Bumped expiry date to 1 May 2017.

Store invitation outcome in metadata and make it available to the UI

This MR is based on !479 and should only be merged after that one has been merged as well.

It stores the invitation outcome in the message metadata  and includes it in the `canBeOpened()` calculation for private groups and sharables.

Closes #877

See merge request !480

.gitignore

@@ -21,3 +21,5 @@ local.properties
 .gradle
 build/
 *.iml
+.gitignore
+src/test/

.idea/codeStyleSettings.xml

@@ -31,6 +31,8 @@
           </value>
         </option>
         <option name="RIGHT_MARGIN" value="100" />
+        <option name="JD_ALIGN_PARAM_COMMENTS" value="false" />
+        <option name="JD_ALIGN_EXCEPTION_COMMENTS" value="false" />
         <AndroidXmlCodeStyleSettings>
           <option name="USE_CUSTOM_SETTINGS" value="true" />
         </AndroidXmlCodeStyleSettings>

LICENSE.txt

@@ -13,23 +13,6 @@
     You should have received a copy of the GNU General Public License
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
--------------------------------------------------------------------------
-
-    All files under the directories briar-android/src, briar-api/src,
-    briar-core/src, briar-desktop/src and briar-test/src are licensed
-    under the Apache License, version 2.0 (the "License"); you may not
-    use these files except in compliance with the License.
-
-    You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing, software
-    distributed under the License is distributed on an "AS IS" BASIS,
-    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-    implied. See the License for the specific language governing
-    permissions and limitations under the License.
-
 -------------------------------------------------------------------------
 
                     GNU GENERAL PUBLIC LICENSE

bramble-android/.gitignore

@@ -1,5 +1,5 @@
 bin
 gen
 build
-local.properties
 .settings
+src/main/res/raw/*.zip

bramble-android/build.gradle

@@ -0,0 +1,104 @@
+import de.undercouch.gradle.tasks.download.Download
+import de.undercouch.gradle.tasks.download.Verify
+
+apply plugin: 'com.android.library'
+apply plugin: 'witness'
+apply plugin: 'de.undercouch.download'
+
+android {
+	compileSdkVersion 23
+	buildToolsVersion "23.0.3"
+
+	defaultConfig {
+		minSdkVersion 14
+		targetSdkVersion 22
+		versionCode 1
+		versionName "1.0"
+		consumerProguardFiles 'proguard-rules.txt'
+	}
+
+	compileOptions {
+		sourceCompatibility JavaVersion.VERSION_1_7
+		targetCompatibility JavaVersion.VERSION_1_7
+	}
+}
+
+dependencies {
+	compile project(':bramble-core')
+	compile fileTree(dir: 'libs', include: ['*.jar'])
+	provided 'javax.annotation:jsr250-api:1.0'
+}
+
+def torBinaryDir = 'src/main/res/raw'
+
+task downloadTorGeoIp(type: Download) {
+	src 'https://briarproject.org/build/geoip-2015-12-01.zip'
+	dest "$torBinaryDir/geoip.zip"
+	onlyIfNewer true
+}
+
+task downloadTorBinaryArm(type: Download) {
+	src 'https://briarproject.org/build/tor-0.2.7.6-arm.zip'
+	dest "$torBinaryDir/tor_arm.zip"
+	onlyIfNewer true
+}
+
+task downloadTorBinaryArmPie(type: Download) {
+	src 'https://briarproject.org/build/tor-0.2.7.6-arm-pie.zip'
+	dest "$torBinaryDir/tor_arm_pie.zip"
+	onlyIfNewer true
+}
+
+task downloadTorBinaryX86(type: Download) {
+	src 'https://briarproject.org/build/tor-0.2.7.6-x86.zip'
+	dest "$torBinaryDir/tor_x86.zip"
+	onlyIfNewer true
+}
+
+task downloadTorBinaryX86Pie(type: Download) {
+	src 'https://briarproject.org/build/tor-0.2.7.6-x86-pie.zip'
+	dest "$torBinaryDir/tor_x86_pie.zip"
+	onlyIfNewer true
+}
+
+task verifyTorGeoIp(type: Verify, dependsOn: 'downloadTorGeoIp') {
+	src "$torBinaryDir/geoip.zip"
+	algorithm 'SHA-256'
+	checksum '9bcdaf0a7ba0933735328d8ec466c25c25dbb459efc2bce9e55c774eabea5162'
+}
+
+task verifyTorBinaryArm(type: Verify, dependsOn: 'downloadTorBinaryArm') {
+	src "$torBinaryDir/tor_arm.zip"
+	algorithm 'SHA-256'
+	checksum '83272962eda701cd5d74d2418651c4ff0f0b1dff51f558a292d1a1c42bf12146'
+}
+
+task verifyTorBinaryArmPie(type: Verify, dependsOn: 'downloadTorBinaryArmPie') {
+	src "$torBinaryDir/tor_arm_pie.zip"
+	algorithm 'SHA-256'
+	checksum 'd0300d1e45de11ebb24ed62b9c492be9c2e88590b7822195ab38c7a76ffcf646'
+}
+
+task verifyTorBinaryX86(type: Verify, dependsOn: 'downloadTorBinaryX86') {
+	src "$torBinaryDir/tor_x86.zip"
+	algorithm 'SHA-256'
+	checksum 'b8813d97b01ee1b9c9a4233c1b9bbe9f9f6b494ae6f9cbd84de8a3911911615e'
+}
+
+task verifyTorBinaryX86Pie(type: Verify, dependsOn: 'downloadTorBinaryX86Pie') {
+	src "$torBinaryDir/tor_x86_pie.zip"
+	algorithm 'SHA-256'
+	checksum '9c66e765aa196dc089951a1b2140cc8290305c2fcbf365121f99e01a233baf4e'
+}
+
+project.afterEvaluate {
+	preBuild.dependsOn {
+		[
+				'verifyTorGeoIp',
+				'verifyTorBinaryArm',
+				'verifyTorBinaryArmPie',
+				'verifyTorBinaryX86',
+				'verifyTorBinaryX86Pie'
+		]
+	}
+}

bramble-android/proguard-rules.txt

@@ -0,0 +1,15 @@
+-keep,includedescriptorclasses class org.briarproject.** { *; }
+
+-keep class org.h2.** { *; }
+-dontwarn org.h2.**
+-dontnote org.h2.**
+
+-keep class dagger.** { *; }
+-dontwarn dagger.**
+-dontnote dagger.**
+
+-dontwarn sun.misc.Unsafe
+-dontnote com.google.common.**
+
+# UPnP library isn't used
+-dontwarn org.bitlet.weupnp.**

bramble-android/src/main/AndroidManifest.xml

@@ -0,0 +1,24 @@
+<manifest
+	package="org.briarproject.bramble"
+	xmlns:android="http://schemas.android.com/apk/res/android">
+
+	<uses-feature android:name="android.hardware.bluetooth"/>
+
+	<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
+	<uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
+	<uses-permission android:name="android.permission.BLUETOOTH"/>
+	<uses-permission android:name="android.permission.BLUETOOTH_ADMIN"/>
+	<uses-permission android:name="android.permission.INTERNET"/>
+	<uses-permission android:name="android.permission.READ_LOGS"/>
+	<uses-permission android:name="android.permission.WAKE_LOCK"/>
+	<!-- Since API 23, this is needed to add contacts via Bluetooth -->
+	<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
+
+	<application
+		android:allowBackup="false"
+		android:label="@string/app_name"
+		android:supportsRtl="true">
+
+	</application>
+
+</manifest>

bramble-android/src/main/java/org/briarproject/bramble/BrambleAndroidModule.java

@@ -0,0 +1,13 @@
+package org.briarproject.bramble;
+
+import org.briarproject.bramble.plugin.AndroidPluginModule;
+import org.briarproject.bramble.system.AndroidSystemModule;
+
+import dagger.Module;
+
+@Module(includes = {
+		AndroidPluginModule.class,
+		AndroidSystemModule.class
+})
+public class BrambleAndroidModule {
+}

bramble-android/src/main/java/org/briarproject/bramble/api/system/AndroidExecutor.java

@@ -1,4 +1,4 @@
-package org.briarproject.android.api;
+package org.briarproject.bramble.api.system;
 
 import java.util.concurrent.Callable;
 import java.util.concurrent.Future;

bramble-android/src/main/java/org/briarproject/bramble/plugin/AndroidPluginModule.java

@@ -1,20 +1,21 @@
-package org.briarproject.plugins;
+package org.briarproject.bramble.plugin;
 
 import android.app.Application;
 import android.content.Context;
 
-import org.briarproject.android.api.AndroidExecutor;
+import org.briarproject.bramble.api.event.EventBus;
-import org.briarproject.api.event.EventBus;
+import org.briarproject.bramble.api.lifecycle.IoExecutor;
-import org.briarproject.api.lifecycle.IoExecutor;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.api.plugins.BackoffFactory;
+import org.briarproject.bramble.api.plugin.BackoffFactory;
-import org.briarproject.api.plugins.PluginConfig;
+import org.briarproject.bramble.api.plugin.PluginConfig;
-import org.briarproject.api.plugins.duplex.DuplexPluginFactory;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPluginFactory;
-import org.briarproject.api.plugins.simplex.SimplexPluginFactory;
+import org.briarproject.bramble.api.plugin.simplex.SimplexPluginFactory;
-import org.briarproject.api.reporting.DevReporter;
+import org.briarproject.bramble.api.reporting.DevReporter;
-import org.briarproject.api.system.LocationUtils;
+import org.briarproject.bramble.api.system.AndroidExecutor;
-import org.briarproject.plugins.droidtooth.DroidtoothPluginFactory;
+import org.briarproject.bramble.api.system.LocationUtils;
-import org.briarproject.plugins.tcp.AndroidLanTcpPluginFactory;
+import org.briarproject.bramble.plugin.droidtooth.DroidtoothPluginFactory;
-import org.briarproject.plugins.tor.TorPluginFactory;
+import org.briarproject.bramble.plugin.tcp.AndroidLanTcpPluginFactory;
+import org.briarproject.bramble.plugin.tor.TorPluginFactory;
 
 import java.security.SecureRandom;
 import java.util.Arrays;
@@ -28,10 +29,10 @@ import dagger.Module;
 import dagger.Provides;
 
 @Module
-public class AndroidPluginsModule {
+public class AndroidPluginModule {
 
 	@Provides
-	public PluginConfig providePluginConfig(@IoExecutor Executor ioExecutor,
+	PluginConfig providePluginConfig(@IoExecutor Executor ioExecutor,
 			AndroidExecutor androidExecutor, SecureRandom random,
 			SocketFactory torSocketFactory, BackoffFactory backoffFactory,
 			Application app, LocationUtils locationUtils, DevReporter reporter,
@@ -46,7 +47,8 @@ public class AndroidPluginsModule {
 				backoffFactory, appContext);
 		final Collection<DuplexPluginFactory> duplex =
 				Arrays.asList(bluetooth, tor, lan);
-		return new PluginConfig() {
+		@NotNullByDefault
+		PluginConfig pluginConfig = new PluginConfig() {
 
 			@Override
 			public Collection<DuplexPluginFactory> getDuplexFactories() {
@@ -58,5 +60,6 @@ public class AndroidPluginsModule {
 				return Collections.emptyList();
 			}
 		};
+		return pluginConfig;
 	}
 }

bramble-android/src/main/java/org/briarproject/bramble/plugin/droidtooth/DroidtoothPlugin.java

@@ -1,4 +1,4 @@
-package org.briarproject.plugins.droidtooth;
+package org.briarproject.bramble.plugin.droidtooth;
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
@@ -9,21 +9,26 @@ import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 
-import org.briarproject.android.api.AndroidExecutor;
+import org.briarproject.bramble.api.FormatException;
-import org.briarproject.android.util.AndroidUtils;
+import org.briarproject.bramble.api.contact.ContactId;
-import org.briarproject.api.TransportId;
+import org.briarproject.bramble.api.crypto.PseudoRandom;
-import org.briarproject.api.contact.ContactId;
+import org.briarproject.bramble.api.data.BdfList;
-import org.briarproject.api.crypto.PseudoRandom;
+import org.briarproject.bramble.api.keyagreement.KeyAgreementConnection;
-import org.briarproject.api.keyagreement.KeyAgreementConnection;
+import org.briarproject.bramble.api.keyagreement.KeyAgreementListener;
-import org.briarproject.api.keyagreement.KeyAgreementListener;
+import org.briarproject.bramble.api.nullsafety.MethodsNotNullByDefault;
-import org.briarproject.api.keyagreement.TransportDescriptor;
+import org.briarproject.bramble.api.nullsafety.ParametersNotNullByDefault;
-import org.briarproject.api.plugins.Backoff;
+import org.briarproject.bramble.api.plugin.Backoff;
-import org.briarproject.api.plugins.duplex.DuplexPlugin;
+import org.briarproject.bramble.api.plugin.PluginException;
-import org.briarproject.api.plugins.duplex.DuplexPluginCallback;
+import org.briarproject.bramble.api.plugin.TransportId;
-import org.briarproject.api.plugins.duplex.DuplexTransportConnection;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPlugin;
-import org.briarproject.api.properties.TransportProperties;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPluginCallback;
-import org.briarproject.util.StringUtils;
+import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
+import org.briarproject.bramble.api.properties.TransportProperties;
+import org.briarproject.bramble.api.system.AndroidExecutor;
+import org.briarproject.bramble.util.AndroidUtils;
+import org.briarproject.bramble.util.StringUtils;
 
+import java.io.Closeable;
 import java.io.IOException;
 import java.io.InputStream;
 import java.security.SecureRandom;
@@ -36,6 +41,7 @@ import java.util.Map.Entry;
 import java.util.UUID;
 import java.util.concurrent.Callable;
 import java.util.concurrent.CompletionService;
+import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.Executor;
@@ -44,6 +50,8 @@ import java.util.concurrent.Future;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.logging.Logger;
 
+import javax.annotation.Nullable;
+
 import static android.bluetooth.BluetoothAdapter.ACTION_SCAN_MODE_CHANGED;
 import static android.bluetooth.BluetoothAdapter.ACTION_STATE_CHANGED;
 import static android.bluetooth.BluetoothAdapter.EXTRA_SCAN_MODE;
@@ -57,24 +65,24 @@ import static android.bluetooth.BluetoothDevice.EXTRA_DEVICE;
 import static java.util.concurrent.TimeUnit.MILLISECONDS;
 import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.WARNING;
-import static org.briarproject.util.PrivacyUtils.scrubMacAddress;
+import static org.briarproject.bramble.api.keyagreement.KeyAgreementConstants.TRANSPORT_ID_BLUETOOTH;
+import static org.briarproject.bramble.api.plugin.BluetoothConstants.ID;
+import static org.briarproject.bramble.api.plugin.BluetoothConstants.PROP_ADDRESS;
+import static org.briarproject.bramble.api.plugin.BluetoothConstants.PROP_UUID;
+import static org.briarproject.bramble.api.plugin.BluetoothConstants.UUID_BYTES;
+import static org.briarproject.bramble.util.PrivacyUtils.scrubMacAddress;
 
+@MethodsNotNullByDefault
+@ParametersNotNullByDefault
 class DroidtoothPlugin implements DuplexPlugin {
 
