroominic deleted the fix/pre-external-privacy branch August 13, 2026 23:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shroominic
0