release: freeRASP KMP 2.1.0 (Android SDK 19.2.1, iOS SDK 7.1.2)

[tompsota]

Summary

Rolls Android Talsec SDK 19.2.1 into the KMP library (from 18.3.0) and bumps the library to 2.1.0. Also rolls the iOS TalsecRuntime to 7.1.2 (from 6.14.4).

SDK package and callback migration (required)

19.2.1 is a breaking SDK release beyond what the release notes describe:

• The package moved from com.aheaditec.talsec_security.security.api to app.talsec.rasp.security.api (4 files in androidMain).
• Every ThreatListener callback was renamed to match its threat name — onRootDetected() → onPrivilegedAccess(), onUnlockedDeviceDetected() → onPasscode(), onADBEnabledDetected() → onAdbEnabled(), onSystemVPNDetected() → onSystemVpn(), and so on for all 21.

Because the package moved as well, this fails to compile rather than silently delivering no threats.

New FreeRaspEvent.Bootloader (Android only)

The release adds onBootloader(), reporting an unlocked or compromised bootloader. It is surfaced as a new FreeRaspEvent.Bootloader in commonMain, marked Android only. in its KDoc following the Automation precedent.

freerasp_event_mapper.ios.kt is deliberately unchanged — iOS has no matching threat string, so the event never fires there, exactly as with Automation, UnsecureWifi, and LocationSpoofing.

Note for consumers: adding a member to the sealed FreeRaspEvent will break any exhaustive when over it. This follows the precedent from 1.1.0, where FreeRaspEvent.Automation was added as a minor bump under Added rather than Breaking.

Dependency resolution

jitpack.io is replaced by https://europe-west3-maven.pkg.dev/talsec-artifact-repository/common, which mirrors the SDK's two JitPack dependencies (fingerprint-android, truetime-android).

iOS SDK 7.1.2

TalsecRuntime.xcframework under library/src/iosMain/nativeTalsec/ goes from 6.14.4 straight to 7.1.2, so the changelog covers three SDK releases: 6.14.5, 7.1.0 and 7.1.2.

The framework diff is modification-only. The public Swift API gains exactly one additive type, ScreenCaptureBlockError; no existing declaration changed, so the cinterop def file and the Kotlin bridge are unchanged.

TalsecBridge.xcframework embeds its own nested copy of TalsecRuntime.framework, which the SDK bump alone left at 6.14.4. That stale copy is not what ran — TalsecBridge resolves @rpath/TalsecRuntime.framework/TalsecRuntime and its rpath list puts @executable_path/Frameworks ahead of @loader_path/Frameworks, so the top-level 7.1.2 copy won — but it still shipped a duplicate 6.14.4 binary inside the app bundle.

TalsecBridge has no source or build recipe in this repo and is not published in releases-ios, so it was patched in place: the nested framework in both slices was replaced with 7.1.2, keeping the trimmed layout (no Headers/ or Modules/) and ad-hoc signature that Xcode's RemoveHeadersOnCopy + CodeSignOnCopy embed produces, and the enclosing TalsecBridge.framework was re-signed so its CodeResources match. TalsecBridge's own version is unchanged at 1.0; only the runtime it carries moved.

This is a stopgap. The clean fix is for TalsecBridge to be rebuilt against 7.1.2 upstream.

dSYMs are attached to this description.

Test plan

• :library:compileDebugKotlinAndroid succeeds against SDK 19.2.1.
• :example:composeApp:assembleDebug succeeds. The exhaustive when in the example's toCheckId() is the compile-time guarantee that the new event is handled everywhere.
• Example app runs on a Pixel 9 Pro API 34 emulator without crashing; logs confirm app.talsec.rasp classes are loaded at runtime.
• The new Bootloader row renders in the dashboard (verified via UI accessibility dump — the app blocks screen capture, so screenshots come back empty).
• :library:cinteropTalsecIosSimulatorArm64 and :example:composeApp:linkDebugFrameworkIosSimulatorArm64 succeed against 7.1.2.
• iosApp builds for the iOS simulator through the Gradle embedAndSignAppleFrameworkForXcode phase.
• Example app runs on an iPhone 17 Pro simulator (iOS 26.1) without crashing, renders the dashboard, and vmmap confirms TalsecRuntime 7.1.2 is the mapped image.
• codesign --verify --strict --deep passes on both patched TalsecBridge.framework slices, and the nested framework keeps its original trimmed layout and architectures (arm64; x86_64 arm64).
• Rebuilt and re-ran the smoke test after the bridge patch: both TalsecRuntime copies in the app bundle now report 7.1.2, and the dashboard result is unchanged.

Threats flagged on the emulator (app integrity, debug, simulator, unofficial store, obfuscation issues, malware, ADB, passcode, secure hardware) are the expected debug-build-on-emulator set.
dSYMs.zip

Made with Cursor