-	// Share an ID with the J2SE Bluetooth plugin
-	static final TransportId ID = new TransportId("bt");
-
 	private static final Logger LOG =
 			Logger.getLogger(DroidtoothPlugin.class.getName());
-	private static final int UUID_BYTES = 16;
 	private static final String FOUND =
 			"android.bluetooth.device.action.FOUND";
 	private static final String DISCOVERY_FINISHED =
 			"android.bluetooth.adapter.action.DISCOVERY_FINISHED";
 
-	private static final String PROP_ADDRESS = "address";
-	private static final String PROP_UUID = "uuid";
-
 	private final Executor ioExecutor;
 	private final AndroidExecutor androidExecutor;
 	private final Context appContext;
@@ -121,7 +129,7 @@ class DroidtoothPlugin implements DuplexPlugin {
 	}
 
 	@Override
-	public boolean start() throws IOException {
+	public void start() throws PluginException {
 		if (used.getAndSet(true)) throw new IllegalStateException();
 		// BluetoothAdapter.getDefaultAdapter() must be called on a thread
 		// with a message queue, so submit it to the AndroidExecutor
@@ -135,13 +143,14 @@ class DroidtoothPlugin implements DuplexPlugin {
 					}).get();
 		} catch (InterruptedException e) {
 			Thread.currentThread().interrupt();
-			throw new IOException("Interrupted while getting BluetoothAdapter");
+			LOG.warning("Interrupted while getting BluetoothAdapter");
+			throw new PluginException(e);
 		} catch (ExecutionException e) {
-			throw new IOException(e);
+			throw new PluginException(e);
 		}
 		if (adapter == null) {
 			LOG.info("Bluetooth is not supported");
-			return false;
+			throw new PluginException();
 		}
 		running = true;
 		// Listen for changes to the Bluetooth state
@@ -163,7 +172,6 @@ class DroidtoothPlugin implements DuplexPlugin {
 				LOG.info("Not enabling Bluetooth");
 			}
 		}
-		return true;
 	}
 
 	private void bind() {
@@ -217,7 +225,7 @@ class DroidtoothPlugin implements DuplexPlugin {
 		return UUID.fromString(uuid);
 	}
 
-	private void tryToClose(BluetoothServerSocket ss) {
+	private void tryToClose(@Nullable BluetoothServerSocket ss) {
 		try {
 			if (ss != null) ss.close();
 		} catch (IOException e) {
@@ -305,6 +313,7 @@ class DroidtoothPlugin implements DuplexPlugin {
 		}
 	}
 
+	@Nullable
 	private BluetoothSocket connect(String address, String uuid) {
 		// Validate the address
 		if (!BluetoothAdapter.checkBluetoothAddress(address)) {
@@ -333,16 +342,18 @@ class DroidtoothPlugin implements DuplexPlugin {
 				LOG.info("Connected to " + scrubMacAddress(address));
 			return s;
 		} catch (IOException e) {
-			if (LOG.isLoggable(INFO))
+			if (LOG.isLoggable(INFO)) {
-				LOG.info("Failed to connect to " + scrubMacAddress(address));
+				LOG.info("Failed to connect to " + scrubMacAddress(address)
+						+ ": " + e);
+			}
 			tryToClose(s);
 			return null;
 		}
 	}
 
-	private void tryToClose(BluetoothSocket s) {
+	private void tryToClose(@Nullable Closeable c) {
 		try {
-			if (s != null) s.close();
+			if (c != null) c.close();
 		} catch (IOException e) {
 			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 		}
@@ -379,7 +390,7 @@ class DroidtoothPlugin implements DuplexPlugin {
 		BluetoothServerSocket ss;
 		try {
 			ss = adapter.listenUsingInsecureRfcommWithServiceRecord(
-					"RFCOMM", getUuid());
+					"RFCOMM", uuid);
 		} catch (IOException e) {
 			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 			return null;
@@ -420,7 +431,7 @@ class DroidtoothPlugin implements DuplexPlugin {
 	}
 
 	private void closeSockets(final List<Future<BluetoothSocket>> futures,
-			final BluetoothSocket chosen) {
+			@Nullable final BluetoothSocket chosen) {
 		ioExecutor.execute(new Runnable() {
 			@Override
 			public void run() {
@@ -454,6 +465,9 @@ class DroidtoothPlugin implements DuplexPlugin {
 	@Override
 	public KeyAgreementListener createKeyAgreementListener(byte[] commitment) {
 		if (!isRunning()) return null;
+		// There's no point listening if we can't discover our own address
+		String address = AndroidUtils.getBluetoothAddress(appContext, adapter);
+		if (address.isEmpty()) return null;
 		// No truncation necessary because COMMIT_LENGTH = 16
 		UUID uuid = UUID.nameUUIDFromBytes(commitment);
 		if (LOG.isLoggable(INFO)) LOG.info("Key agreement UUID " + uuid);
@@ -461,28 +475,28 @@ class DroidtoothPlugin implements DuplexPlugin {
 		BluetoothServerSocket ss;
 		try {
 			ss = adapter.listenUsingInsecureRfcommWithServiceRecord(
-					"RFCOMM", getUuid());
+					"RFCOMM", uuid);
 		} catch (IOException e) {
 			if (LOG.isLoggable(WARNING)) LOG.log(WARNING, e.toString(), e);
 			return null;
 		}
-		TransportProperties p = new TransportProperties();
+		BdfList descriptor = new BdfList();
-		String address = AndroidUtils.getBluetoothAddress(appContext, adapter);
+		descriptor.add(TRANSPORT_ID_BLUETOOTH);
-		if (!StringUtils.isNullOrEmpty(address))
+		descriptor.add(StringUtils.macToBytes(address));
-			p.put(PROP_ADDRESS, address);
+		return new BluetoothKeyAgreementListener(descriptor, ss);
-		TransportDescriptor d = new TransportDescriptor(ID, p);
-		return new BluetoothKeyAgreementListener(d, ss);
 	}
 
 	@Override
 	public DuplexTransportConnection createKeyAgreementConnection(
-			byte[] commitment, TransportDescriptor d, long timeout) {
+			byte[] commitment, BdfList descriptor, long timeout) {
 		if (!isRunning()) return null;
-		if (!ID.equals(d.getIdentifier())) return null;
+		String address;
-		TransportProperties p = d.getProperties();
+		try {
-		if (p == null) return null;
+			address = parseAddress(descriptor);
-		String address = p.get(PROP_ADDRESS);
+		} catch (FormatException e) {
-		if (StringUtils.isNullOrEmpty(address)) return null;
+			LOG.info("Invalid address in key agreement descriptor");
+			return null;
+		}
 		// No truncation necessary because COMMIT_LENGTH = 16
 		UUID uuid = UUID.nameUUIDFromBytes(commitment);
 		if (LOG.isLoggable(INFO))
@@ -492,6 +506,12 @@ class DroidtoothPlugin implements DuplexPlugin {
 		return new DroidtoothTransportConnection(this, s);
 	}
 
+	private String parseAddress(BdfList descriptor) throws FormatException {
+		byte[] mac = descriptor.getRaw(1);
+		if (mac.length != 6) throw new FormatException();
+		return StringUtils.macToString(mac);
+	}
+
 	private class BluetoothStateReceiver extends BroadcastReceiver {
 
 		@Override
@@ -560,7 +580,7 @@ class DroidtoothPlugin implements DuplexPlugin {
 	private static class DiscoveryReceiver extends BroadcastReceiver {
 
 		private final CountDownLatch finished = new CountDownLatch(1);
-		private final List<String> addresses = new ArrayList<>();
+		private final List<String> addresses = new CopyOnWriteArrayList<>();
 
 		@Override
 		public void onReceive(Context ctx, Intent intent) {
@@ -571,17 +591,19 @@ class DroidtoothPlugin implements DuplexPlugin {
 				finished.countDown();
 			} else if (action.equals(FOUND)) {
 				BluetoothDevice d = intent.getParcelableExtra(EXTRA_DEVICE);
-				if (LOG.isLoggable(INFO))
+				if (LOG.isLoggable(INFO)) {
 					LOG.info("Discovered device: " +
 							scrubMacAddress(d.getAddress()));
+				}
 				addresses.add(d.getAddress());
 			}
 		}
 
 		private List<String> waitForAddresses() throws InterruptedException {
 			finished.await();
-			Collections.shuffle(addresses);
+			List<String> shuffled = new ArrayList<>(addresses);
-			return Collections.unmodifiableList(addresses);
+			Collections.shuffle(shuffled);
+			return shuffled;
 		}
 	}
 
@@ -626,7 +648,7 @@ class DroidtoothPlugin implements DuplexPlugin {
 
 		private final BluetoothServerSocket ss;
 
-		BluetoothKeyAgreementListener(TransportDescriptor descriptor,
+		private BluetoothKeyAgreementListener(BdfList descriptor,
 				BluetoothServerSocket ss) {
 			super(descriptor);
 			this.ss = ss;

bramble-android/src/main/java/org/briarproject/bramble/plugin/droidtooth/DroidtoothPluginFactory.java

@@ -1,18 +1,25 @@
-package org.briarproject.plugins.droidtooth;
+package org.briarproject.bramble.plugin.droidtooth;
 
 import android.content.Context;
 
-import org.briarproject.android.api.AndroidExecutor;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.api.TransportId;
+import org.briarproject.bramble.api.plugin.Backoff;
-import org.briarproject.api.plugins.Backoff;
+import org.briarproject.bramble.api.plugin.BackoffFactory;
-import org.briarproject.api.plugins.BackoffFactory;
+import org.briarproject.bramble.api.plugin.TransportId;
-import org.briarproject.api.plugins.duplex.DuplexPlugin;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPlugin;
-import org.briarproject.api.plugins.duplex.DuplexPluginCallback;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPluginCallback;
-import org.briarproject.api.plugins.duplex.DuplexPluginFactory;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPluginFactory;
+import org.briarproject.bramble.api.system.AndroidExecutor;
 
 import java.security.SecureRandom;
 import java.util.concurrent.Executor;
 
+import javax.annotation.concurrent.Immutable;
+
+import static org.briarproject.bramble.api.plugin.BluetoothConstants.ID;
+
+@Immutable
+@NotNullByDefault
 public class DroidtoothPluginFactory implements DuplexPluginFactory {
 
 	private static final int MAX_LATENCY = 30 * 1000; // 30 seconds
@@ -38,7 +45,7 @@ public class DroidtoothPluginFactory implements DuplexPluginFactory {
 
 	@Override
 	public TransportId getId() {
-		return DroidtoothPlugin.ID;
+		return ID;
 	}
 
 	@Override

bramble-android/src/main/java/org/briarproject/bramble/plugin/droidtooth/DroidtoothTransportConnection.java

@@ -1,14 +1,16 @@
-package org.briarproject.plugins.droidtooth;
+package org.briarproject.bramble.plugin.droidtooth;
 
 import android.bluetooth.BluetoothSocket;
 
-import org.briarproject.api.plugins.Plugin;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.api.plugins.duplex.AbstractDuplexTransportConnection;
+import org.briarproject.bramble.api.plugin.Plugin;
+import org.briarproject.bramble.api.plugin.duplex.AbstractDuplexTransportConnection;
 
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 
+@NotNullByDefault
 class DroidtoothTransportConnection extends AbstractDuplexTransportConnection {
 
 	private final BluetoothSocket socket;

bramble-android/src/main/java/org/briarproject/bramble/plugin/tcp/AndroidLanTcpPlugin.java

@@ -1,4 +1,4 @@
-package org.briarproject.plugins.tcp;
+package org.briarproject.bramble.plugin.tcp;
 
 import android.content.BroadcastReceiver;
 import android.content.Context;
@@ -7,16 +7,20 @@ import android.content.IntentFilter;
 import android.net.ConnectivityManager;
 import android.net.NetworkInfo;
 
-import org.briarproject.api.plugins.Backoff;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.api.plugins.duplex.DuplexPluginCallback;
+import org.briarproject.bramble.api.plugin.Backoff;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPluginCallback;
 
 import java.util.concurrent.Executor;
 import java.util.logging.Logger;
 
+import javax.annotation.Nullable;
+
 import static android.content.Context.CONNECTIVITY_SERVICE;
 import static android.net.ConnectivityManager.CONNECTIVITY_ACTION;
 import static android.net.ConnectivityManager.TYPE_WIFI;
 
+@NotNullByDefault
 class AndroidLanTcpPlugin extends LanTcpPlugin {
 
 	private static final Logger LOG =
@@ -24,6 +28,7 @@ class AndroidLanTcpPlugin extends LanTcpPlugin {
 
 	private final Context appContext;
 
+	@Nullable
 	private volatile BroadcastReceiver networkStateReceiver = null;
 
 	AndroidLanTcpPlugin(Executor ioExecutor, Backoff backoff,
@@ -34,14 +39,13 @@ class AndroidLanTcpPlugin extends LanTcpPlugin {
 	}
 
 	@Override
-	public boolean start() {
+	public void start() {
 		if (used.getAndSet(true)) throw new IllegalStateException();
 		running = true;
 		// Register to receive network status events
 		networkStateReceiver = new NetworkStateReceiver();
 		IntentFilter filter = new IntentFilter(CONNECTIVITY_ACTION);
 		appContext.registerReceiver(networkStateReceiver, filter);
-		return true;
 	}
 
 	@Override

bramble-android/src/main/java/org/briarproject/bramble/plugin/tcp/AndroidLanTcpPluginFactory.java

@@ -1,16 +1,23 @@
-package org.briarproject.plugins.tcp;
+package org.briarproject.bramble.plugin.tcp;
 
 import android.content.Context;
 
-import org.briarproject.api.TransportId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.api.plugins.Backoff;
+import org.briarproject.bramble.api.plugin.Backoff;
-import org.briarproject.api.plugins.BackoffFactory;
+import org.briarproject.bramble.api.plugin.BackoffFactory;
-import org.briarproject.api.plugins.duplex.DuplexPlugin;
+import org.briarproject.bramble.api.plugin.TransportId;
-import org.briarproject.api.plugins.duplex.DuplexPluginCallback;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPlugin;
-import org.briarproject.api.plugins.duplex.DuplexPluginFactory;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPluginCallback;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPluginFactory;
 
 import java.util.concurrent.Executor;
 
+import javax.annotation.concurrent.Immutable;
+
+import static org.briarproject.bramble.api.plugin.LanTcpConstants.ID;
+
+@Immutable
+@NotNullByDefault
 public class AndroidLanTcpPluginFactory implements DuplexPluginFactory {
 
 	private static final int MAX_LATENCY = 30 * 1000; // 30 seconds
@@ -32,7 +39,7 @@ public class AndroidLanTcpPluginFactory implements DuplexPluginFactory {
 
 	@Override
 	public TransportId getId() {
-		return LanTcpPlugin.ID;
+		return ID;
 	}
 
 	@Override

bramble-android/src/main/java/org/briarproject/bramble/plugin/tor/TorNetworkMetadata.java

@@ -1,18 +1,18 @@
-package org.briarproject.plugins.tor;
+package org.briarproject.bramble.plugin.tor;
 
 import java.util.Arrays;
 import java.util.HashSet;
 import java.util.Set;
 
-public class TorNetworkMetadata {
+class TorNetworkMetadata {
 
 	// See https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
 	// and https://trac.torproject.org/projects/tor/wiki/doc/OONI/censorshipwiki
 	// TODO: get a more complete list
 	private static final Set<String> BLOCKED_IN_COUNTRIES =
-			new HashSet<String>(Arrays.asList("CN", "IR", "SY", "ZZ"));
+			new HashSet<>(Arrays.asList("CN", "IR", "SY", "ZZ"));
 
