[leoromanovsky]

What does this PR do?

Adds optional public v1 response verification to Android Flags with OFF, OBSERVE and REQUIRED modes. The default remains off. Observe accepts otherwise-valid unsigned or unverifiable responses with bounded diagnostics; required rejects them. Authentication, transport, redirect and JSON errors keep their ordinary behavior.

Motivation

Customers need response integrity without forcing installed mobile applications to update whenever a signing key or intermediate rotates. An explicitly configured public root verifies the full leaf/intermediate chain carried by each response. No production or test root is bundled, and responses cannot replace trusted roots. Client adoption can proceed independently of other SDKs.

Additional Notes

The public v1 transcript binds the exact request, nonce, response body and expiry. X.509 v3 certificate encoding is unchanged. The response to one assignment request carries the proof and certificate chain; verification adds no certificate fetch or unsigned retry. When signing preparation succeeds, observe and required requests send X-stream: false for buffered delivery. Off mode retains ordinary transport selection. This draft does not add signed streaming.

Required mode keeps verified assignments in memory and checks their original expiry and scope on every evaluation. Application-ID/context changes, cancellation and shutdown prevent stale responses from being installed. Observe retains ordinary persistence in a fresh full-request-scoped namespace, causing a one-time cold start; unsigned observations cannot replace its separate verified fallback. Server disablement cannot weaken a client's required policy. See configuration and cache behavior.

The main corpus and four isolated certificate-rule cases are copied byte-for-byte from ffe-system-test-data main, at b57eac6711204a906f0b24e127124a03314e35a9. Two local KeyUsage cases remain separate. The adapters check 52 response cases in total; they do not load the shared nested-DER supplement or server signer-key cases. Siblings are browser #436 and iOS #3357.

At 1b8b0321f34279e00158320981f9ac263f1566bb, all 694 host-JVM tests pass with zero failures or skips. Formatting and detekt pass. Coverage includes response verification, factory/client behavior, and cache lifecycle. The request-mode assertions failed in observe and required modes before the fix. They now verify the buffered override and unchanged off-mode headers.

Tested commit	Validation	Result
DataDog/dd-sdk-android@1b8b0321f34279e00158320981f9ac263f1566bb	Manual native-provider probe: exact verifier classes against 52 response cases; Android 16/API 36 arm64 emulator, AndroidOpenSSL	52 passed, 0 failed, 0 skipped; application and transport lifecycle excluded

Production trust-anchor provisioning and deployed application validation remain release gates.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Make sure you discussed the feature or bugfix with the maintaining team in an Issue
• Make sure each commit and the PR mention the Issue number (cf the CONTRIBUTING doc)

[linear-code]

FFLSDK-267

[datadog-official]

 

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🔄 Datadog retried 1 test - 1 passed on retry

🎯 Code Coverage (details)
• Patch Coverage: 72.22%
• Overall Coverage: 71.93% (+0.10%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 1b8b032 | Docs | View more details | Give us feedback!}