Bump version numbers for 1.4.13 release.

Use uTLS with Chrome profile for Snowflake

See merge request briar/briar!1728

.gitlab-ci.yml

@@ -5,6 +5,9 @@ stages:
   - optional_tests
   - check_reproducibility
 
+variables:
+  GIT_SUBMODULE_STRATEGY: recursive
+
 workflow:
   # when to create a CI pipeline
   rules:
@@ -32,6 +35,7 @@ test:
   extends: .base-test
   stage: test
   script:
+    - git submodule update
     - ./gradlew -Djava.security.egd=file:/dev/urandom animalSnifferMain animalSnifferTest
     - ./gradlew -Djava.security.egd=file:/dev/urandom assembleOfficialDebug :briar-headless:linuxJars
     - ./gradlew -Djava.security.egd=file:/dev/urandom compileOfficialDebugAndroidTestSources compileScreenshotDebugAndroidTestSources check
@@ -98,7 +102,7 @@ bridge test:
       allow_failure: true
   script:
     - OPTIONAL_TESTS=org.briarproject.bramble.plugin.tor.BridgeTest ./gradlew --info bramble-java:test --tests BridgeTest
-  timeout: 3h
+  timeout: 4h
 
 mailbox integration test:
   extends: .optional_tests
@@ -109,19 +113,5 @@ mailbox integration test:
       when: manual
       allow_failure: true # TODO figure out how not to allow failure while leaving this optional
   script:
-    # start mailbox
-    - cd /opt && git clone --depth 1 https://code.briarproject.org/briar/briar-mailbox.git briar-mailbox
-    - cd briar-mailbox
-    - mkdir -p /root/.local/share # create directory that mailbox (currently) expects to exist
-    - ./gradlew run --args="--debug --setup-token 54686973206973206120736574757020746f6b656e20666f722042726961722e" &
-    # run mailbox integration test once mailbox has started
-    - cd "$CI_PROJECT_DIR"
-    - bramble-core/src/test/bash/wait-for-mailbox.sh
-    - OPTIONAL_TESTS=org.briarproject.bramble.mailbox.MailboxIntegrationTest ./gradlew --info bramble-core:test --tests MailboxIntegrationTest
-
-pre_release_tests:
-  extends: .optional_tests
-  script:
-    - OPTIONAL_TESTS=org.briarproject.bramble.plugin.tor.BridgeTest ./gradlew --info bramble-java:test --tests BridgeTest
-  only:
-    - tags
+    - (cd briar-mailbox; git fetch; git reset --hard origin/main)
+    - MAILBOX_INTEGRATION_TESTS=true ./gradlew --info mailbox-integration-tests:test

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "briar-mailbox"]
+	path = briar-mailbox
+	url = https://code.briarproject.org/briar/briar-mailbox.git

.idea/runConfigurations/All_tests_in_mailbox_integration_tests.xml

@@ -0,0 +1,29 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="All tests in mailbox-integration-tests" type="GradleRunConfiguration" factoryName="Gradle">
+    <ExternalSystemSettings>
+      <option name="env">
+        <map>
+          <entry key="MAILBOX_INTEGRATION_TESTS" value="true" />
+        </map>
+      </option>
+      <option name="executionName" />
+      <option name="externalProjectPath" value="$PROJECT_DIR$" />
+      <option name="externalSystemIdString" value="GRADLE" />
+      <option name="scriptParameters" value="" />
+      <option name="taskDescriptions">
+        <list />
+      </option>
+      <option name="taskNames">
+        <list>
+          <option value=":mailbox-integration-tests:test" />
+          <option value=":mailbox-integration-tests:cleanTest" />
+        </list>
+      </option>
+      <option name="vmOptions" value="" />
+    </ExternalSystemSettings>
+    <ExternalSystemDebugServerProcess>false</ExternalSystemDebugServerProcess>
+    <ExternalSystemReattachDebugProcess>true</ExternalSystemReattachDebugProcess>
+    <DebugAllEnabled>false</DebugAllEnabled>
+    <method v="2" />
+  </configuration>
+</component>