-	public static boolean isTorProbablyBlocked(String countryCode) {
+	static boolean isTorProbablyBlocked(String countryCode) {
 		return BLOCKED_IN_COUNTRIES.contains(countryCode);
 	}
 }

bramble-android/src/main/java/org/briarproject/bramble/plugin/tor/TorPlugin.java

@@ -1,4 +1,4 @@
-package org.briarproject.plugins.tor;
+package org.briarproject.bramble.plugin.tor;
 
 import android.content.BroadcastReceiver;
 import android.content.Context;
@@ -7,6 +7,7 @@ import android.content.IntentFilter;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.content.pm.PackageManager.NameNotFoundException;
+import android.content.res.Resources;
 import android.net.ConnectivityManager;
 import android.net.NetworkInfo;
 import android.os.FileObserver;
@@ -15,26 +16,29 @@ import android.os.PowerManager;
 import net.freehaven.tor.control.EventHandler;
 import net.freehaven.tor.control.TorControlConnection;
 
-import org.briarproject.android.util.AndroidUtils;
+import org.briarproject.bramble.api.contact.ContactId;
-import org.briarproject.api.TransportId;
+import org.briarproject.bramble.api.crypto.PseudoRandom;
-import org.briarproject.api.contact.ContactId;
+import org.briarproject.bramble.api.data.BdfList;
-import org.briarproject.api.crypto.PseudoRandom;
+import org.briarproject.bramble.api.event.Event;
-import org.briarproject.api.event.Event;
+import org.briarproject.bramble.api.event.EventListener;
-import org.briarproject.api.event.EventListener;
+import org.briarproject.bramble.api.keyagreement.KeyAgreementListener;
-import org.briarproject.api.event.SettingsUpdatedEvent;
+import org.briarproject.bramble.api.nullsafety.MethodsNotNullByDefault;
-import org.briarproject.api.keyagreement.KeyAgreementListener;
+import org.briarproject.bramble.api.nullsafety.ParametersNotNullByDefault;
-import org.briarproject.api.keyagreement.TransportDescriptor;
+import org.briarproject.bramble.api.plugin.Backoff;
-import org.briarproject.api.plugins.Backoff;
+import org.briarproject.bramble.api.plugin.PluginException;
-import org.briarproject.api.plugins.TorConstants;
+import org.briarproject.bramble.api.plugin.TorConstants;
-import org.briarproject.api.plugins.duplex.DuplexPlugin;
+import org.briarproject.bramble.api.plugin.TransportId;
-import org.briarproject.api.plugins.duplex.DuplexPluginCallback;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPlugin;
-import org.briarproject.api.plugins.duplex.DuplexTransportConnection;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPluginCallback;
-import org.briarproject.api.properties.TransportProperties;
+import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
-import org.briarproject.api.reporting.DevReporter;
+import org.briarproject.bramble.api.properties.TransportProperties;
-import org.briarproject.api.settings.Settings;
+import org.briarproject.bramble.api.reporting.DevReporter;
-import org.briarproject.api.system.LocationUtils;
+import org.briarproject.bramble.api.settings.Settings;
-import org.briarproject.util.IoUtils;
+import org.briarproject.bramble.api.settings.event.SettingsUpdatedEvent;
-import org.briarproject.util.StringUtils;
+import org.briarproject.bramble.api.system.LocationUtils;
+import org.briarproject.bramble.util.AndroidUtils;
+import org.briarproject.bramble.util.IoUtils;
+import org.briarproject.bramble.util.StringUtils;
 
 import java.io.Closeable;
 import java.io.EOFException;
@@ -60,6 +64,7 @@ import java.util.logging.Logger;
 import java.util.regex.Pattern;
 import java.util.zip.ZipInputStream;
 
+import javax.annotation.Nullable;
 import javax.net.SocketFactory;
 
 import static android.content.Context.CONNECTIVITY_SERVICE;
@@ -73,9 +78,11 @@ import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.WARNING;
 import static net.freehaven.tor.control.TorControlCommands.HS_ADDRESS;
 import static net.freehaven.tor.control.TorControlCommands.HS_PRIVKEY;
-import static org.briarproject.api.plugins.TorConstants.CONTROL_PORT;
+import static org.briarproject.bramble.api.plugin.TorConstants.CONTROL_PORT;
-import static org.briarproject.util.PrivacyUtils.scrubOnion;
+import static org.briarproject.bramble.util.PrivacyUtils.scrubOnion;
 
+@MethodsNotNullByDefault
+@ParametersNotNullByDefault
 class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 
 	private static final String PROP_ONION = "onion";
@@ -156,14 +163,18 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 	}
 
 	@Override
-	public boolean start() throws IOException {
+	public void start() throws PluginException {
 		if (used.getAndSet(true)) throw new IllegalStateException();
 		// Install or update the assets if necessary
 		if (!assetsAreUpToDate()) installAssets();
 		LOG.info("Starting Tor");
 		// Watch for the auth cookie file being updated
+		try {
 			cookieFile.getParentFile().mkdirs();
 			cookieFile.createNewFile();
+		} catch (IOException e) {
+			throw new PluginException(e);
+		}
 		CountDownLatch latch = new CountDownLatch(1);
 		FileObserver obs = new WriteObserver(cookieFile, latch);
 		obs.startWatching();
@@ -176,8 +187,8 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 		Process torProcess;
 		try {
 			torProcess = Runtime.getRuntime().exec(cmd, env, torDirectory);
-		} catch (SecurityException e) {
+		} catch (SecurityException | IOException e) {
-			throw new IOException(e);
+			throw new PluginException(e);
 		}
 		// Log the process's standard output until it detaches
 		if (LOG.isLoggable(INFO)) {
@@ -191,19 +202,20 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 			if (exit != 0) {
 				if (LOG.isLoggable(WARNING))
 					LOG.warning("Tor exited with value " + exit);
-				return false;
+				throw new PluginException();
 			}
 			// Wait for the auth cookie file to be created/updated
 			if (!latch.await(COOKIE_TIMEOUT, MILLISECONDS)) {
 				LOG.warning("Auth cookie not created");
 				if (LOG.isLoggable(INFO)) listFiles(torDirectory);
-				return false;
+				throw new PluginException();
 			}
 		} catch (InterruptedException e) {
 			LOG.warning("Interrupted while starting Tor");
 			Thread.currentThread().interrupt();
-			return false;
+			throw new PluginException();
 		}
+		try {
 			// Open a control connection and authenticate using the cookie file
 			controlSocket = new Socket("127.0.0.1", CONTROL_PORT);
 			controlConnection = new TorControlConnection(controlSocket);
@@ -221,13 +233,15 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 				LOG.info("Tor has already bootstrapped");
 				connectionStatus.setBootstrapped();
 			}
+		} catch (IOException e) {
+			throw new PluginException(e);
+		}
 		// Register to receive network status events
 		networkStateReceiver = new NetworkStateReceiver();
 		IntentFilter filter = new IntentFilter(CONNECTIVITY_ACTION);
 		appContext.registerReceiver(networkStateReceiver, filter);
 		// Bind a server socket to receive incoming hidden service connections
 		bind();
-		return true;
 	}
 
 	private boolean assetsAreUpToDate() {
@@ -240,7 +254,7 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 		}
 	}
 
-	private void installAssets() throws IOException {
+	private void installAssets() throws PluginException {
 		InputStream in = null;
 		OutputStream out = null;
 		try {
@@ -248,48 +262,54 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 			// Unzip the Tor binary to the filesystem
 			in = getTorInputStream();
 			out = new FileOutputStream(torFile);
-			IoUtils.copy(in, out);
+			IoUtils.copyAndClose(in, out);
 			// Make the Tor binary executable
 			if (!torFile.setExecutable(true, true)) throw new IOException();
 			// Unzip the GeoIP database to the filesystem
 			in = getGeoIpInputStream();
 			out = new FileOutputStream(geoIpFile);
-			IoUtils.copy(in, out);
+			IoUtils.copyAndClose(in, out);
 			// Copy the config file to the filesystem
 			in = getConfigInputStream();
 			out = new FileOutputStream(configFile);
-			IoUtils.copy(in, out);
+			IoUtils.copyAndClose(in, out);
 			doneFile.createNewFile();
 		} catch (IOException e) {
 			tryToClose(in);
 			tryToClose(out);
-			throw e;
+			throw new PluginException(e);
 		}
 	}
 
 	private InputStream getTorInputStream() throws IOException {
 		if (LOG.isLoggable(INFO))
 			LOG.info("Installing Tor binary for " + architecture);
-		String filename = "tor-" + architecture + ".zip";
+		int resId = getResourceId("tor_" + architecture);
-		InputStream in = appContext.getResources().getAssets().open(filename);
+		InputStream in = appContext.getResources().openRawResource(resId);
 		ZipInputStream zin = new ZipInputStream(in);
 		if (zin.getNextEntry() == null) throw new IOException();
 		return zin;
 	}
 
 	private InputStream getGeoIpInputStream() throws IOException {
-		String filename = "geoip.zip";
+		int resId = getResourceId("geoip");
-		InputStream in = appContext.getResources().getAssets().open(filename);
+		InputStream in = appContext.getResources().openRawResource(resId);
 		ZipInputStream zin = new ZipInputStream(in);
 		if (zin.getNextEntry() == null) throw new IOException();
 		return zin;
 	}
 
 	private InputStream getConfigInputStream() throws IOException {
-		return appContext.getResources().getAssets().open("torrc");
+		int resId = getResourceId("torrc");
+		return appContext.getResources().openRawResource(resId);
 	}
 
-	private void tryToClose(Closeable c) {
+	private int getResourceId(String filename) {
+		Resources res = appContext.getResources();
+		return res.getIdentifier(filename, "raw", appContext.getPackageName());
+	}
+
+	private void tryToClose(@Nullable Closeable c) {
 		try {
 			if (c != null) c.close();
 		} catch (IOException e) {
@@ -297,7 +317,7 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 		}
 	}
 
-	private void tryToClose(Socket s) {
+	private void tryToClose(@Nullable Socket s) {
 		try {
 			if (s != null) s.close();
 		} catch (IOException e) {
@@ -306,8 +326,12 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 	}
 
 	private void listFiles(File f) {
-		if (f.isDirectory()) for (File child : f.listFiles()) listFiles(child);
+		if (f.isDirectory()) {
-		else LOG.info(f.getAbsolutePath());
+			File[] children = f.listFiles();
+			if (children != null) for (File child : children) listFiles(child);
+		} else {
+			LOG.info(f.getAbsolutePath());
+		}
 	}
 
 	private byte[] read(File f) throws IOException {
@@ -322,7 +346,7 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 			}
 			return b;
 		} finally {
-			in.close();
+			tryToClose(in);
 		}
 	}
 
@@ -381,7 +405,7 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 		});
 	}
 
-	private void tryToClose(ServerSocket ss) {
+	private void tryToClose(@Nullable ServerSocket ss) {
 		try {
 			if (ss != null) ss.close();
 		} catch (IOException e) {
@@ -460,7 +484,7 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 	}
 
 	@Override
-	public void stop() throws IOException {
+	public void stop() throws PluginException {
 		running = false;
 		tryToClose(socket);
 		if (networkStateReceiver != null)
@@ -570,7 +594,7 @@ class TorPlugin implements DuplexPlugin, EventHandler, EventListener {
 
 	@Override
 	public DuplexTransportConnection createKeyAgreementConnection(
-			byte[] commitment, TransportDescriptor d, long timeout) {
+			byte[] commitment, BdfList descriptor, long timeout) {
 		throw new UnsupportedOperationException();
 	}
 

bramble-android/src/main/java/org/briarproject/bramble/plugin/tor/TorPluginFactory.java

@@ -1,25 +1,29 @@
-package org.briarproject.plugins.tor;
+package org.briarproject.bramble.plugin.tor;
 
 import android.content.Context;
 import android.os.Build;
 
-import org.briarproject.android.util.AndroidUtils;
+import org.briarproject.bramble.api.event.EventBus;
-import org.briarproject.api.TransportId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.api.event.EventBus;
+import org.briarproject.bramble.api.plugin.Backoff;
-import org.briarproject.api.plugins.Backoff;
+import org.briarproject.bramble.api.plugin.BackoffFactory;
-import org.briarproject.api.plugins.BackoffFactory;
+import org.briarproject.bramble.api.plugin.TorConstants;
-import org.briarproject.api.plugins.TorConstants;
+import org.briarproject.bramble.api.plugin.TransportId;
-import org.briarproject.api.plugins.duplex.DuplexPlugin;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPlugin;
-import org.briarproject.api.plugins.duplex.DuplexPluginCallback;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPluginCallback;
-import org.briarproject.api.plugins.duplex.DuplexPluginFactory;
+import org.briarproject.bramble.api.plugin.duplex.DuplexPluginFactory;
-import org.briarproject.api.reporting.DevReporter;
+import org.briarproject.bramble.api.reporting.DevReporter;
-import org.briarproject.api.system.LocationUtils;
+import org.briarproject.bramble.api.system.LocationUtils;
+import org.briarproject.bramble.util.AndroidUtils;
 
 import java.util.concurrent.Executor;
 import java.util.logging.Logger;
 
+import javax.annotation.concurrent.Immutable;
 import javax.net.SocketFactory;
 
+@Immutable
+@NotNullByDefault
 public class TorPluginFactory implements DuplexPluginFactory {
 
 	private static final Logger LOG =
@@ -81,7 +85,7 @@ public class TorPluginFactory implements DuplexPluginFactory {
 			return null;
 		}
 		// Use position-independent executable for SDK >= 16
-		if (Build.VERSION.SDK_INT >= 16) architecture += "-pie";
+		if (Build.VERSION.SDK_INT >= 16) architecture += "_pie";
 
 		Backoff backoff = backoffFactory.createBackoff(MIN_POLLING_INTERVAL,
 				MAX_POLLING_INTERVAL, BACKOFF_BASE);

bramble-android/src/main/java/org/briarproject/bramble/plugin/tor/TorTransportConnection.java

@@ -1,13 +1,15 @@
-package org.briarproject.plugins.tor;
+package org.briarproject.bramble.plugin.tor;
 
-import org.briarproject.api.plugins.Plugin;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.api.plugins.duplex.AbstractDuplexTransportConnection;
+import org.briarproject.bramble.api.plugin.Plugin;
+import org.briarproject.bramble.api.plugin.duplex.AbstractDuplexTransportConnection;
 
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.net.Socket;
 
+@NotNullByDefault
 class TorTransportConnection extends AbstractDuplexTransportConnection {
 
 	private final Socket socket;

bramble-android/src/main/java/org/briarproject/bramble/system/AndroidExecutorImpl.java

@@ -1,10 +1,10 @@
-package org.briarproject.system;
+package org.briarproject.bramble.system;
 
 import android.app.Application;
 import android.os.Handler;
 import android.os.Looper;
 
-import org.briarproject.android.api.AndroidExecutor;
+import org.briarproject.bramble.api.system.AndroidExecutor;
 
 import java.util.concurrent.Callable;
 import java.util.concurrent.CountDownLatch;

bramble-android/src/main/java/org/briarproject/bramble/system/AndroidLocationUtils.java

