Skip to content

Commit c8a0079

Browse files
Monolith-secMonolith-sec
committed
Initial commit
0 parents  commit c8a0079

182 files changed

Lines changed: 24919 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/security-pipeline.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: CI Pipeline
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- 'feature/**'
8+
pull_request:
9+
branches: [ main ]
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
ci:
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
# ── Setup ──────────────────────────────────────────────────────────
20+
- name: Checkout code
21+
uses: actions/checkout@v4
22+
with:
23+
fetch-depth: 0 # full history required for TruffleHog
24+
25+
- name: Set up JDK 17
26+
uses: actions/setup-java@v4
27+
with:
28+
distribution: 'temurin'
29+
java-version: '17'
30+
cache: 'gradle'
31+
32+
- name: Grant execute permission for Gradle wrapper
33+
run: chmod +x gradlew
34+
35+
# ── Secrets Scanning ───────────────────────────────────────────────
36+
- name: Scan for leaked secrets (TruffleHog)
37+
uses: trufflesecurity/trufflehog@v3.88.26
38+
with:
39+
extra_args: --only-verified
40+
41+
# ── Static Analysis ────────────────────────────────────────────────
42+
- name: Run SAST (detekt)
43+
run: ./gradlew detekt
44+
45+
- name: Run Android Lint
46+
run: ./gradlew lintDebug
47+
48+
# ── Build & Test ───────────────────────────────────────────────────
49+
- name: Build debug APK
50+
run: ./gradlew assembleDebug
51+
52+
- name: Run unit tests
53+
run: ./gradlew testDebugUnitTest
54+
55+
# ── Dependency Scanning ────────────────────────────────────────────
56+
- name: Run CVE scan (OWASP Dependency-Check)
57+
uses: dependency-check/Dependency-Check_Action@75ba02d6183445fe0761d26e836bde58b1560600
58+
env:
59+
JAVA_HOME: /opt/jdk
60+
with:
61+
project: 'Monolith-v1.0'
62+
path: 'app'
63+
format: 'HTML'
64+
args: >
65+
--failOnCVSS 7
66+
--disableRubygems
67+
--disableNodeJS
68+
--disablePyPkg
69+
--disableGolangMod
70+
--disableGolangDep

‎.gitignore‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# ── Gradle ─────────────────────────────────────────────────────────
2+
.gradle/
3+
build/
4+
5+
# ── Android build output ───────────────────────────────────────────
6+
/captures
7+
.externalNativeBuild/
8+
.cxx/
9+
*.apk
10+
*.aab
11+
*.ap_
12+
*.dex
13+
14+
# ── Module-specific build folders ──────────────────────────────────
15+
app/build/
16+
app/release/
17+
18+
# ── Local configuration (paths, SDKs) ──────────────────────────────
19+
local.properties
20+
21+
# ── IntelliJ / Android Studio ──────────────────────────────────────
22+
.idea/
23+
*.iml
24+
*.ipr
25+
*.iws
26+
27+
# ── Kotlin ─────────────────────────────────────────────────────────
28+
.kotlin/
29+
30+
# ── Logs ───────────────────────────────────────────────────────────
31+
*.log
32+
build.log
33+
34+
# ── Signing & key material (NEVER commit) ──────────────────────────
35+
*.jks
36+
*.keystore
37+
*.key
38+
*.pem
39+
key.properties
40+
keystore.properties
41+
signing.properties