CONTRIBUTING.md

@@ -0,0 +1,10 @@
+Folder-Description:
+===================
+* `briar-*`: Specifically for the Briar app (Phone/Desktop/Headless)
+* `bramble-*`: The protocol stack - not necessarily Briar-dependent
+
+---
+
+* `*-api`: public stuff that can be referenced from other packages and modules - mostly interfaces + a few utility classes
+* `*-core`: implementations of api that are portable across Android/Desktop/Headless
+* `*-java`: implementations of api that are specific to Desktop & Headless

bramble-android/build.gradle

@@ -15,8 +15,8 @@ android {
 	defaultConfig {
 		minSdkVersion 16
 		targetSdkVersion 30
-		versionCode 10406
-		versionName "1.4.6"
+		versionCode 10413
+		versionName "1.4.13"
 		consumerProguardFiles 'proguard-rules.txt'
 
 		testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
@@ -42,8 +42,10 @@ configurations {
 
 dependencies {
 	implementation project(path: ':bramble-core', configuration: 'default')
+	implementation 'androidx.annotation:annotation:1.5.0'
 	tor "org.briarproject:tor-android:$tor_version"
 	tor "org.briarproject:obfs4proxy-android:$obfs4proxy_version"
+	tor "org.briarproject:snowflake-android:$snowflake_version"
 
 	annotationProcessor "com.google.dagger:dagger-compiler:$dagger_version"
 

bramble-android/proguard-rules.txt

@@ -18,3 +18,7 @@
 -dontnote com.google.common.**
 
 -dontwarn com.fasterxml.jackson.databind.ext.Java7SupportImpl
+
+# Keep all Jackson-serialisable classes and their members
+-keep interface com.fasterxml.jackson.databind.annotation.JsonSerialize
+-keep @com.fasterxml.jackson.databind.annotation.JsonSerialize class * { *; }

bramble-android/src/main/java/org/briarproject/bramble/BrambleAndroidModule.java

@@ -1,6 +1,7 @@
 package org.briarproject.bramble;
 
 import org.briarproject.bramble.battery.AndroidBatteryModule;
+import org.briarproject.bramble.io.DnsModule;
 import org.briarproject.bramble.network.AndroidNetworkModule;
 import org.briarproject.bramble.plugin.tor.CircumventionModule;
 import org.briarproject.bramble.reporting.ReportingModule;
@@ -18,6 +19,7 @@ import dagger.Module;
 		AndroidTaskSchedulerModule.class,
 		AndroidWakefulIoExecutorModule.class,
 		CircumventionModule.class,
+		DnsModule.class,
 		ReportingModule.class,
 		SocksModule.class
 })

bramble-android/src/main/java/org/briarproject/bramble/api/system/AlarmListener.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.api.system;
 
 import android.content.Intent;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface AlarmListener {

bramble-android/src/main/java/org/briarproject/bramble/api/system/AndroidWakeLock.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.system;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface AndroidWakeLock {

bramble-android/src/main/java/org/briarproject/bramble/api/system/AndroidWakeLockManager.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.system;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.concurrent.Executor;
 

bramble-android/src/main/java/org/briarproject/bramble/network/AndroidNetworkManager.java

@@ -11,17 +11,19 @@ import android.net.LinkAddress;
 import android.net.LinkProperties;
 import android.net.Network;
 import android.net.NetworkInfo;
+import android.net.wifi.WifiInfo;
+import android.net.wifi.WifiManager;
 
+import org.briarproject.bramble.api.Cancellable;
 import org.briarproject.bramble.api.event.EventBus;
 import org.briarproject.bramble.api.event.EventExecutor;
 import org.briarproject.bramble.api.lifecycle.Service;
 import org.briarproject.bramble.api.network.NetworkManager;
 import org.briarproject.bramble.api.network.NetworkStatus;
 import org.briarproject.bramble.api.network.event.NetworkStatusEvent;
-import org.briarproject.bramble.api.nullsafety.MethodsNotNullByDefault;
-import org.briarproject.bramble.api.nullsafety.ParametersNotNullByDefault;
 import org.briarproject.bramble.api.system.TaskScheduler;
-import org.briarproject.bramble.api.system.TaskScheduler.Cancellable;
+import org.briarproject.nullsafety.MethodsNotNullByDefault;
+import org.briarproject.nullsafety.ParametersNotNullByDefault;
 
 import java.net.Inet4Address;
 import java.net.InetAddress;
@@ -38,6 +40,7 @@ import javax.annotation.Nullable;
 import javax.inject.Inject;
 
 import static android.content.Context.CONNECTIVITY_SERVICE;
+import static android.content.Context.WIFI_SERVICE;
 import static android.content.Intent.ACTION_SCREEN_OFF;
 import static android.content.Intent.ACTION_SCREEN_ON;
 import static android.net.ConnectivityManager.CONNECTIVITY_ACTION;
@@ -52,8 +55,8 @@ import static java.util.concurrent.TimeUnit.SECONDS;
 import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.WARNING;
 import static java.util.logging.Logger.getLogger;
-import static org.briarproject.bramble.api.nullsafety.NullSafety.requireNonNull;
 import static org.briarproject.bramble.util.LogUtils.logException;
+import static org.briarproject.nullsafety.NullSafety.requireNonNull;
 
