|
| 1 | +--- |
| 2 | +title: "PWA Wrapper Security and Network Access" |
| 3 | +url: /refguide/mobile/pwa-wrapper/pwa-wrapper-security/ |
| 4 | +weight: 50 |
| 5 | +description: "Describes the network access and local filesystem scanning behavior of PWA Wrapper for security and IT reviewers." |
| 6 | +--- |
| 7 | + |
| 8 | +## Introduction |
| 9 | + |
| 10 | +This page describes two behaviors of PWA Wrapper that are relevant for security reviews and IT governance: what the extension downloads from the network during a build, and what local paths and environment variables it inspects to detect existing developer tool installations. |
| 11 | + |
| 12 | +This information is intended for security engineers, IT administrators, and other reviewers who need a precise account of what the extension does outside its own process boundary. It does not cover general build usage; for that, see [Build PWA Wrapper Apps](/refguide/mobile/pwa-wrapper/build-pwa-wrapper-apps/). |
| 13 | + |
| 14 | +## Network Downloads During Build |
| 15 | + |
| 16 | +PWA Wrapper itself does not download anything when it is installed or when Studio Pro starts. Network access happens at build time, through platform-standard build tooling, not through custom code in the extension. The following two downloads can occur on the first build for each respective platform. |
| 17 | + |
| 18 | +### Android: Gradle Wrapper Distribution |
| 19 | + |
| 20 | +Android builds are run via the Gradle Wrapper, which is standard for Android and Gradle-based projects. On the first Android build, the Gradle Wrapper checks whether the required Gradle distribution is already cached locally. If it is not, the wrapper downloads the following archive and caches it for all subsequent builds: |
| 21 | + |
| 22 | +| Property | Value | |
| 23 | +| --- | --- | |
| 24 | +| File | `gradle-8.9-bin.zip` | |
| 25 | +| URL | `https://services.gradle.org/distributions/gradle-8.9-bin.zip` | |
| 26 | +| Host | `services.gradle.org` (Gradle's official distribution server, operated by Gradle, Inc.) | |
| 27 | +| Cache location | `~/.gradle/wrapper/dists/gradle-8.9-bin/` | |
| 28 | +| Trigger | First Android build on a machine; not re-downloaded on subsequent builds or on extension install | |
| 29 | + |
| 30 | +This is standard Gradle Wrapper behavior, identical to any Gradle-based Android project. It is not custom logic added by PWA Wrapper. |
| 31 | + |
| 32 | +To avoid this download in air-gapped environments, pre-populate the Gradle wrapper cache directory before running the first build. |
| 33 | + |
| 34 | +## Bundled Binaries Executed Locally |
| 35 | + |
| 36 | +In addition to the runtime downloads above, PWA Wrapper ships the following binaries inside its own extension package. These are not downloaded at build time — they are included in the extension at install time and are invoked as local subprocesses during Android and HarmonyOS build, signing, and packaging steps. They run with the same operating-system privileges as the Studio Pro process. |
| 37 | + |
| 38 | +| Binary | Purpose | Platform | |
| 39 | +| --- | --- | --- | |
| 40 | +| `apktool.jar` | Decoding and rebuilding Android APKs | Android | |
| 41 | +| `bundletool.jar` | Building and manipulating Android App Bundles | Android | |
| 42 | +| `aapt2` / `aapt2.exe` | Android Asset Packaging Tool | Android | |
| 43 | +| `apksigner.jar` | APK signing | Android | |
| 44 | +| `android.jar` | Android SDK stub library used during compilation | Android | |
| 45 | + |
| 46 | +These binaries are third-party open-source tools redistributed with the extension. They are not fetched from the network at runtime. |
| 47 | + |
| 48 | +## Local Filesystem and Environment Scanning |
| 49 | + |
| 50 | +When the builder opens, PWA Wrapper inspects the local machine to auto-detect existing developer tool installations. This is a read-only discovery process: no data leaves the machine, and no files are created or modified. The scan is performed so users do not have to manually configure tool paths. |
| 51 | + |
| 52 | +### JDK Discovery |
| 53 | + |
| 54 | +PWA Wrapper needs a Java runtime to execute the build tools listed above. It searches for an installed JDK in the following order and uses the first usable result it finds. |
| 55 | + |
| 56 | +**On macOS:** |
| 57 | + |
| 58 | +| Step | Method | |
| 59 | +| --- | --- | |
| 60 | +| 1 | Read the `JAVA_HOME` environment variable, if set | |
| 61 | +| 2 | Run `/usr/libexec/java_home` — the operating-system JDK registry | |
| 62 | +| 3 | Resolve `java` on the shell `PATH` (equivalent to `which java`) | |
| 63 | +| 4 | Scan `/Library/Java/JavaVirtualMachines/` — the standard directory where installers such as Adoptium/Temurin, Oracle, and Azul place JDKs | |
| 64 | + |
| 65 | +**On Windows:** |
| 66 | + |
| 67 | +On Windows, JDK discovery does not scan directories. Instead it reads the output of `mx show-java-version` and inspects the Mendix Studio Pro settings database (`Settings.sqlite`) to find the JDK path configured in Studio Pro. |
| 68 | + |
| 69 | +If no usable JDK is found, the build fails with an error that instructs the user to install a JDK from [Adoptium](https://adoptium.net) or set `JAVA_HOME` manually. PWA Wrapper does not download a JDK on the user's behalf. |
| 70 | + |
| 71 | +### Mendix Studio Pro Discovery |
| 72 | + |
| 73 | +PWA Wrapper needs to locate the Mendix Studio Pro installation to access the runtime and SDK files it uses during the build. |
| 74 | + |
| 75 | +**On macOS:** The extension scans `/Applications/` and `~/Applications/` for app bundles whose names match "Mendix Studio Pro" or "Studio Pro". Among all matches that contain a valid `runtime/` subdirectory, it selects the one with the highest version number. |
| 76 | + |
| 77 | +**On Windows:** Auto-detection is not performed. The Studio Pro path must be provided explicitly via a CLI argument, a `.env` file, or a `.launch` file. |
| 78 | + |
| 79 | +## Summary for Reviewers |
| 80 | + |
| 81 | +| Category | What happens | When | Data leaves machine? | |
| 82 | +| --- | --- | --- | --- | |
| 83 | +| Gradle distribution download | Downloads `gradle-8.9-bin.zip` from `services.gradle.org` | First Android build only | No (download only; no data sent) | |
| 84 | +| Bundled binary execution | Runs `apktool.jar`, `bundletool.jar`, `aapt2`, `apksigner.jar`, `android.jar` locally | Every applicable build | No | |
| 85 | +| JDK filesystem scan | Reads `JAVA_HOME`, `/Library/Java/JavaVirtualMachines/`, version manager directories, or Windows Studio Pro settings | When the builder opens | No | |
| 86 | +| Studio Pro filesystem scan | Scans `/Applications/` and `~/Applications/` for Studio Pro app bundles (macOS only) | When the builder opens | No | |
| 87 | + |
| 88 | +PWA Wrapper makes no telemetry calls, analytics requests, or other network connections beyond the two build-time package downloads described above. |
0 commit comments