‎README.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Monolith
2+
3+
Air-gapped, end-to-end encrypted offline messenger for Android.
4+
5+
Monolith is designed for environments that demand resistance against high level threat actors. Communication happens exclusively through QR codes. The application requires no network access of any kind.
6+
7+
For the full architecture and threat model, see the [Monolith Whitepaper](https://monolith-sec.com/#whitepaper).
8+
9+
---
10+
11+
## Get the App
12+
13+
See **[monolith-sec.com](https://monolith-sec.com/#downloads)**.
14+
15+
16+
---
17+
18+
## Build from Source
19+
20+
### Requirements
21+
22+
- Android SDK with compile SDK 36, min SDK 33
23+
- NDK 27.0.12077973 (LTS)
24+
- CMake 3.22.1
25+
- Target ABI: `arm64-v8a` only
26+
- Device with TEE or StrongBox hardware-backed key storage
27+
28+
### Commands
29+
30+
```bash
31+
./gradlew assembleDebug # Build debug APK
32+
./gradlew assembleRelease # Build release APK
33+
./gradlew installDebug # Install on connected device
34+
./gradlew test # Run local unit tests
35+
./gradlew connectedAndroidTest # Run instrumented tests (device required)
36+
./gradlew detekt # Static analysis
37+
```
38+
39+
---
40+
41+
## Architecture
42+
43+
| Layer | Location | Purpose |
44+
|--------------|----------------------------------------------|----------------------------------------------------------------|
45+
| Presentation | `app/src/main/java/com/monolith/app/ui/` | Jetpack Compose, single-activity navigation |
46+
| Cryptography | `app/src/main/java/com/monolith/app/crypto/` | Identity keys, database wrapping, JNI bridge |
47+
| Data | `app/src/main/java/com/monolith/app/data/` | Room database with SQLCipher encryption |
48+
| Native | `app/src/main/cpp/` | libsodium-based hybrid encryption (X25519 + ChaCha20-Poly1305) |
49+
50+
For details on each layer, the cryptographic primitives, and the full threat model, refer to the [Whitepaper](https://www.monolith-sec.com/#whitepaper).
51+
52+
---
53+
54+
## Security
55+
56+
If you discover a security vulnerability, please follow the procedure described in [SECURITY.md](SECURITY.md). **Do not file public GitHub issues for security-related bugs.**
57+
58+
---
59+
60+
## Copyright
61+
62+
Copyright © 2026 Monolith Security Solutions (Aron Basalt). All rights reserved.
63+
64+
This repository is published for transparency and independent review. No license is granted to use, modify, distribute the source code or any derivative works. All rights are reserved by the copyright holder.

‎SECURITY.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
If you discover a security vulnerability in Monolith, please report it privately. **Do not open public GitHub issues for security-related bugs.**
6+
7+
**Contact:** security@monolith-sec.com
8+
9+
## What to Include
10+
11+
* Affected version or commit hash
12+
* Description of the issue
13+
* Steps to reproduce, if available
14+
* Potential impact
15+
16+
## Response
17+
18+
Reports are reviewed as quickly as possible. You will receive an acknowledgement after submission.
19+
20+
## Threat Model
21+
22+
The full threat model and security architecture are documented in the [Monolith Whitepaper](https://monolith-sec.com/#whitepaper).
23+