 @MethodsNotNullByDefault
 @ParametersNotNullByDefault
@@ -111,15 +114,37 @@ class AndroidNetworkManager implements NetworkManager, Service {
 
 	@Override
 	public NetworkStatus getNetworkStatus() {
-		NetworkInfo net = connectivityManager.getActiveNetworkInfo();
-		boolean connected = net != null && net.isConnected();
-		boolean wifi = false, ipv6Only = false;
-		if (connected) {
-			wifi = net.getType() == TYPE_WIFI;
-			if (SDK_INT >= 23) ipv6Only = isActiveNetworkIpv6Only();
-			else ipv6Only = areAllAvailableNetworksIpv6Only();
+		// https://issuetracker.google.com/issues/175055271
+		try {
+			NetworkInfo net = connectivityManager.getActiveNetworkInfo();
+			boolean connected = net != null && net.isConnected();
+			boolean wifi = false, ipv6Only = false;
+			if (connected) {
+				wifi = net.getType() == TYPE_WIFI;
+				if (SDK_INT >= 23) ipv6Only = isActiveNetworkIpv6Only();
+				else ipv6Only = areAllAvailableNetworksIpv6Only();
+			}
+			return new NetworkStatus(connected, wifi, ipv6Only);
+		} catch (SecurityException e) {
+			logException(LOG, WARNING, e);
+			// Without the ConnectivityManager we can't detect whether we have
+			// internet access. Assume we do, which is probably less harmful
+			// than assuming we don't. Likewise, assume the connection is
+			// IPv6-only. Fall back to the WifiManager to detect whether we
+			// have a wifi connection.
+			LOG.info("ConnectivityManager is broken, guessing connectivity");
+			boolean connected = true, wifi = false, ipv6Only = true;
+			WifiManager wm = (WifiManager) app.getSystemService(WIFI_SERVICE);
+			if (wm != null) {
+				WifiInfo info = wm.getConnectionInfo();
+				if (info != null && info.getIpAddress() != 0) {
+					LOG.info("Connected to wifi");
+					wifi = true;
+					ipv6Only = false;
+				}
+			}
+			return new NetworkStatus(connected, wifi, ipv6Only);
 		}
-		return new NetworkStatus(connected, wifi, ipv6Only);
 	}
 
 	/**
@@ -130,23 +155,29 @@ class AndroidNetworkManager implements NetworkManager, Service {
 	 */
 	@TargetApi(23)
 	private boolean isActiveNetworkIpv6Only() {
-		Network net = connectivityManager.getActiveNetwork();
-		if (net == null) {
-			LOG.info("No active network");
+		// https://issuetracker.google.com/issues/175055271
+		try {
+			Network net = connectivityManager.getActiveNetwork();
+			if (net == null) {
+				LOG.info("No active network");
+				return false;
+			}
+			LinkProperties props = connectivityManager.getLinkProperties(net);
+			if (props == null) {
+				LOG.info("No link properties for active network");
+				return false;
+			}
+			boolean hasIpv6Unicast = false;
+			for (LinkAddress linkAddress : props.getLinkAddresses()) {
+				InetAddress addr = linkAddress.getAddress();
+				if (addr instanceof Inet4Address) return false;
+				if (!addr.isMulticastAddress()) hasIpv6Unicast = true;
+			}
+			return hasIpv6Unicast;
+		} catch (SecurityException e) {
+			logException(LOG, WARNING, e);
 			return false;
 		}
-		LinkProperties props = connectivityManager.getLinkProperties(net);
-		if (props == null) {
-			LOG.info("No link properties for active network");
-			return false;
-		}
-		boolean hasIpv6Unicast = false;
-		for (LinkAddress linkAddress : props.getLinkAddresses()) {
-			InetAddress addr = linkAddress.getAddress();
-			if (addr instanceof Inet4Address) return false;
-			if (!addr.isMulticastAddress()) hasIpv6Unicast = true;
-		}
-		return hasIpv6Unicast;
 	}
 
