halkyon/apps/train/halkyon_train_flutter/android/gradle/verification-metadata.xml
Tizian 「ティツィアーン」 cd72cf6ccc
feat(train): setting up and keeping the Polar Loop (ADR 0030, D34–D36)
On Android, the Loop through Polar's BLE SDK 8.3.0 (from JitPack, asked
for Polar's group alone, its files pinned by SHA-256 in Gradle's
verification metadata): LoopBridge.kt over app.halkyon.train/loop, the
first-time use's figures mapped and checked in LoopSetup.kt, tested on
the JVM. PolarLoop per person remembers the band in loop.json, connects
while the app is open, sets its clock at each connection, keeps what it
tells (battery, charging, firmware), offers a changed profile and sends
it only when asked (D35: first-time use writes a new user identifier
each time), and lets the band go by a factory reset after asking. The
setup sheet finds Loops nearest first and asks only for what the
profile lacks; Polar's defaults (60, 220 less the age, a VO2max from
Polar's fitness tables) go to the band alone.

Polar's SDK is not free software (D36, correcting D32): the app's AGPL
gains a section 7 permission for linking it, LICENSE.md names it, and
its licence and bundled notices join the licence list on Android.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-30 15:52:55 +01:00

32 lines
1.7 KiB
XML

<?xml version="1.0" encoding="UTF-8"?>
<!--
Polar's BLE SDK comes from JitPack (ADR 0030, D34), which builds it from
Polar's repository itself: its files are pinned here by their SHA-256, as
JitPack served them on 28 Oct 2026, so that a file changed there fails the
build. Everything else comes from Google's and Maven Central's repositories
and is trusted as before.
-->
<verification-metadata xmlns="https://schema.gradle.org/dependency-verification"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://schema.gradle.org/dependency-verification https://schema.gradle.org/dependency-verification/dependency-verification-1.3.xsd">
<configuration>
<verify-metadata>true</verify-metadata>
<verify-signatures>false</verify-signatures>
<trusted-artifacts>
<trust group="^(?!com[.]github[.]polarofficial$).*$" regex="true"/>
</trusted-artifacts>
</configuration>
<components>
<component group="com.github.polarofficial" name="polar-ble-sdk" version="8.3.0">
<artifact name="polar-ble-sdk-8.3.0.aar">
<sha256 value="f207c8b4a1812890e4737ac5c72b46bbcb1889826ef89d82ddc66c5772a826d0" origin="JitPack, 28 Oct 2026"/>
</artifact>
<artifact name="polar-ble-sdk-8.3.0.module">
<sha256 value="00ddeeac9e681cdfa411dd4cb6834968c0b08c18efff7debbd9d6379200293fc" origin="JitPack, 28 Oct 2026"/>
</artifact>
<artifact name="polar-ble-sdk-8.3.0.pom">
<sha256 value="1bceb6bf7e24262b196a3a7d55b94dadbfbe9428fe5aa998e20d4e6b4a4e1285" origin="JitPack, 28 Oct 2026"/>
</artifact>
</component>
</components>
</verification-metadata>