@@ -1,4 +1,4 @@
-package org.briarproject.system;
+package org.briarproject.bramble.system;
 
 import android.annotation.SuppressLint;
 import android.app.Application;
@@ -6,7 +6,8 @@ import android.content.Context;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
 
-import org.briarproject.api.system.LocationUtils;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.system.LocationUtils;
 
 import java.util.Locale;
 import java.util.logging.Logger;
@@ -15,6 +16,7 @@ import javax.inject.Inject;
 
 import static android.content.Context.TELEPHONY_SERVICE;
 
+@NotNullByDefault
 class AndroidLocationUtils implements LocationUtils {
 
 	private static final Logger LOG =
@@ -23,7 +25,7 @@ class AndroidLocationUtils implements LocationUtils {
 	private final Context appContext;
 
 	@Inject
-	public AndroidLocationUtils(Application app) {
+	AndroidLocationUtils(Application app) {
 		appContext = app.getApplicationContext();
 	}
 
@@ -44,6 +46,7 @@ class AndroidLocationUtils implements LocationUtils {
 	 * some reason - both that class and {@code Context.COUNTRY_CODE} are
 	 * annotated {@code @hide}.
 	 */
+	@Override
 	@SuppressLint("DefaultLocale")
 	public String getCurrentCountry() {
 		String countryCode = getCountryFromPhoneNetwork();

bramble-android/src/main/java/org/briarproject/bramble/system/AndroidSeedProvider.java

@@ -1,4 +1,4 @@
-package org.briarproject.system;
+package org.briarproject.bramble.system;
 
 import android.app.Application;
 import android.content.ContentResolver;
@@ -6,13 +6,18 @@ import android.content.Context;
 import android.os.Build;
 import android.provider.Settings;
 
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
 import java.io.DataOutputStream;
 import java.io.IOException;
 
+import javax.annotation.concurrent.Immutable;
 import javax.inject.Inject;
 
 import static android.provider.Settings.Secure.ANDROID_ID;
 
+@Immutable
+@NotNullByDefault
 class AndroidSeedProvider extends LinuxSeedProvider {
 
 	private final Context appContext;

bramble-android/src/main/java/org/briarproject/bramble/system/AndroidSystemModule.java

@@ -0,0 +1,33 @@
+package org.briarproject.bramble.system;
+
+import android.app.Application;
+
+import org.briarproject.bramble.api.system.AndroidExecutor;
+import org.briarproject.bramble.api.system.LocationUtils;
+import org.briarproject.bramble.api.system.SeedProvider;
+
+import javax.inject.Singleton;
+
+import dagger.Module;
+import dagger.Provides;
+
+@Module
+public class AndroidSystemModule {
+
+	@Provides
+	@Singleton
+	SeedProvider provideSeedProvider(Application app) {
+		return new AndroidSeedProvider(app);
+	}
+
+	@Provides
+	LocationUtils provideLocationUtils(Application app) {
+		return new AndroidLocationUtils(app);
+	}
+
+	@Provides
+	@Singleton
+	AndroidExecutor provideAndroidExecutor(Application app) {
+		return new AndroidExecutorImpl(app);
+	}
+}

bramble-android/src/main/java/org/briarproject/bramble/util/AndroidUtils.java

@@ -0,0 +1,70 @@
+package org.briarproject.bramble.util;
+
+import android.bluetooth.BluetoothAdapter;
+import android.content.Context;
+import android.os.Build;
+import android.provider.Settings;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.List;
+
+import static android.content.Context.MODE_PRIVATE;
+
+public class AndroidUtils {
+
+	// Fake Bluetooth address returned by BluetoothAdapter on API 23 and later
+	private static final String FAKE_BLUETOOTH_ADDRESS = "02:00:00:00:00:00";
+
+	private static final String STORED_REPORTS = "dev-reports";
+
+	@SuppressWarnings("deprecation")
+	public static Collection<String> getSupportedArchitectures() {
+		List<String> abis = new ArrayList<>();
+		if (Build.VERSION.SDK_INT >= 21) {
+			abis.addAll(Arrays.asList(Build.SUPPORTED_ABIS));
+		} else {
+			abis.add(Build.CPU_ABI);
+			if (Build.CPU_ABI2 != null) abis.add(Build.CPU_ABI2);
+		}
+		return abis;
+	}
+
+	public static String getBluetoothAddress(Context ctx,
+			BluetoothAdapter adapter) {
+		// Return the adapter's address if it's valid and not fake
+		String address = adapter.getAddress();
+		if (isValidBluetoothAddress(address)) return address;
+		// Return the address from settings if it's valid and not fake
+		address = Settings.Secure.getString(ctx.getContentResolver(),
+				"bluetooth_address");
+		if (isValidBluetoothAddress(address)) return address;
+		// Let the caller know we can't find the address
+		return "";
+	}
+
+	private static boolean isValidBluetoothAddress(String address) {
+		return !StringUtils.isNullOrEmpty(address)
+				&& BluetoothAdapter.checkBluetoothAddress(address)
+				&& !address.equals(FAKE_BLUETOOTH_ADDRESS);
+	}
+
+	public static void deleteAppData(Context ctx) {
+		File dataDir = new File(ctx.getApplicationInfo().dataDir);
+		File[] children = dataDir.listFiles();
+		if (children != null) {
+			for (File child : children) {
+				if (!child.getName().equals("lib"))
+					IoUtils.deleteFileOrDir(child);
+			}
+		}
+		// Recreate the cache dir as some OpenGL drivers expect it to exist
+		new File(dataDir, "cache").mkdir();
+	}
+
+	public static File getReportDir(Context ctx) {
+		return ctx.getDir(STORED_REPORTS, MODE_PRIVATE);
+	}
+}

bramble-android/src/main/res/values/strings.xml

@@ -0,0 +1,3 @@
+<resources>
+	<string name="app_name">Bramble</string>
+</resources>

bramble-api/build.gradle

@@ -0,0 +1,41 @@
+apply plugin: 'java'
+sourceCompatibility = 1.6
+targetCompatibility = 1.6
+
+apply plugin: 'witness'
+
+dependencies {
+	compile "com.google.dagger:dagger:2.0.2"
+	compile 'com.google.dagger:dagger-compiler:2.0.2'
+	compile 'com.google.code.findbugs:jsr305:3.0.1'
+
+	testCompile 'junit:junit:4.12'
+	testCompile "org.jmock:jmock:2.8.1"
+	testCompile "org.jmock:jmock-junit4:2.8.1"
+	testCompile "org.jmock:jmock-legacy:2.8.1"
+	testCompile "org.hamcrest:hamcrest-library:1.3"
+	testCompile "org.hamcrest:hamcrest-core:1.3"
+}
+
+dependencyVerification {
+	verify = [
+			'com.google.dagger:dagger:84c0282ed8be73a29e0475d639da030b55dee72369e58dd35ae7d4fe6243dcf9',
+			'com.google.dagger:dagger-compiler:b74bc9de063dd4c6400b232231f2ef5056145b8fbecbf5382012007dd1c071b3',
+			'com.google.code.findbugs:jsr305:c885ce34249682bc0236b4a7d56efcc12048e6135a5baf7a9cde8ad8cda13fcd',
+			'javax.inject:javax.inject:91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff',
+			'com.google.dagger:dagger-producers:99ec15e8a0507ba569e7655bc1165ee5e5ca5aa914b3c8f7e2c2458f724edd6b',
+			'com.google.guava:guava:d664fbfc03d2e5ce9cab2a44fb01f1d0bf9dfebeccc1a473b1f9ea31f79f6f99',
+	]
+}
+
+// needed to make test output available to bramble-core and briar-core
+configurations {
+	testOutput.extendsFrom(testCompile)
+}
+task jarTest(type: Jar, dependsOn: testClasses) {
+	from sourceSets.test.output
+	classifier = 'test'
+}
+artifacts {
+	testOutput jarTest
+}

bramble-api/src/main/java/org/briarproject/bramble/api/Bytes.java

@@ -1,11 +1,17 @@
-package org.briarproject.api;
+package org.briarproject.bramble.api;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 
 import java.util.Arrays;
 import java.util.Comparator;
 
+import javax.annotation.concurrent.ThreadSafe;
+
 /**
  * A wrapper around a byte array, to allow it to be stored in maps etc.
  */
+@ThreadSafe
+@NotNullByDefault
 public class Bytes implements Comparable<Bytes> {
 
 	public static final BytesComparator COMPARATOR = new BytesComparator();

bramble-api/src/main/java/org/briarproject/bramble/api/FormatException.java

@@ -0,0 +1,9 @@
+package org.briarproject.bramble.api;
+
+import java.io.IOException;
+
+/**
+ * An exception that indicates an unrecoverable formatting error.
+ */
+public class FormatException extends IOException {
+}

bramble-api/src/main/java/org/briarproject/bramble/api/StringMap.java

@@ -1,12 +1,10 @@
-package org.briarproject.api;
+package org.briarproject.bramble.api;
 
 import java.util.Hashtable;
 import java.util.Map;
 
 public abstract class StringMap extends Hashtable<String, String> {
 
-	private static final long serialVersionUID = 2497176435908100448L;
-
 	protected StringMap(Map<String, String> m) {
 		super(m);
 	}

bramble-api/src/main/java/org/briarproject/bramble/api/UniqueId.java

@@ -0,0 +1,20 @@
+package org.briarproject.bramble.api;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.concurrent.ThreadSafe;
+
+@ThreadSafe
+@NotNullByDefault
+public abstract class UniqueId extends Bytes {
+
+	/**
+	 * The length of a unique identifier in bytes.
+	 */
+	public static final int LENGTH = 32;
+
+	protected UniqueId(byte[] id) {
+		super(id);
+		if (id.length != LENGTH) throw new IllegalArgumentException();
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/client/BdfMessageContext.java

@@ -0,0 +1,36 @@
+package org.briarproject.bramble.api.client;
+
+import org.briarproject.bramble.api.data.BdfDictionary;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.sync.MessageId;
+
+import java.util.Collection;
+import java.util.Collections;
+
+import javax.annotation.concurrent.Immutable;
+
+@Immutable
+@NotNullByDefault
+public class BdfMessageContext {
+
+	private final BdfDictionary dictionary;
+	private final Collection<MessageId> dependencies;
+
+	public BdfMessageContext(BdfDictionary dictionary,
+			Collection<MessageId> dependencies) {
+		this.dictionary = dictionary;
+		this.dependencies = dependencies;
+	}
+
+	public BdfMessageContext(BdfDictionary dictionary) {
+		this(dictionary, Collections.<MessageId>emptyList());
+	}
+
+	public BdfDictionary getDictionary() {
+		return dictionary;
+	}
+
+	public Collection<MessageId> getDependencies() {
+		return dependencies;
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/client/BdfMessageValidator.java

@@ -0,0 +1,66 @@
+package org.briarproject.bramble.api.client;
+
+import org.briarproject.bramble.api.FormatException;
+import org.briarproject.bramble.api.data.BdfList;
+import org.briarproject.bramble.api.data.MetadataEncoder;
+import org.briarproject.bramble.api.db.Metadata;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.sync.Group;
+import org.briarproject.bramble.api.sync.InvalidMessageException;
+import org.briarproject.bramble.api.sync.Message;
+import org.briarproject.bramble.api.sync.MessageContext;
+import org.briarproject.bramble.api.sync.ValidationManager.MessageValidator;
+import org.briarproject.bramble.api.system.Clock;
+
+import java.util.logging.Logger;
+
+import javax.annotation.concurrent.Immutable;
+
+import static org.briarproject.bramble.api.sync.SyncConstants.MESSAGE_HEADER_LENGTH;
+import static org.briarproject.bramble.api.transport.TransportConstants.MAX_CLOCK_DIFFERENCE;
+
+@Immutable
+@NotNullByDefault
+public abstract class BdfMessageValidator implements MessageValidator {
+
+	protected static final Logger LOG =
+			Logger.getLogger(BdfMessageValidator.class.getName());
+
+	protected final ClientHelper clientHelper;
+	protected final MetadataEncoder metadataEncoder;
+	protected final Clock clock;
+
+	protected BdfMessageValidator(ClientHelper clientHelper,
+			MetadataEncoder metadataEncoder, Clock clock) {
+		this.clientHelper = clientHelper;
+		this.metadataEncoder = metadataEncoder;
+		this.clock = clock;
+	}
+
+	protected abstract BdfMessageContext validateMessage(Message m, Group g,
+			BdfList body) throws InvalidMessageException, FormatException;
+
+	@Override
+	public MessageContext validateMessage(Message m, Group g)
+			throws InvalidMessageException {
+		// Reject the message if it's too far in the future
+		long now = clock.currentTimeMillis();
+		if (m.getTimestamp() - now > MAX_CLOCK_DIFFERENCE) {
+			throw new InvalidMessageException(
+					"Timestamp is too far in the future");
+		}
+		byte[] raw = m.getRaw();
+		if (raw.length <= MESSAGE_HEADER_LENGTH) {
+			throw new InvalidMessageException("Message is too short");
+		}
+		try {
+			BdfList body = clientHelper.toList(raw, MESSAGE_HEADER_LENGTH,
+					raw.length - MESSAGE_HEADER_LENGTH);
+			BdfMessageContext result = validateMessage(m, g, body);
+			Metadata meta = metadataEncoder.encode(result.getDictionary());
+			return new MessageContext(meta, result.getDependencies());
+		} catch (FormatException e) {
+			throw new InvalidMessageException(e);
+		}
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/client/ClientHelper.java

@@ -1,17 +1,21 @@
-package org.briarproject.api.clients;
+package org.briarproject.bramble.api.client;
 
-import org.briarproject.api.FormatException;
+import org.briarproject.bramble.api.FormatException;
-import org.briarproject.api.data.BdfDictionary;
+import org.briarproject.bramble.api.data.BdfDictionary;
-import org.briarproject.api.data.BdfList;
+import org.briarproject.bramble.api.data.BdfList;
-import org.briarproject.api.db.DbException;
+import org.briarproject.bramble.api.db.DbException;
-import org.briarproject.api.db.Transaction;
+import org.briarproject.bramble.api.db.Transaction;
-import org.briarproject.api.sync.GroupId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.api.sync.Message;
+import org.briarproject.bramble.api.sync.GroupId;
-import org.briarproject.api.sync.MessageId;
+import org.briarproject.bramble.api.sync.Message;
+import org.briarproject.bramble.api.sync.MessageId;
 
 import java.security.GeneralSecurityException;
 import java.util.Map;
 
+import javax.annotation.Nullable;
+
+@NotNullByDefault
 public interface ClientHelper {
 
 	void addLocalMessage(Message m, BdfDictionary metadata, boolean shared)
@@ -20,14 +24,21 @@ public interface ClientHelper {
 	void addLocalMessage(Transaction txn, Message m, BdfDictionary metadata,
 			boolean shared) throws DbException, FormatException;
 
-	Message createMessage(GroupId g, long timestamp, BdfDictionary body)
-			throws FormatException;
-
 	Message createMessage(GroupId g, long timestamp, BdfList body)
 			throws FormatException;
 
+	Message createMessageForStoringMetadata(GroupId g);
+
+	@Nullable
+	Message getMessage(MessageId m) throws DbException;
+
+	@Nullable
+	Message getMessage(Transaction txn, MessageId m) throws DbException;
+
+	@Nullable
 	BdfList getMessageAsList(MessageId m) throws DbException, FormatException;
 
