Before you begin#
You need a profile from a deployment owner you intend to trust, the correct recipient device when sealed, and a separately trusted way to compare the owner’s full deployment fingerprint.
Preview → compare → confirm#
Choose the import explicitly
Open Profiles, then the add or QR action. The source supports bounded file, URI, clipboard, share-intent and QR admission. Do not paste production profiles into a website mockup.
Review the profile
Read the preview and any recipient, expiry or validity issue. A mismatched device or failed validation must not be bypassed.
Compare the deployment fingerprint
Use the complete code and an independently trusted channel to the intended owner. Do not compare only the first or last few characters.
Confirm trust and storage
Nothing should be silently accepted merely because you opened an import. Confirmation stores the accepted profile locally.
Select it, then return Home
Profile management and connection control are separate jobs. The Home state must reflect the actual runtime, not the animation.
What changed?#
| Outcome | What to expect |
|---|---|
| Accepted | The intended local profile is available for selection after explicit confirmation. |
| Duplicate | The existing copy stays unchanged. Do not repeatedly re-import it. |
| Older generation | Rollback checks reject an older replacement rather than silently downgrading. |
| Wrong device or invalid signature | Stop. Ask the owner for an appropriate signed profile for this device. |
| Revoked or expired | Changing the display, system clock or interface mode is not a way to restore authority. |
Validity is not identity#
Profile validity and owner trust are separate decisions.Implemented in sourceView evidence
- What this means
- A valid signature is not proof that a profile came from the person you intended.
- How the design works
- The Android import flow previews the profile, requires comparison of the deployment fingerprint, and confirms storage.
- The limit
- You need an independent, trusted way to compare the fingerprint. A code repeated by the same untrusted sender is not independent confirmation.
Reviewed . Source code alone is not release qualification.
Source and scope
Reviewed . The linked source describes the implementation; released-build evidence is a separate check.