 	/**

bramble-android/src/main/java/org/briarproject/bramble/plugin/bluetooth/AndroidBluetoothConnectionFactory.java

@@ -3,10 +3,10 @@ package org.briarproject.bramble.plugin.bluetooth;
 import android.bluetooth.BluetoothSocket;
 
 import org.briarproject.bramble.api.io.TimeoutMonitor;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.duplex.DuplexPlugin;
 import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
 import org.briarproject.bramble.api.system.AndroidWakeLockManager;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 

bramble-android/src/main/java/org/briarproject/bramble/plugin/bluetooth/AndroidBluetoothPlugin.java

@@ -10,8 +10,6 @@ import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 
-import org.briarproject.bramble.api.nullsafety.MethodsNotNullByDefault;
-import org.briarproject.bramble.api.nullsafety.ParametersNotNullByDefault;
 import org.briarproject.bramble.api.plugin.Backoff;
 import org.briarproject.bramble.api.plugin.PluginCallback;
 import org.briarproject.bramble.api.plugin.PluginException;
@@ -20,6 +18,8 @@ import org.briarproject.bramble.api.system.AndroidExecutor;
 import org.briarproject.bramble.api.system.Clock;
 import org.briarproject.bramble.util.AndroidUtils;
 import org.briarproject.bramble.util.IoUtils;
+import org.briarproject.nullsafety.MethodsNotNullByDefault;
+import org.briarproject.nullsafety.ParametersNotNullByDefault;
 
 import java.io.IOException;
 import java.security.SecureRandom;

bramble-android/src/main/java/org/briarproject/bramble/plugin/bluetooth/AndroidBluetoothPluginFactory.java

@@ -6,7 +6,6 @@ import android.bluetooth.BluetoothSocket;
 import org.briarproject.bramble.api.event.EventBus;
 import org.briarproject.bramble.api.io.TimeoutMonitor;
 import org.briarproject.bramble.api.lifecycle.IoExecutor;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.Backoff;
 import org.briarproject.bramble.api.plugin.BackoffFactory;
 import org.briarproject.bramble.api.plugin.PluginCallback;
@@ -17,6 +16,7 @@ import org.briarproject.bramble.api.system.AndroidExecutor;
 import org.briarproject.bramble.api.system.AndroidWakeLockManager;
 import org.briarproject.bramble.api.system.Clock;
 import org.briarproject.bramble.api.system.WakefulIoExecutor;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.security.SecureRandom;
 import java.util.concurrent.Executor;

bramble-android/src/main/java/org/briarproject/bramble/plugin/bluetooth/AndroidBluetoothTransportConnection.java

@@ -3,11 +3,11 @@ package org.briarproject.bramble.plugin.bluetooth;
 import android.bluetooth.BluetoothSocket;
 
 import org.briarproject.bramble.api.io.TimeoutMonitor;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.Plugin;
 import org.briarproject.bramble.api.plugin.duplex.AbstractDuplexTransportConnection;
 import org.briarproject.bramble.api.system.AndroidWakeLock;
 import org.briarproject.bramble.api.system.AndroidWakeLockManager;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 import java.io.InputStream;

bramble-android/src/main/java/org/briarproject/bramble/plugin/file/AndroidRemovableDrivePlugin.java

@@ -3,9 +3,9 @@ package org.briarproject.bramble.plugin.file;
 import android.app.Application;
 import android.net.Uri;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.PluginCallback;
 import org.briarproject.bramble.api.properties.TransportProperties;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -32,13 +32,22 @@ class AndroidRemovableDrivePlugin extends RemovableDrivePlugin {
 	InputStream openInputStream(TransportProperties p) throws IOException {
 		String uri = p.get(PROP_URI);
 		if (isNullOrEmpty(uri)) throw new IllegalArgumentException();
-		return app.getContentResolver().openInputStream(Uri.parse(uri));
+		try {
+			return app.getContentResolver().openInputStream(Uri.parse(uri));
+		} catch (SecurityException e) {
+			throw new IOException(e);
+		}
 	}
 
 	@Override
 	OutputStream openOutputStream(TransportProperties p) throws IOException {
 		String uri = p.get(PROP_URI);
 		if (isNullOrEmpty(uri)) throw new IllegalArgumentException();
-		return app.getContentResolver().openOutputStream(Uri.parse(uri), "wt");
+		try {
+			return app.getContentResolver()
+					.openOutputStream(Uri.parse(uri), "wt");
+		} catch (SecurityException e) {
+			throw new IOException(e);
+		}
 	}
 }

bramble-android/src/main/java/org/briarproject/bramble/plugin/file/AndroidRemovableDrivePluginFactory.java