+	@Nullable
 	BdfList getMessageAsList(Transaction txn, MessageId m) throws DbException,
 			FormatException;
 
@@ -37,7 +48,8 @@ public interface ClientHelper {
 	BdfDictionary getGroupMetadataAsDictionary(Transaction txn, GroupId g)
 			throws DbException, FormatException;
 
-	BdfDictionary getMessageMetadataAsDictionary(MessageId m) throws DbException,
+	BdfDictionary getMessageMetadataAsDictionary(MessageId m)
+			throws DbException,
 			FormatException;
 
 	BdfDictionary getMessageMetadataAsDictionary(Transaction txn, MessageId m)
@@ -68,12 +80,6 @@ public interface ClientHelper {
 	void mergeMessageMetadata(Transaction txn, MessageId m,
 			BdfDictionary metadata) throws DbException, FormatException;
 
-	/**
-	 * Marks the given message as shared or unshared with other contacts.
-	 */
-	void setMessageShared(Transaction txn, MessageId m, boolean shared)
-			throws DbException;
-
 	byte[] toByteArray(BdfDictionary dictionary) throws FormatException;
 
 	byte[] toByteArray(BdfList list) throws FormatException;
@@ -85,6 +91,12 @@ public interface ClientHelper {
 
 	BdfList toList(byte[] b) throws FormatException;
 
-	byte[] sign(BdfList toSign, byte[] privateKey)
+	BdfList toList(Message m) throws FormatException;
+
+	byte[] sign(String label, BdfList toSign, byte[] privateKey)
 			throws FormatException, GeneralSecurityException;
+
+	void verifySignature(String label, byte[] sig, byte[] publicKey,
+			BdfList signed) throws FormatException, GeneralSecurityException;
+
 }

bramble-api/src/main/java/org/briarproject/bramble/api/client/ContactGroupFactory.java

@@ -0,0 +1,29 @@
+package org.briarproject.bramble.api.client;
+
+import org.briarproject.bramble.api.contact.Contact;
+import org.briarproject.bramble.api.identity.AuthorId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.sync.ClientId;
+import org.briarproject.bramble.api.sync.Group;
+
+@NotNullByDefault
+public interface ContactGroupFactory {
+
+	/**
+	 * Creates a group that is not shared with any contacts.
+	 */
+	Group createLocalGroup(ClientId clientId);
+
+	/**
+	 * Creates a group for the given client to share with the given contact.
+	 */
+	Group createContactGroup(ClientId clientId, Contact contact);
+
+	/**
+	 * Creates a group for the given client to share between the given authors
+	 * identified by their AuthorIds.
+	 */
+	Group createContactGroup(ClientId clientId, AuthorId authorId1,
+			AuthorId authorId2);
+
+}

bramble-api/src/main/java/org/briarproject/bramble/api/contact/Contact.java

@@ -1,8 +1,13 @@
-package org.briarproject.api.contact;
+package org.briarproject.bramble.api.contact;
 
-import org.briarproject.api.identity.Author;
+import org.briarproject.bramble.api.identity.Author;
-import org.briarproject.api.identity.AuthorId;
+import org.briarproject.bramble.api.identity.AuthorId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 
+import javax.annotation.concurrent.Immutable;
+
+@Immutable
+@NotNullByDefault
 public class Contact {
 
 	private final ContactId id;

bramble-api/src/main/java/org/briarproject/bramble/api/contact/ContactExchangeListener.java

@@ -0,0 +1,20 @@
+package org.briarproject.bramble.api.contact;
+
+import org.briarproject.bramble.api.identity.Author;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
+public interface ContactExchangeListener {
+
+	void contactExchangeSucceeded(Author remoteAuthor);
+
+	/**
+	 * The exchange failed because the contact already exists.
+	 */
+	void duplicateContact(Author remoteAuthor);
+
+	/**
+	 * A general failure.
+	 */
+	void contactExchangeFailed();
+}

bramble-api/src/main/java/org/briarproject/bramble/api/contact/ContactExchangeTask.java

@@ -0,0 +1,22 @@
+package org.briarproject.bramble.api.contact;
+
+import org.briarproject.bramble.api.crypto.SecretKey;
+import org.briarproject.bramble.api.identity.LocalAuthor;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.plugin.TransportId;
+import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
+
+/**
+ * A task for conducting a contact information exchange with a remote peer.
+ */
+@NotNullByDefault
+public interface ContactExchangeTask {
+
+	/**
+	 * Exchanges contact information with a remote peer.
+	 */
+	void startExchange(ContactExchangeListener listener,
+			LocalAuthor localAuthor, SecretKey masterSecret,
+			DuplexTransportConnection conn, TransportId transportId,
+			boolean alice);
+}

bramble-api/src/main/java/org/briarproject/bramble/api/contact/ContactId.java

@@ -1,9 +1,15 @@
-package org.briarproject.api.contact;
+package org.briarproject.bramble.api.contact;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.concurrent.Immutable;
 
 /**
  * Type-safe wrapper for an integer that uniquely identifies a contact within
  * the scope of a single node.
  */
+@Immutable
+@NotNullByDefault
 public class ContactId {
 
 	private final int id;

bramble-api/src/main/java/org/briarproject/bramble/api/contact/ContactManager.java

@@ -0,0 +1,104 @@
+package org.briarproject.bramble.api.contact;
+
+import org.briarproject.bramble.api.crypto.SecretKey;
+import org.briarproject.bramble.api.db.DbException;
+import org.briarproject.bramble.api.db.Transaction;
+import org.briarproject.bramble.api.identity.Author;
+import org.briarproject.bramble.api.identity.AuthorId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import java.util.Collection;
+
+@NotNullByDefault
+public interface ContactManager {
+
+	/**
+	 * Registers a hook to be called whenever a contact is added.
+	 */
+	void registerAddContactHook(AddContactHook hook);
+
+	/**
+	 * Registers a hook to be called whenever a contact is removed.
+	 */
+	void registerRemoveContactHook(RemoveContactHook hook);
+
+	/**
+	 * Stores a contact within the given transaction associated with the given
+	 * local and remote pseudonyms, and returns an ID for the contact.
+	 */
+	ContactId addContact(Transaction txn, Author remote, AuthorId local,
+			SecretKey master, long timestamp, boolean alice, boolean verified,
+			boolean active) throws DbException;
+
+	/**
+	 * Stores a contact associated with the given local and remote pseudonyms,
+	 * and returns an ID for the contact.
+	 */
+	ContactId addContact(Author remote, AuthorId local,
+			SecretKey master, long timestamp, boolean alice, boolean verified,
+			boolean active) throws DbException;
+
+	/**
+	 * Returns the contact with the given ID.
+	 */
+	Contact getContact(ContactId c) throws DbException;
+
+	/**
+	 * Returns the contact with the given remoteAuthorId
+	 * that was added by the LocalAuthor with the given localAuthorId
+	 *
+	 * @throws org.briarproject.bramble.api.db.NoSuchContactException
+	 */
+	Contact getContact(AuthorId remoteAuthorId, AuthorId localAuthorId)
+			throws DbException;
+
+	/**
+	 * Returns the contact with the given remoteAuthorId
+	 * that was added by the LocalAuthor with the given localAuthorId
+	 *
+	 * @throws org.briarproject.bramble.api.db.NoSuchContactException
+	 */
+	Contact getContact(Transaction txn, AuthorId remoteAuthorId,
+			AuthorId localAuthorId) throws DbException;
+
+	/**
+	 * Returns all active contacts.
+	 */
+	Collection<Contact> getActiveContacts() throws DbException;
+
+	/**
+	 * Removes a contact and all associated state.
+	 */
+	void removeContact(ContactId c) throws DbException;
+
+	/**
+	 * Removes a contact and all associated state.
+	 */
+	void removeContact(Transaction txn, ContactId c) throws DbException;
+
+	/**
+	 * Marks a contact as active or inactive.
+	 */
+	void setContactActive(Transaction txn, ContactId c, boolean active)
+			throws DbException;
+
+	/**
+	 * Return true if a contact with this name and public key already exists
+	 */
+	boolean contactExists(Transaction txn, AuthorId remoteAuthorId,
+			AuthorId localAuthorId) throws DbException;
+
+	/**
+	 * Return true if a contact with this name and public key already exists
+	 */
+	boolean contactExists(AuthorId remoteAuthorId, AuthorId localAuthorId)
+			throws DbException;
+
+	interface AddContactHook {
+		void addingContact(Transaction txn, Contact c) throws DbException;
+	}
+
+	interface RemoveContactHook {
+		void removingContact(Transaction txn, Contact c) throws DbException;
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/ContactAddedEvent.java

@@ -0,0 +1,31 @@
+package org.briarproject.bramble.api.contact.event;
+
+import org.briarproject.bramble.api.contact.ContactId;
+import org.briarproject.bramble.api.event.Event;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.concurrent.Immutable;
+
+/**
+ * An event that is broadcast when a contact is added.
+ */
+@Immutable
+@NotNullByDefault
+public class ContactAddedEvent extends Event {
+
+	private final ContactId contactId;
+	private final boolean active;
+
+	public ContactAddedEvent(ContactId contactId, boolean active) {
+		this.contactId = contactId;
+		this.active = active;
+	}
+
+	public ContactId getContactId() {
+		return contactId;
+	}
+
+	public boolean isActive() {
+		return active;
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/ContactRemovedEvent.java

@@ -0,0 +1,25 @@
+package org.briarproject.bramble.api.contact.event;
+
+import org.briarproject.bramble.api.contact.ContactId;
+import org.briarproject.bramble.api.event.Event;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.concurrent.Immutable;
+
+/**
+ * An event that is broadcast when a contact is removed.
+ */
+@Immutable
+@NotNullByDefault
+public class ContactRemovedEvent extends Event {
+
+	private final ContactId contactId;
+
+	public ContactRemovedEvent(ContactId contactId) {
+		this.contactId = contactId;
+	}
+
+	public ContactId getContactId() {
+		return contactId;
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/ContactStatusChangedEvent.java

@@ -0,0 +1,31 @@
+package org.briarproject.bramble.api.contact.event;
+
+import org.briarproject.bramble.api.contact.ContactId;
+import org.briarproject.bramble.api.event.Event;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.concurrent.Immutable;
+
+/**
+ * An event that is broadcast when a contact is marked active or inactive.
+ */
+@Immutable
+@NotNullByDefault
+public class ContactStatusChangedEvent extends Event {
+
+	private final ContactId contactId;
+	private final boolean active;
+
+	public ContactStatusChangedEvent(ContactId contactId, boolean active) {
+		this.contactId = contactId;
+		this.active = active;
+	}
+
+	public ContactId getContactId() {
+		return contactId;
+	}
+
+	public boolean isActive() {
+		return active;
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/ContactVerifiedEvent.java

@@ -0,0 +1,26 @@
+package org.briarproject.bramble.api.contact.event;
+
+import org.briarproject.bramble.api.contact.ContactId;
+import org.briarproject.bramble.api.event.Event;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.concurrent.Immutable;
+
+/**
+ * An event that is broadcast when a contact is verified.
+ */
+@Immutable
+@NotNullByDefault
+public class ContactVerifiedEvent extends Event {
+
+	private final ContactId contactId;
+
+	public ContactVerifiedEvent(ContactId contactId) {
+		this.contactId = contactId;
+	}
+
+	public ContactId getContactId() {
+		return contactId;
+	}
+
+}

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/CryptoComponent.java

@@ -1,7 +1,7 @@
-package org.briarproject.api.crypto;
+package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.api.TransportId;
+import org.briarproject.bramble.api.plugin.TransportId;
-import org.briarproject.api.transport.TransportKeys;
+import org.briarproject.bramble.api.transport.TransportKeys;
 
 import java.security.GeneralSecurityException;
 import java.security.SecureRandom;
@@ -10,14 +10,10 @@ public interface CryptoComponent {
 
 	SecretKey generateSecretKey();
 
-	MessageDigest getMessageDigest();
-
 	PseudoRandom getPseudoRandom(int seed1, int seed2);
 
 	SecureRandom getSecureRandom();
 
-	Signature getSignature();
-
 	KeyPair generateAgreementKeyPair();
 
 	KeyParser getAgreementKeyParser();
@@ -143,11 +139,40 @@ public interface CryptoComponent {
 	/** Encodes the pseudo-random tag that is used to recognise a stream. */
 	void encodeTag(byte[] tag, SecretKey tagKey, long streamNumber);
 
+	/**
+	 * Signs the given byte[] with the given PrivateKey.
+	 *
+	 * @param label A label specific to this signature
+	 *              to ensure that the signature cannot be repurposed
+	 */
+	byte[] sign(String label, byte[] toSign, byte[] privateKey)
+			throws GeneralSecurityException;
+
+	/**
+	 * Verifies that the given signature is valid for the signedData
+	 * and the given publicKey.
+	 *
+	 * @param label A label that was specific to this signature
+	 *              to ensure that the signature cannot be repurposed
+	 * @return true if the signature was valid, false otherwise.
+	 */
+	boolean verify(String label, byte[] signedData, byte[] publicKey,
+			byte[] signature) throws GeneralSecurityException;
+
 	/**
 	 * Returns the hash of the given inputs. The inputs are unambiguously
 	 * combined by prefixing each input with its length.
+	 *
+	 * @param label A label specific to this hash to ensure that hashes
+	 *              calculated for distinct purposes don't collide.
 	 */
-	byte[] hash(byte[]... inputs);
+	byte[] hash(String label, byte[]... inputs);
+
+	/**
+	 * Returns the length of hashes produced by
+	 * the {@link CryptoComponent#hash(String, byte[]...)} method.
+	 */
+	int getHashLength();
 
 	/**
 	 * Returns a message authentication code with the given key over the

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/CryptoExecutor.java

@@ -0,0 +1,25 @@
+package org.briarproject.bramble.api.crypto;
+
+import java.lang.annotation.Retention;
+import java.lang.annotation.Target;
+
+import javax.inject.Qualifier;
+
+import static java.lang.annotation.ElementType.FIELD;
+import static java.lang.annotation.ElementType.METHOD;
+import static java.lang.annotation.ElementType.PARAMETER;
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+/**
+ * Annotation for injecting the executor for long-running crypto tasks. Also
+ * used for annotating methods that should run on the crypto executor.
+ * <p>
+ * The contract of this executor is that tasks may be run concurrently, and
+ * submitting a task will never block. Tasks must not run indefinitely. Tasks
+ * submitted during shutdown are discarded.
+ */
+@Qualifier
+@Target({FIELD, METHOD, PARAMETER})
+@Retention(RUNTIME)
+public @interface CryptoExecutor {
+}

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/KeyPair.java

@@ -1,6 +1,14 @@
-package org.briarproject.api.crypto;
+package org.briarproject.bramble.api.crypto;
 
-/** A key pair consisting of a {@link PublicKey} and a {@link PrivateKey). */
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.concurrent.Immutable;
+
+/**
+ * A key pair consisting of a {@link PublicKey} and a {@link PrivateKey).
+ */
+@Immutable
+@NotNullByDefault
 public class KeyPair {
 
 	private final PublicKey publicKey;

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/KeyParser.java

@@ -1,7 +1,10 @@
-package org.briarproject.api.crypto;
+package org.briarproject.bramble.api.crypto;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 
 import java.security.GeneralSecurityException;
 
+@NotNullByDefault
 public interface KeyParser {
 
 	PublicKey parsePublicKey(byte[] encodedKey) throws GeneralSecurityException;