‎app/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/build

‎app/build.gradle.kts‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
plugins {
2+
alias(libs.plugins.android.application)
3+
alias(libs.plugins.kotlin.android)
4+
alias(libs.plugins.kotlin.compose)
5+
alias(libs.plugins.ksp)
6+
id("io.gitlab.arturbosch.detekt")
7+
}
8+
9+
android {
10+
namespace = "com.monolith.app"
11+
compileSdk = 36
12+
13+
// NDK r27 LTS — must be in android block, not defaultConfig
14+
ndkVersion = "27.0.12077973"
15+
16+
defaultConfig {
17+
applicationId = "com.monolith.app"
18+
minSdk = 33
19+
targetSdk = 36
20+
versionCode = 1
21+
versionName = "1.0.0"
22+
23+
testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
24+
vectorDrawables {
25+
useSupportLibrary = true
26+
}
27+
28+
externalNativeBuild {
29+
cmake {
30+
arguments += listOf(
31+
"-DANDROID_STL=c++_shared",
32+
"-DCMAKE_BUILD_TYPE=Release",
33+
"-DCMAKE_SHARED_LINKER_FLAGS=-Wl,-z,max-page-size=16384"
34+
)
35+
36+
cppFlags += listOf(
37+
"-std=c++17",
38+
"-fstack-protector-strong",
39+
"-D_FORTIFY_SOURCE=2",
40+
"-Werror=format-security",
41+
"-fvisibility=hidden",
42+
)
43+
}
44+
}
45+
46+
// ARM64 only (Pixel devices)
47+
ndk {
48+
abiFilters.clear()
49+
abiFilters.add("arm64-v8a")
50+
}
51+
}
52+
53+
buildTypes {
54+
release {
55+
isDebuggable = false
56+
isMinifyEnabled = true
57+
isShrinkResources = true
58+
proguardFiles(
59+
getDefaultProguardFile("proguard-android-optimize.txt"),
60+
"proguard-rules.pro"
61+
)
62+
}
63+
}
64+
65+
compileOptions {
66+
sourceCompatibility = JavaVersion.VERSION_1_8
67+
targetCompatibility = JavaVersion.VERSION_1_8
68+
}
69+
70+
kotlinOptions {
71+
jvmTarget = "1.8"
72+
}
73+
74+
buildFeatures {
75+
compose = true
76+
}
77+
78+
composeOptions {
79+
kotlinCompilerExtensionVersion = "1.5.1"
80+
}
81+
82+
externalNativeBuild {
83+
cmake {
84+
path = file("src/main/cpp/CMakeLists.txt")
85+
version = "3.22.1"
86+
}
87+
}
88+
89+
packaging {
90+
resources {
91+
excludes += "/META-INF/{AL2.0,LGPL2.1}"
92+
}
93+
jniLibs {
94+
pickFirsts += "**/*.so"
95+
}
96+
}
97+
}
98+
99+
dependencies {
100+
101+
// Core
102+
implementation(libs.androidx.core.ktx)
103+
implementation(libs.androidx.lifecycle.runtime.ktx)
104+
implementation(libs.androidx.activity.compose)
105+
implementation(platform(libs.androidx.compose.bom))
106+
implementation(libs.androidx.ui)
107+
implementation(libs.androidx.ui.graphics)
108+
implementation(libs.androidx.material3)
109+
110+
111+
// Unit tests
112+
testImplementation(libs.junit)
113+
114+
// Instrumented tests
115+
androidTestImplementation(libs.androidx.junit)
116+
androidTestImplementation(libs.androidx.espresso.core)
117+
androidTestImplementation(platform(libs.androidx.compose.bom))
118+
androidTestImplementation(libs.androidx.ui.test.junit4)
119+
androidTestImplementation(libs.androidx.navigation.testing)
120+
121+
// Debug tooling
122+
debugImplementation(libs.androidx.ui.tooling)
123+
debugImplementation(libs.androidx.ui.test.manifest)
124+
debugImplementation(libs.androidx.ui.tooling.preview)
125+
126+
// QR code generation & scanning
127+
implementation(libs.zxing.core)
128+
129+
// CameraX
130+
implementation(libs.androidx.camera.core)
131+
implementation(libs.androidx.camera.camera2)
132+
implementation(libs.androidx.camera.lifecycle)
133+
implementation(libs.androidx.camera.view)
134+
135+
// Navigation & ViewModel
136+
implementation(libs.androidx.lifecycle.viewmodel.compose)
137+
implementation(libs.androidx.navigation.compose)
138+
139+
// Room & SQLCipher
140+
implementation(libs.androidx.room.runtime)
141+
implementation(libs.androidx.room.ktx)
142+
ksp(libs.androidx.room.compiler)
143+
implementation(libs.sqlcipher.android)
144+
145+
// Ed25519 signature verification
146+
implementation(libs.eddsa)
147+
}
148+
149+
detekt {
150+
config.setFrom(file("../config/detekt/detekt.yml"))
151+
}

0 commit comments

Comments
 (0)