Android engine · 0.1.0 local evaluation

From your build to inspectable evidence.

Public distribution is pending. Start with an authorized copy of the Android engine repository. The separate analysis platform is not required for this integration.

1. Publish the engine locally

Use the engine checkout, its Gradle wrapper and an installed Android SDK. This writes development artifacts to your own Maven Local repository.

./gradlew :plugin:publishToMavenLocal :runtime:publishToMavenLocal --configuration-cache

2. Resolve local artifacts in your Android project

Keep pluginManagement at the beginning of settings.gradle.kts. Maven Local is required for this evaluation path; the plugin snippet alone cannot download an unpublished release.

pluginManagement {
    repositories {
        mavenLocal()
        google()
        mavenCentral()
        gradlePluginPortal()
    }
}
dependencyResolutionManagement {
    repositories {
        mavenLocal()
        google()
        mavenCentral()
    }
}

3. Apply the application plugin

plugins {
    id("com.android.application")
    id("com.apparmorx.security") version "0.1.0"
}

No consumer initialization call is required. STANDARD is the default profile. Debuggable variants suppress threat-response enforcement; evaluate release behavior separately.

4. Build and inspect coverage

./gradlew assembleRelease --configuration-cache

Configure your real release signing configuration. Signer pins are derived from it unless explicitly overridden. Open build/reports/apparmorx/protection-report-release.html in the application module and review coverage, policy, weakenings and payload digests.

5. Test your actual deployment

Run both debug and release variants on the devices you support. A successful build does not establish resistance to every attack. Release emulator checks can report a threat; use a physical device or the DEVELOPMENT profile for intentional emulator evaluation.