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/PasswordStrengthEstimator.java

@@ -1,5 +1,8 @@
-package org.briarproject.api.crypto;
+package org.briarproject.bramble.api.crypto;
 
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
 public interface PasswordStrengthEstimator {
 
 	float NONE = 0;

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/PrivateKey.java

@@ -0,0 +1,15 @@
+package org.briarproject.bramble.api.crypto;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+/**
+ * The private half of a public/private {@link KeyPair}.
+ */
+@NotNullByDefault
+public interface PrivateKey {
+
+	/**
+	 * Returns the encoded representation of this key.
+	 */
+	byte[] getEncoded();
+}

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/PseudoRandom.java

@@ -0,0 +1,12 @@
+package org.briarproject.bramble.api.crypto;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+/**
+ * A deterministic pseudo-random number generator.
+ */
+@NotNullByDefault
+public interface PseudoRandom {
+
+	byte[] nextBytes(int bytes);
+}

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/PublicKey.java

@@ -0,0 +1,15 @@
+package org.briarproject.bramble.api.crypto;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+/**
+ * The public half of a public/private {@link KeyPair}.
+ */
+@NotNullByDefault
+public interface PublicKey {
+
+	/**
+	 * Returns the encoded representation of this key.
+	 */
+	byte[] getEncoded();
+}

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/SecretKey.java

@@ -1,9 +1,14 @@
-package org.briarproject.api.crypto;
+package org.briarproject.bramble.api.crypto;
 
-/** A secret key used for encryption and/or authentication. */
+/**
+ * A secret key used for encryption and/or authentication.
+ */
 public class SecretKey {
 
-	public static final int LENGTH = 32; // Bytes
+	/**
+	 * The length of a secret key in bytes.
+	 */
+	public static final int LENGTH = 32;
 
 	private final byte[] key;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/StreamDecrypter.java

@@ -1,13 +1,17 @@
-package org.briarproject.api.crypto;
+package org.briarproject.bramble.api.crypto;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 
+@NotNullByDefault
 public interface StreamDecrypter {
 
 	/**
 	 * Reads a frame, decrypts its payload into the given buffer and returns
 	 * the payload length, or -1 if no more frames can be read from the stream.
-	 * @throws java.io.IOException if an error occurs while reading the frame,
+	 *
+	 * @throws IOException if an error occurs while reading the frame,
 	 * or if authenticated decryption fails.
 	 */
 	int readFrame(byte[] payload) throws IOException;

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/StreamDecrypterFactory.java

@@ -1,12 +1,16 @@
-package org.briarproject.api.crypto;
+package org.briarproject.bramble.api.crypto;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.transport.StreamContext;
 
 import java.io.InputStream;
 
-import org.briarproject.api.transport.StreamContext;
+@NotNullByDefault
-
 public interface StreamDecrypterFactory {
 
-	/** Creates a {@link StreamDecrypter} for decrypting a transport stream. */
+	/**
+	 * Creates a {@link StreamDecrypter} for decrypting a transport stream.
+	 */
 	StreamDecrypter createStreamDecrypter(InputStream in, StreamContext ctx);
 
 	/**

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/StreamEncrypter.java

@@ -0,0 +1,20 @@
+package org.briarproject.bramble.api.crypto;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import java.io.IOException;
+
+@NotNullByDefault
+public interface StreamEncrypter {
+
+	/**
+	 * Encrypts the given frame and writes it to the stream.
+	 */
+	void writeFrame(byte[] payload, int payloadLength, int paddingLength,
+			boolean finalFrame) throws IOException;
+
+	/**
+	 * Flushes the stream.
+	 */
+	void flush() throws IOException;
+}

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/StreamEncrypterFactory.java

@@ -1,12 +1,16 @@
-package org.briarproject.api.crypto;
+package org.briarproject.bramble.api.crypto;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.transport.StreamContext;
 
 import java.io.OutputStream;
 
-import org.briarproject.api.transport.StreamContext;
+@NotNullByDefault
-
 public interface StreamEncrypterFactory {
 
-	/** Creates a {@link StreamEncrypter} for encrypting a transport stream. */
+	/**
+	 * Creates a {@link StreamEncrypter} for encrypting a transport stream.
+	 */
 	StreamEncrypter createStreamEncrypter(OutputStream out, StreamContext ctx);
 
 	/**

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfDictionary.java

@@ -1,11 +1,13 @@
-package org.briarproject.api.data;
+package org.briarproject.bramble.api.data;
 
-import org.briarproject.api.Bytes;
+import org.briarproject.bramble.api.Bytes;
-import org.briarproject.api.FormatException;
+import org.briarproject.bramble.api.FormatException;
 
 import java.util.Map;
 import java.util.concurrent.ConcurrentSkipListMap;
 
+import javax.annotation.Nullable;
+
 public class BdfDictionary extends ConcurrentSkipListMap<String, Object> {
 
 	public static final Object NULL_VALUE = new Object();
@@ -39,6 +41,7 @@ public class BdfDictionary extends ConcurrentSkipListMap<String, Object> {
 		throw new FormatException();
 	}
 
+	@Nullable
 	public Boolean getOptionalBoolean(String key) throws FormatException {
 		Object o = get(key);
 		if (o == null || o == NULL_VALUE) return null;
@@ -61,6 +64,7 @@ public class BdfDictionary extends ConcurrentSkipListMap<String, Object> {
 		throw new FormatException();
 	}
 
+	@Nullable
 	public Long getOptionalLong(String key) throws FormatException {
 		Object o = get(key);
 		if (o == null || o == NULL_VALUE) return null;
@@ -87,6 +91,7 @@ public class BdfDictionary extends ConcurrentSkipListMap<String, Object> {
 		throw new FormatException();
 	}
 
+	@Nullable
 	public Double getOptionalDouble(String key) throws FormatException {
 		Object o = get(key);
 		if (o == null || o == NULL_VALUE) return null;
@@ -108,6 +113,7 @@ public class BdfDictionary extends ConcurrentSkipListMap<String, Object> {
 		throw new FormatException();
 	}
 
+	@Nullable
 	public String getOptionalString(String key) throws FormatException {
 		Object o = get(key);
 		if (o == null || o == NULL_VALUE) return null;
@@ -128,6 +134,7 @@ public class BdfDictionary extends ConcurrentSkipListMap<String, Object> {
 		throw new FormatException();
 	}
 
+	@Nullable
 	public byte[] getOptionalRaw(String key) throws FormatException {
 		Object o = get(key);
 		if (o == null || o == NULL_VALUE) return null;
@@ -149,6 +156,7 @@ public class BdfDictionary extends ConcurrentSkipListMap<String, Object> {
 		throw new FormatException();
 	}
 
+	@Nullable
 	public BdfList getOptionalList(String key) throws FormatException {
 		Object o = get(key);
 		if (o == null || o == NULL_VALUE) return null;
@@ -168,6 +176,7 @@ public class BdfDictionary extends ConcurrentSkipListMap<String, Object> {
 		throw new FormatException();
 	}
 
+	@Nullable
 	public BdfDictionary getOptionalDictionary(String key)
 			throws FormatException {
 		Object o = get(key);

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfEntry.java

@@ -1,7 +1,13 @@
-package org.briarproject.api.data;
+package org.briarproject.bramble.api.data;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 
 import java.util.Map.Entry;
 
+import javax.annotation.concurrent.Immutable;
+
+@Immutable
+@NotNullByDefault
 public class BdfEntry implements Entry<String, Object>, Comparable<BdfEntry> {
 
 	private final String key;

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfList.java

@@ -1,13 +1,15 @@
-package org.briarproject.api.data;
+package org.briarproject.bramble.api.data;
 
-import org.briarproject.api.Bytes;
+import org.briarproject.bramble.api.Bytes;
-import org.briarproject.api.FormatException;
+import org.briarproject.bramble.api.FormatException;
 
 import java.util.Arrays;
 import java.util.List;
 import java.util.Vector;
 
-import static org.briarproject.api.data.BdfDictionary.NULL_VALUE;
+import javax.annotation.Nullable;
+
+import static org.briarproject.bramble.api.data.BdfDictionary.NULL_VALUE;
 
 public class BdfList extends Vector<Object> {
 
@@ -29,13 +31,20 @@ public class BdfList extends Vector<Object> {
 		super(items);
 	}
 
+	private boolean isInRange(int index) {
+		return index >= 0 && index < size();
+	}
+
 	public Boolean getBoolean(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o instanceof Boolean) return (Boolean) o;
 		throw new FormatException();
 	}
 
+	@Nullable
 	public Boolean getOptionalBoolean(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o == null || o == NULL_VALUE) return null;
 		if (o instanceof Boolean) return (Boolean) o;
@@ -43,12 +52,14 @@ public class BdfList extends Vector<Object> {
 	}
 
 	public Boolean getBoolean(int index, Boolean defaultValue) {
+		if (!isInRange(index)) return defaultValue;
 		Object o = get(index);
 		if (o instanceof Boolean) return (Boolean) o;
 		return defaultValue;
 	}
 
 	public Long getLong(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o instanceof Long) return (Long) o;
 		if (o instanceof Integer) return ((Integer) o).longValue();
@@ -57,7 +68,9 @@ public class BdfList extends Vector<Object> {
 		throw new FormatException();
 	}
 
+	@Nullable
 	public Long getOptionalLong(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o == null || o == NULL_VALUE) return null;
 		if (o instanceof Long) return (Long) o;
@@ -68,6 +81,7 @@ public class BdfList extends Vector<Object> {
 	}
 
 	public Long getLong(int index, Long defaultValue) {
+		if (!isInRange(index)) return defaultValue;
 		Object o = get(index);
 		if (o instanceof Long) return (Long) o;
 		if (o instanceof Integer) return ((Integer) o).longValue();
@@ -77,13 +91,16 @@ public class BdfList extends Vector<Object> {
 	}
 
 	public Double getDouble(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o instanceof Double) return (Double) o;
 		if (o instanceof Float) return ((Float) o).doubleValue();
 		throw new FormatException();
 	}
 
+	@Nullable
 	public Double getOptionalDouble(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o == null || o == NULL_VALUE) return null;
 		if (o instanceof Double) return (Double) o;
@@ -92,6 +109,7 @@ public class BdfList extends Vector<Object> {
 	}
 
 	public Double getDouble(int index, Double defaultValue) {
+		if (!isInRange(index)) return defaultValue;
 		Object o = get(index);
 		if (o instanceof Double) return (Double) o;
 		if (o instanceof Float) return ((Float) o).doubleValue();
@@ -99,12 +117,15 @@ public class BdfList extends Vector<Object> {
 	}
 
 	public String getString(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o instanceof String) return (String) o;
 		throw new FormatException();
 	}
 
+	@Nullable
 	public String getOptionalString(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o == null || o == NULL_VALUE) return null;
 		if (o instanceof String) return (String) o;
@@ -112,19 +133,23 @@ public class BdfList extends Vector<Object> {
 	}
 
 	public String getString(int index, String defaultValue) {
+		if (!isInRange(index)) return defaultValue;
 		Object o = get(index);
 		if (o instanceof String) return (String) o;
 		return defaultValue;
 	}
 
 	public byte[] getRaw(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o instanceof byte[]) return (byte[]) o;
 		if (o instanceof Bytes) return ((Bytes) o).getBytes();
 		throw new FormatException();
 	}
 
+	@Nullable
 	public byte[] getOptionalRaw(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o == null || o == NULL_VALUE) return null;
 		if (o instanceof byte[]) return (byte[]) o;
@@ -133,6 +158,7 @@ public class BdfList extends Vector<Object> {
 	}
 
 	public byte[] getRaw(int index, byte[] defaultValue) {
+		if (!isInRange(index)) return defaultValue;
 		Object o = get(index);
 		if (o instanceof byte[]) return (byte[]) o;
 		if (o instanceof Bytes) return ((Bytes) o).getBytes();
@@ -140,12 +166,15 @@ public class BdfList extends Vector<Object> {
 	}
 
 	public BdfList getList(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o instanceof BdfList) return (BdfList) o;
 		throw new FormatException();
 	}
 
+	@Nullable
 	public BdfList getOptionalList(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o == null || o == NULL_VALUE) return null;
 		if (o instanceof BdfList) return (BdfList) o;
@@ -153,19 +182,23 @@ public class BdfList extends Vector<Object> {
 	}
 
 	public BdfList getList(int index, BdfList defaultValue) {
+		if (!isInRange(index)) return defaultValue;
 		Object o = get(index);
 		if (o instanceof BdfList) return (BdfList) o;
 		return defaultValue;
 	}
 
 	public BdfDictionary getDictionary(int index) throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o instanceof BdfDictionary) return (BdfDictionary) o;
 		throw new FormatException();
 	}
 
+	@Nullable
 	public BdfDictionary getOptionalDictionary(int index)
 			throws FormatException {
+		if (!isInRange(index)) throw new FormatException();
 		Object o = get(index);
 		if (o == null || o == NULL_VALUE) return null;
 		if (o instanceof BdfDictionary) return (BdfDictionary) o;
@@ -173,6 +206,7 @@ public class BdfList extends Vector<Object> {
 	}
 
 	public BdfDictionary getDictionary(int index, BdfDictionary defaultValue) {
+		if (!isInRange(index)) return defaultValue;
 		Object o = get(index);
 		if (o instanceof BdfDictionary) return (BdfDictionary) o;
 		return defaultValue;

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfReader.java

@@ -1,47 +1,75 @@
-package org.briarproject.api.data;
+package org.briarproject.bramble.api.data;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 
+@NotNullByDefault
 public interface BdfReader {
 
+	int DEFAULT_NESTED_LIMIT = 5;
+
 	boolean eof() throws IOException;
+
 	void close() throws IOException;
 
 	boolean hasNull() throws IOException;
+
 	void readNull() throws IOException;
+
 	void skipNull() throws IOException;
 
 	boolean hasBoolean() throws IOException;
+
 	boolean readBoolean() throws IOException;
+
 	void skipBoolean() throws IOException;
 
 	boolean hasLong() throws IOException;
+
 	long readLong() throws IOException;
+
 	void skipLong() throws IOException;
 
 	boolean hasDouble() throws IOException;
+
 	double readDouble() throws IOException;
+
 	void skipDouble() throws IOException;
 
 	boolean hasString() throws IOException;
+
 	String readString(int maxLength) throws IOException;
+
 	void skipString() throws IOException;
 
 	boolean hasRaw() throws IOException;
+
 	byte[] readRaw(int maxLength) throws IOException;
+
 	void skipRaw() throws IOException;
 
 	boolean hasList() throws IOException;
+
 	BdfList readList() throws IOException;
+
 	void readListStart() throws IOException;
+
 	boolean hasListEnd() throws IOException;
+
 	void readListEnd() throws IOException;
+
 	void skipList() throws IOException;
 
 	boolean hasDictionary() throws IOException;
+
 	BdfDictionary readDictionary() throws IOException;
+
 	void readDictionaryStart() throws IOException;
+
 	boolean hasDictionaryEnd() throws IOException;
+
 	void readDictionaryEnd() throws IOException;
+
 	void skipDictionary() throws IOException;
 }

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfReaderFactory.java

@@ -0,0 +1,13 @@
+package org.briarproject.bramble.api.data;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import java.io.InputStream;
+
+@NotNullByDefault
+public interface BdfReaderFactory {
+
+	BdfReader createReader(InputStream in);
+
+	BdfReader createReader(InputStream in, int nestedLimit);
+}

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfWriter.java

@@ -1,4 +1,4 @@
-package org.briarproject.api.data;
+package org.briarproject.bramble.api.data;
 
 import java.io.IOException;
 import java.util.Collection;
@@ -7,20 +7,30 @@ import java.util.Map;
 public interface BdfWriter {
 
 	void flush() throws IOException;
+
 	void close() throws IOException;
 
 	void writeNull() throws IOException;
+
 	void writeBoolean(boolean b) throws IOException;
+
 	void writeLong(long l) throws IOException;
+
 	void writeDouble(double d) throws IOException;
+
 	void writeString(String s) throws IOException;
+
 	void writeRaw(byte[] b) throws IOException;
 
 	void writeList(Collection<?> c) throws IOException;
+
 	void writeListStart() throws IOException;
+
 	void writeListEnd() throws IOException;
 
 	void writeDictionary(Map<?, ?> m) throws IOException;
+
 	void writeDictionaryStart() throws IOException;
+
 	void writeDictionaryEnd() throws IOException;
 }

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfWriterFactory.java

@@ -0,0 +1,11 @@
+package org.briarproject.bramble.api.data;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import java.io.OutputStream;
+
+@NotNullByDefault
+public interface BdfWriterFactory {
+
+	BdfWriter createWriter(OutputStream out);
+}

bramble-api/src/main/java/org/briarproject/bramble/api/data/MetadataEncoder.java

@@ -0,0 +1,11 @@
+package org.briarproject.bramble.api.data;
+
+import org.briarproject.bramble.api.FormatException;
+import org.briarproject.bramble.api.db.Metadata;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
+public interface MetadataEncoder {
+
+	Metadata encode(BdfDictionary d) throws FormatException;
+}

bramble-api/src/main/java/org/briarproject/bramble/api/data/MetadataParser.java

@@ -0,0 +1,11 @@
+package org.briarproject.bramble.api.data;
+
+import org.briarproject.bramble.api.FormatException;
+import org.briarproject.bramble.api.db.Metadata;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
+public interface MetadataParser {
+
+	BdfDictionary parse(Metadata m) throws FormatException;
+}

bramble-api/src/main/java/org/briarproject/bramble/api/data/ObjectReader.java

@@ -0,0 +1,11 @@
+package org.briarproject.bramble.api.data;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import java.io.IOException;
+
+@NotNullByDefault
+public interface ObjectReader<T> {
+
+	T readObject(BdfReader r) throws IOException;
+}

bramble-api/src/main/java/org/briarproject/bramble/api/db/ContactExistsException.java

@@ -1,10 +1,8 @@
-package org.briarproject.api.db;
+package org.briarproject.bramble.api.db;
 
 /**
  * Thrown when a duplicate contact is added to the database. This exception may
  * occur due to concurrent updates and does not indicate a database error.
  */
 public class ContactExistsException extends DbException {
-
-	private static final long serialVersionUID = -6658762011691502411L;
 }

bramble-api/src/main/java/org/briarproject/bramble/api/db/DatabaseComponent.java

@@ -1,34 +1,38 @@
-package org.briarproject.api.db;
+package org.briarproject.bramble.api.db;
 
-import org.briarproject.api.DeviceId;
+import org.briarproject.bramble.api.contact.Contact;
-import org.briarproject.api.TransportId;
+import org.briarproject.bramble.api.contact.ContactId;
-import org.briarproject.api.contact.Contact;
+import org.briarproject.bramble.api.identity.Author;
-import org.briarproject.api.contact.ContactId;
+import org.briarproject.bramble.api.identity.AuthorId;
-import org.briarproject.api.identity.Author;
+import org.briarproject.bramble.api.identity.LocalAuthor;
-import org.briarproject.api.identity.AuthorId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.api.identity.LocalAuthor;
+import org.briarproject.bramble.api.plugin.TransportId;
-import org.briarproject.api.settings.Settings;
+import org.briarproject.bramble.api.settings.Settings;
-import org.briarproject.api.sync.Ack;
+import org.briarproject.bramble.api.sync.Ack;
-import org.briarproject.api.sync.ClientId;
+import org.briarproject.bramble.api.sync.ClientId;
-import org.briarproject.api.sync.Group;
+import org.briarproject.bramble.api.sync.Group;
-import org.briarproject.api.sync.GroupId;
+import org.briarproject.bramble.api.sync.Group.Visibility;
-import org.briarproject.api.sync.Message;
+import org.briarproject.bramble.api.sync.GroupId;
-import org.briarproject.api.sync.MessageId;
+import org.briarproject.bramble.api.sync.Message;
-import org.briarproject.api.sync.MessageStatus;
+import org.briarproject.bramble.api.sync.MessageId;
-import org.briarproject.api.sync.Offer;
+import org.briarproject.bramble.api.sync.MessageStatus;
-import org.briarproject.api.sync.Request;
+import org.briarproject.bramble.api.sync.Offer;
-import org.briarproject.api.transport.TransportKeys;
+import org.briarproject.bramble.api.sync.Request;
-import org.jetbrains.annotations.Nullable;
+import org.briarproject.bramble.api.sync.ValidationManager;
+import org.briarproject.bramble.api.transport.TransportKeys;
 
 import java.util.Collection;
 import java.util.Map;
 
-import static org.briarproject.api.sync.ValidationManager.State;
+import javax.annotation.Nullable;
+
+import static org.briarproject.bramble.api.sync.ValidationManager.State;
 
 /**
  * Encapsulates the database implementation and exposes high-level operations
  * to other components.
  */
+@NotNullByDefault
 public interface DatabaseComponent {
 
 	/**
@@ -52,11 +56,17 @@ public interface DatabaseComponent {
 	Transaction startTransaction(boolean readOnly) throws DbException;
 
 	/**
-	 * Ends a transaction. If the transaction is marked as complete, the
+	 * Commits a transaction to the database.
-	 * transaction is committed and any events attached to the transaction are
-	 * broadcast; otherwise the transaction is aborted.
 	 */
-	void endTransaction(Transaction txn) throws DbException;
+	void commitTransaction(Transaction txn) throws DbException;
+
+	/**
+	 * Ends a transaction. If the transaction has not been committed,
+	 * it will be aborted. If the transaction has been committed,
+	 * any events attached to the transaction are broadcast.
+	 * The database lock will be released in either case.
+	 */
+	void endTransaction(Transaction txn);
 
 	/**
 	 * Stores a contact associated with the given local and remote pseudonyms,
@@ -198,13 +208,6 @@ public interface DatabaseComponent {
 	Collection<ContactId> getContacts(Transaction txn, AuthorId a)
 			throws DbException;
 
-	/**
-	 * Returns the unique ID for this device.
-	 * <p/>
-	 * Read-only.
-	 */
-	DeviceId getDeviceId(Transaction txn) throws DbException;
-
 	/**
 	 * Returns the group with the given ID.
 	 * <p/>
@@ -226,6 +229,15 @@ public interface DatabaseComponent {
 	 */
 	Collection<Group> getGroups(Transaction txn, ClientId c) throws DbException;
 
+	/**
+	 * Returns the given group's visibility to the given contact, or
+	 * {@link Visibility INVISIBLE} if the group is not in the database.
+	 * <p/>
+	 * Read-only.
+	 */
+	Visibility getGroupVisibility(Transaction txn, ContactId c, GroupId g)
+			throws DbException;
+
 	/**
 	 * Returns the local pseudonym with the given ID.
 	 * <p/>
@@ -258,6 +270,15 @@ public interface DatabaseComponent {
 	Collection<MessageId> getPendingMessages(Transaction txn, ClientId c)
 			throws DbException;
 
+	/**
+	 * Returns the IDs of any messages from the given client
+	 * that have a shared dependent, but are still not shared themselves.
+	 * <p/>
+	 * Read-only.
+	 */
+	Collection<MessageId> getMessagesToShare(Transaction txn,
+			ClientId c) throws DbException;
+
 	/**
 	 * Returns the message with the given ID, in serialised form, or null if
 	 * the message has been deleted.
@@ -313,10 +334,10 @@ public interface DatabaseComponent {
 
 	/**
 	 * Returns the IDs and states of all dependencies of the given message.
-	 * Missing dependencies have the state {@link
+	 * Missing dependencies have the state
-	 * org.briarproject.api.sync.ValidationManager.State UNKNOWN}.
+	 * {@link ValidationManager.State UNKNOWN}.
-	 * Dependencies in other groups have the state {@link
+	 * Dependencies in other groups have the state
-	 * org.briarproject.api.sync.ValidationManager.State INVALID}.
+	 * {@link ValidationManager.State INVALID}.
 	 * Note that these states are not set on the dependencies themselves; the
 	 * returned states should only be taken in the context of the given message.
 	 * <p/>
@@ -373,14 +394,6 @@ public interface DatabaseComponent {
 	void incrementStreamCounter(Transaction txn, ContactId c, TransportId t,
 			long rotationPeriod) throws DbException;
 
-	/**
-	 * Returns true if the given group is visible to the given contact.
-	 * <p/>
-	 * Read-only.
-	 */
-	boolean isVisibleToContact(Transaction txn, ContactId c, GroupId g)
-			throws DbException;
-
 	/**
 	 * Merges the given metadata with the existing metadata for the given
 	 * group.
@@ -456,10 +469,15 @@ public interface DatabaseComponent {
 			throws DbException;
 
 	/**
-	 * Marks the given message as shared or unshared.
+	 * Sets the given group's visibility to the given contact.
 	 */
-	void setMessageShared(Transaction txn, MessageId m, boolean shared)
+	void setGroupVisibility(Transaction txn, ContactId c, GroupId g,
-			throws DbException;
+			Visibility v) throws DbException;
+
+	/**
+	 * Marks the given message as shared.
+	 */
+	void setMessageShared(Transaction txn, MessageId m) throws DbException;
 
 	/**
 	 * Sets the validation and delivery state of the given message.
@@ -480,12 +498,6 @@ public interface DatabaseComponent {
 	void setReorderingWindow(Transaction txn, ContactId c, TransportId t,
 			long rotationPeriod, long base, byte[] bitmap) throws DbException;
 
-	/**
-	 * Makes a group visible or invisible to a contact.
-	 */
-	void setVisibleToContact(Transaction txn, ContactId c, GroupId g,
-			boolean visible) throws DbException;
-
 	/**
 	 * Stores the given transport keys, deleting any keys they have replaced.
 	 */

bramble-api/src/main/java/org/briarproject/bramble/api/db/DatabaseConfig.java

@@ -0,0 +1,28 @@
+package org.briarproject.bramble.api.db;
+
+import org.briarproject.bramble.api.crypto.SecretKey;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import java.io.File;
+
+import javax.annotation.Nullable;
+
+@NotNullByDefault
+public interface DatabaseConfig {
+
+	boolean databaseExists();
+
+	File getDatabaseDirectory();
+
+	void setEncryptionKey(SecretKey key);
+
+	@Nullable
+	SecretKey getEncryptionKey();
+
+	void setLocalAuthorName(String nickname);
+
+	@Nullable
+	String getLocalAuthorName();
+
+	long getMaxSize();
+}

bramble-api/src/main/java/org/briarproject/bramble/api/db/DatabaseExecutor.java

@@ -0,0 +1,26 @@
+package org.briarproject.bramble.api.db;
+
+import java.lang.annotation.Retention;
+import java.lang.annotation.Target;
+
+import javax.inject.Qualifier;
+
+import static java.lang.annotation.ElementType.FIELD;
+import static java.lang.annotation.ElementType.METHOD;
+import static java.lang.annotation.ElementType.PARAMETER;
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+/**
+ * Annotation for injecting the executor for database tasks. Also used for
+ * annotating methods that should run on the database executor.
+ * <p>
+ * The contract of this executor is that tasks are run in the order they're
+ * submitted, tasks are not run concurrently, and submitting a task will never
+ * block. Tasks must not run indefinitely. Tasks submitted during shutdown are
+ * discarded.
+ */
+@Qualifier
+@Target({FIELD, METHOD, PARAMETER})
+@Retention(RUNTIME)
+public @interface DatabaseExecutor {
+}

bramble-api/src/main/java/org/briarproject/bramble/api/db/DbClosedException.java

@@ -0,0 +1,7 @@
+package org.briarproject.bramble.api.db;
+
+/**
+ * Thrown when a database operation is attempted and the database is closed.
+ */
+public class DbClosedException extends DbException {
+}

bramble-api/src/main/java/org/briarproject/bramble/api/db/DbException.java

@@ -0,0 +1,11 @@
+package org.briarproject.bramble.api.db;
+
+public class DbException extends Exception {
+
+	public DbException() {
+	}
+
+	public DbException(Throwable t) {
+		super(t);
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/db/Metadata.java

@@ -1,7 +1,10 @@
-package org.briarproject.api.db;
+package org.briarproject.bramble.api.db;
 
 import java.util.Hashtable;
 
+import javax.annotation.concurrent.ThreadSafe;
+
+@ThreadSafe
 public class Metadata extends Hashtable<String, byte[]> {
 
 	/**

bramble-api/src/main/java/org/briarproject/bramble/api/db/NoSuchContactException.java

@@ -1,4 +1,4 @@
-package org.briarproject.api.db;
+package org.briarproject.bramble.api.db;
 
 /**
  * Thrown when a database operation is attempted for a contact that is not in
@@ -6,6 +6,4 @@ package org.briarproject.api.db;
  * not indicate a database error.
  */
 public class NoSuchContactException extends DbException {
-
-	private static final long serialVersionUID = -7048538231308207386L;
 }

bramble-api/src/main/java/org/briarproject/bramble/api/db/NoSuchGroupException.java

@@ -1,4 +1,4 @@
-package org.briarproject.api.db;
+package org.briarproject.bramble.api.db;
 
 /**
  * Thrown when a database operation is attempted for a group that is not in the
@@ -6,6 +6,4 @@ package org.briarproject.api.db;
  * indicate a database error.
  */
 public class NoSuchGroupException extends DbException {
-
-	private static final long serialVersionUID = -5494178507342571697L;
 }

bramble-api/src/main/java/org/briarproject/bramble/api/db/NoSuchLocalAuthorException.java

@@ -1,4 +1,4 @@
-package org.briarproject.api.db;
+package org.briarproject.bramble.api.db;
 
 /**
  * Thrown when a database operation is attempted for a pseudonym that is not in
@@ -6,6 +6,4 @@ package org.briarproject.api.db;
  * not indicate a database error.
  */
 public class NoSuchLocalAuthorException extends DbException {
-
-	private static final long serialVersionUID = 494398665376703860L;
 }

bramble-api/src/main/java/org/briarproject/bramble/api/db/NoSuchMessageException.java

@@ -1,4 +1,4 @@
-package org.briarproject.api.db;
+package org.briarproject.bramble.api.db;
 
 /**
  * Thrown when a database operation is attempted for a message that is not in
@@ -6,6 +6,4 @@ package org.briarproject.api.db;
  * not indicate a database error.
  */
 public class NoSuchMessageException extends DbException {
-
-	private static final long serialVersionUID = 9191508339698803848L;
 }

bramble-api/src/main/java/org/briarproject/bramble/api/db/NoSuchTransportException.java

@@ -1,4 +1,4 @@
-package org.briarproject.api.db;
+package org.briarproject.bramble.api.db;
 
 /**
  * Thrown when a database operation is attempted for a transport that is not in
@@ -6,6 +6,4 @@ package org.briarproject.api.db;
  * not indicate a database error.
  */
 public class NoSuchTransportException extends DbException {
-
-	private static final long serialVersionUID = -6274982612759573100L;
 }

bramble-api/src/main/java/org/briarproject/bramble/api/db/Transaction.java

@@ -1,21 +1,24 @@
-package org.briarproject.api.db;
+package org.briarproject.bramble.api.db;
 
-import org.briarproject.api.event.Event;
+import org.briarproject.bramble.api.event.Event;
 
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.concurrent.NotThreadSafe;
+
 /**
  * A wrapper around a database transaction. Transactions are not thread-safe.
  */
+@NotThreadSafe
 public class Transaction {
 
 	private final Object txn;
 	private final boolean readOnly;
 
 	private List<Event> events = null;
-	private boolean complete = false;
+	private boolean committed = false;
 
 	public Transaction(Object txn, boolean readOnly) {
 		this.txn = txn;
@@ -55,18 +58,18 @@ public class Transaction {
 	}
 
 	/**
-	 * Returns true if the transaction is ready to be committed.
+	 * Returns true if the transaction has been committed.
 	 */
-	public boolean isComplete() {
+	public boolean isCommitted() {
-		return complete;
+		return committed;
 	}
 
 	/**
-	 * Marks the transaction as ready to be committed. This method must not be
+	 * Marks the transaction as committed. This method should only be called
-	 * called more than once.
+	 * by the DatabaseComponent. It must not be called more than once.
 	 */
-	public void setComplete() {
+	public void setCommitted() {
-		if (complete) throw new IllegalStateException();
+		if (committed) throw new IllegalStateException();
-		complete = true;
+		committed = true;
 	}
 }

bramble-api/src/main/java/org/briarproject/bramble/api/event/Event.java

@@ -0,0 +1,7 @@
+package org.briarproject.bramble.api.event;
+
+/**
+ * An abstract superclass for events.
+ */
+public abstract class Event {
+}

bramble-api/src/main/java/org/briarproject/bramble/api/event/EventBus.java

@@ -0,0 +1,22 @@
+package org.briarproject.bramble.api.event;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
+public interface EventBus {
+
+	/**
+	 * Adds a listener to be notified when events occur.
+	 */
+	void addListener(EventListener l);
+
+	/**
+	 * Removes a listener.
+	 */
+	void removeListener(EventListener l);
+
+	/**
+	 * Notifies all listeners of an event.
+	 */
+	void broadcast(Event e);
+}

bramble-api/src/main/java/org/briarproject/bramble/api/event/EventListener.java

@@ -0,0 +1,16 @@
+package org.briarproject.bramble.api.event;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+/**
+ * An interface for receiving notifications when events occur.
+ */
+@NotNullByDefault
+public interface EventListener {
+
+	/**
+	 * Called when an event is broadcast. Implementations of this method must
+	 * not block.
+	 */
+	void eventOccurred(Event e);
+}

bramble-api/src/main/java/org/briarproject/bramble/api/identity/Author.java

@@ -1,11 +1,19 @@
-package org.briarproject.api.identity;
+package org.briarproject.bramble.api.identity;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 
 import java.io.UnsupportedEncodingException;
 
-/** A pseudonym for a user. */
+import javax.annotation.concurrent.Immutable;
+
+/**
+ * A pseudonym for a user.
+ */
+@Immutable
+@NotNullByDefault
 public class Author {
 
-	public enum Status { ANONYMOUS, UNKNOWN, UNVERIFIED, VERIFIED, OURSELVES }
+	public enum Status {ANONYMOUS, UNKNOWN, UNVERIFIED, VERIFIED, OURSELVES}
 
 	private final AuthorId id;
 	private final String name;
@@ -25,17 +33,23 @@ public class Author {
 		this.publicKey = publicKey;
 	}
 
-	/** Returns the author's unique identifier. */
+	/**
+	 * Returns the author's unique identifier.
+	 */
 	public AuthorId getId() {
 		return id;
 	}
 
-	/** Returns the author's name. */
+	/**
+	 * Returns the author's name.
+	 */
 	public String getName() {
 		return name;
 	}
 
-	/** Returns the public key used to verify the pseudonym's signatures. */
+	/**
+	 * Returns the public key used to verify the pseudonym's signatures.
+	 */
 	public byte[] getPublicKey() {
 		return publicKey;
 	}

bramble-api/src/main/java/org/briarproject/bramble/api/identity/AuthorConstants.java

@@ -1,8 +1,10 @@
-package org.briarproject.api.identity;
+package org.briarproject.bramble.api.identity;
 
 public interface AuthorConstants {
 
-	/** The maximum length of an author's name in UTF-8 bytes. */
+	/**
+	 * The maximum length of an author's name in UTF-8 bytes.
+	 */
 	int MAX_AUTHOR_NAME_LENGTH = 50;
 
 	/**

bramble-api/src/main/java/org/briarproject/bramble/api/identity/AuthorFactory.java

@@ -1,5 +1,8 @@
-package org.briarproject.api.identity;
+package org.briarproject.bramble.api.identity;
 
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
 public interface AuthorFactory {
 
 	Author createAuthor(String name, byte[] publicKey);

bramble-api/src/main/java/org/briarproject/bramble/api/identity/AuthorId.java

@@ -1,20 +1,22 @@
-package org.briarproject.api.identity;
+package org.briarproject.bramble.api.identity;
 
-import org.briarproject.api.UniqueId;
+import org.briarproject.bramble.api.UniqueId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 
-import java.nio.charset.Charset;
+import javax.annotation.concurrent.ThreadSafe;
 
 /**
  * Type-safe wrapper for a byte array that uniquely identifies an
- * {@link org.briarproject.api.identity.Author Author}.
+ * {@link Author}.
  */
+@ThreadSafe
+@NotNullByDefault
 public class AuthorId extends UniqueId {
 
 	/**
 	 * Label for hashing authors to calculate their identities.
 	 */
-	public static final byte[] LABEL =
+	public static final String LABEL = "org.briarproject.bramble.AUTHOR_ID";
-			"AUTHOR_ID".getBytes(Charset.forName("US-ASCII"));
 
 	public AuthorId(byte[] id) {
 		super(id);

bramble-api/src/main/java/org/briarproject/bramble/api/identity/IdentityManager.java

@@ -0,0 +1,38 @@
+package org.briarproject.bramble.api.identity;
+
+import org.briarproject.bramble.api.db.DbException;
+import org.briarproject.bramble.api.db.Transaction;
+import org.briarproject.bramble.api.identity.Author.Status;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+@NotNullByDefault
+public interface IdentityManager {
+
+	/**
+	 * Stores the local pseudonym.
+	 */
+	void registerLocalAuthor(LocalAuthor a) throws DbException;
+
+	/**
+	 * Returns the cached main local identity, non-blocking, or loads it from
+	 * the db, blocking
+	 */
+	LocalAuthor getLocalAuthor() throws DbException;
+
+	/**
+	 * Returns the cached main local identity, non-blocking, or loads it from
+	 * the db, blocking, within the given Transaction.
+	 */
+	LocalAuthor getLocalAuthor(Transaction txn) throws DbException;
+
+	/**
+	 * Returns the trust-level status of the author
+	 */
+	Status getAuthorStatus(AuthorId a) throws DbException;
+
+	/**
+	 * Returns the trust-level status of the author
+	 */
+	Status getAuthorStatus(Transaction txn, AuthorId a) throws DbException;
+
+}

bramble-api/src/main/java/org/briarproject/bramble/api/identity/LocalAuthor.java

@@ -1,6 +1,14 @@
-package org.briarproject.api.identity;
+package org.briarproject.bramble.api.identity;
 
-/** A pseudonym for the local user. */
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.concurrent.Immutable;
+
+/**
+ * A pseudonym for the local user.
+ */
+@Immutable
+@NotNullByDefault
 public class LocalAuthor extends Author {
 
 	private final byte[] privateKey;
@@ -13,7 +21,9 @@ public class LocalAuthor extends Author {
 		this.created = created;
 	}
 
-	/**  Returns the private key used to generate the pseudonym's signatures. */
+	/**
+	 * Returns the private key used to generate the pseudonym's signatures.
+	 */
 	public byte[] getPrivateKey() {
 		return privateKey;
 	}

bramble-api/src/main/java/org/briarproject/bramble/api/identity/event/LocalAuthorAddedEvent.java

@@ -0,0 +1,25 @@
+package org.briarproject.bramble.api.identity.event;
+
+import org.briarproject.bramble.api.event.Event;
+import org.briarproject.bramble.api.identity.AuthorId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.concurrent.Immutable;
+
+/**
+ * An event that is broadcast when a local pseudonym is added.
+ */
+@Immutable
+@NotNullByDefault
+public class LocalAuthorAddedEvent extends Event {
+
+	private final AuthorId authorId;
+
+	public LocalAuthorAddedEvent(AuthorId authorId) {
+		this.authorId = authorId;
+	}
+
+	public AuthorId getAuthorId() {
+		return authorId;
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/identity/event/LocalAuthorRemovedEvent.java

@@ -0,0 +1,25 @@
+package org.briarproject.bramble.api.identity.event;
+
+import org.briarproject.bramble.api.event.Event;
+import org.briarproject.bramble.api.identity.AuthorId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.concurrent.Immutable;
+
+/**
+ * An event that is broadcast when a local pseudonym is removed.
+ */
+@Immutable
+@NotNullByDefault
+public class LocalAuthorRemovedEvent extends Event {
+
+	private final AuthorId authorId;
+
+	public LocalAuthorRemovedEvent(AuthorId authorId) {
+		this.authorId = authorId;
+	}
+
+	public AuthorId getAuthorId() {
+		return authorId;
+	}
+}

bramble-api/src/main/java/org/briarproject/bramble/api/invitation/InvitationConstants.java

@@ -0,0 +1,20 @@
+package org.briarproject.bramble.api.invitation;
+
+public interface InvitationConstants {
+
+	/**
+	 * The connection timeout in milliseconds.
+	 */
+	long CONNECTION_TIMEOUT = 60 * 1000;
+
+	/**
+	 * The confirmation timeout in milliseconds.
+	 */
+	long CONFIRMATION_TIMEOUT = 60 * 1000;
+
+	/**
+	 * The number of bits in an invitation or confirmation code. Codes must fit
+	 * into six decimal digits.
+	 */
+	int CODE_BITS = 19;
+}

bramble-api/src/main/java/org/briarproject/bramble/api/invitation/InvitationListener.java

@@ -1,4 +1,4 @@
-package org.briarproject.api.invitation;
+package org.briarproject.bramble.api.invitation;
 
 /**
  * An interface for receiving updates about the state of an

bramble-api/src/main/java/org/briarproject/bramble/api/invitation/InvitationState.java

@@ -1,5 +1,15 @@
-package org.briarproject.api.invitation;
+package org.briarproject.bramble.api.invitation;
 
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+import javax.annotation.Nullable;
+import javax.annotation.concurrent.Immutable;
+
+/**
+ * A snapshot of the state of an {@link InvitationTask}.
+ */
+@Immutable
+@NotNullByDefault
 public class InvitationState {
 
 	private final int localInvitationCode, remoteInvitationCode;
@@ -7,13 +17,14 @@ public class InvitationState {
 	private final boolean connected, connectionFailed;
 	private final boolean localCompared, remoteCompared;
 	private final boolean localMatched, remoteMatched;
+	@Nullable
 	private final String contactName;
 
 	public InvitationState(int localInvitationCode, int remoteInvitationCode,
 			int localConfirmationCode, int remoteConfirmationCode,
 			boolean connected, boolean connectionFailed, boolean localCompared,
 			boolean remoteCompared, boolean localMatched,
-			boolean remoteMatched, String contactName) {
+			boolean remoteMatched, @Nullable String contactName) {
 		this.localInvitationCode = localInvitationCode;
 		this.remoteInvitationCode = remoteInvitationCode;
 		this.localConfirmationCode = localConfirmationCode;
@@ -67,6 +78,7 @@ public class InvitationState {
 		return remoteMatched;
 	}
 
+	@Nullable
 	public String getContactName() {
 		return contactName;
 	}

bramble-api/src/main/java/org/briarproject/bramble/api/invitation/InvitationTask.java

@@ -1,6 +1,11 @@
-package org.briarproject.api.invitation;
+package org.briarproject.bramble.api.invitation;
 
-/** A task for exchanging invitations with a remote peer. */
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+/**
+ * A task for exchanging invitations with a remote peer.
+ */
+@NotNullByDefault
 public interface InvitationTask {
 
 	/**
@@ -9,10 +14,14 @@ public interface InvitationTask {
 	 */
 	InvitationState addListener(InvitationListener l);
 
-	/** Removes the given listener. */
+	/**
+	 * Removes the given listener.
+	 */
 	void removeListener(InvitationListener l);
 
-	/** Asynchronously starts the connection process. */
+	/**
+	 * Asynchronously starts the connection process.
+	 */
 	void connect();
 
 	/**

bramble-api/src/main/java/org/briarproject/bramble/api/invitation/InvitationTaskFactory.java

@@ -0,0 +1,15 @@
+package org.briarproject.bramble.api.invitation;
+
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+
+/**
+ * Creates tasks for exchanging invitations with remote peers.
+ */
+@NotNullByDefault
+public interface InvitationTaskFactory {
+
+	/**
+	 * Creates a task using the given local and remote invitation codes.
+	 */
+	InvitationTask createTask(int localCode, int remoteCode);
+}

bramble-api/src/main/java/org/briarproject/bramble/api/keyagreement/KeyAgreementConnection.java

@@ -1,9 +1,15 @@
-package org.briarproject.api.keyagreement;
+package org.briarproject.bramble.api.keyagreement;
 
-import org.briarproject.api.TransportId;
+import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
-import org.briarproject.api.plugins.duplex.DuplexTransportConnection;
+import org.briarproject.bramble.api.plugin.TransportId;
+import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
 
+import javax.annotation.concurrent.Immutable;
+
+@Immutable
+@NotNullByDefault
 public class KeyAgreementConnection {
+
 	private final DuplexTransportConnection conn;
 	private final TransportId id;
 

bramble-api/src/main/java/org/briarproject/bramble/api/keyagreement/KeyAgreementConstants.java

@@ -0,0 +1,36 @@
+package org.briarproject.bramble.api.keyagreement;
+
+public interface KeyAgreementConstants {
+
+	/**
+	 * The current version of the BQP protocol.
+	 */
+	byte PROTOCOL_VERSION = 2;
+
+	/**
+	 * The length of the record header in bytes.
+	 */
+	int RECORD_HEADER_LENGTH = 4;
+
+	/**
+	 * The offset of the payload length in the record header, in bytes.
+	 */
+	int RECORD_HEADER_PAYLOAD_LENGTH_OFFSET = 2;
+
+	/**
+	 * The length of the BQP key commitment in bytes.
+	 */
+	int COMMIT_LENGTH = 16;
+
+	long CONNECTION_TIMEOUT = 20 * 1000; // Milliseconds
+
+	/**
+	 * The transport identifier for Bluetooth.
+	 */
+	int TRANSPORT_ID_BLUETOOTH = 0;
+
+	/**
+	 * The transport identifier for LAN.
+	 */
+	int TRANSPORT_ID_LAN = 1;
+}