@@ -2,11 +2,11 @@ package org.briarproject.bramble.plugin.file;
 
 import android.app.Application;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.PluginCallback;
 import org.briarproject.bramble.api.plugin.TransportId;
 import org.briarproject.bramble.api.plugin.simplex.SimplexPlugin;
 import org.briarproject.bramble.api.plugin.simplex.SimplexPluginFactory;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.Nullable;
 import javax.annotation.concurrent.Immutable;

bramble-android/src/main/java/org/briarproject/bramble/plugin/tcp/AndroidLanTcpPlugin.java

@@ -14,10 +14,10 @@ import org.briarproject.bramble.PoliteExecutor;
 import org.briarproject.bramble.api.Pair;
 import org.briarproject.bramble.api.event.Event;
 import org.briarproject.bramble.api.network.event.NetworkStatusEvent;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.Backoff;
 import org.briarproject.bramble.api.plugin.PluginCallback;
 import org.briarproject.bramble.api.settings.Settings;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 import java.net.InetAddress;
@@ -43,13 +43,13 @@ import static java.util.Collections.list;
 import static java.util.Collections.singletonList;
 import static java.util.logging.Level.WARNING;
 import static java.util.logging.Logger.getLogger;
-import static org.briarproject.bramble.api.nullsafety.NullSafety.requireNonNull;
 import static org.briarproject.bramble.api.plugin.LanTcpConstants.DEFAULT_PREF_PLUGIN_ENABLE;
 import static org.briarproject.bramble.api.plugin.Plugin.State.ACTIVE;
 import static org.briarproject.bramble.api.plugin.Plugin.State.INACTIVE;
 import static org.briarproject.bramble.util.IoUtils.tryToClose;
 import static org.briarproject.bramble.util.LogUtils.logException;
 import static org.briarproject.bramble.util.NetworkUtils.getNetworkInterfaces;
+import static org.briarproject.nullsafety.NullSafety.requireNonNull;
 
 @NotNullByDefault
 class AndroidLanTcpPlugin extends LanTcpPlugin {
@@ -175,16 +175,24 @@ class AndroidLanTcpPlugin extends LanTcpPlugin {
 	@TargetApi(21)
 	@Nullable
 	private InetAddress getWifiClientIpv6Address() {
-		for (Network net : connectivityManager.getAllNetworks()) {
-			NetworkCapabilities caps =
-					connectivityManager.getNetworkCapabilities(net);
-			if (caps == null || !caps.hasTransport(TRANSPORT_WIFI)) continue;
-			LinkProperties props = connectivityManager.getLinkProperties(net);
-			if (props == null) continue;
-			for (LinkAddress linkAddress : props.getLinkAddresses()) {
-				InetAddress addr = linkAddress.getAddress();
-				if (isIpv6LinkLocalAddress(addr)) return addr;
+		// https://issuetracker.google.com/issues/175055271
+		try {
+			for (Network net : connectivityManager.getAllNetworks()) {
+				NetworkCapabilities caps =
+						connectivityManager.getNetworkCapabilities(net);
+				if (caps == null || !caps.hasTransport(TRANSPORT_WIFI)) {
+					continue;
+				}
+				LinkProperties props =
+						connectivityManager.getLinkProperties(net);
+				if (props == null) continue;
+				for (LinkAddress linkAddress : props.getLinkAddresses()) {
+					InetAddress addr = linkAddress.getAddress();
+					if (isIpv6LinkLocalAddress(addr)) return addr;
+				}
 			}
+		} catch (SecurityException e) {
+			logException(LOG, WARNING, e);
 		}
 		return null;
 	}
@@ -227,12 +235,17 @@ class AndroidLanTcpPlugin extends LanTcpPlugin {
 	// network's socket factory may try to connect via another network
 	private SocketFactory getSocketFactory() {
 		if (SDK_INT < 21) return SocketFactory.getDefault();
-		for (Network net : connectivityManager.getAllNetworks()) {
-			NetworkCapabilities caps =
-					connectivityManager.getNetworkCapabilities(net);
-			if (caps != null && caps.hasTransport(TRANSPORT_WIFI)) {
-				return net.getSocketFactory();
+		// https://issuetracker.google.com/issues/175055271
+		try {
+			for (Network net : connectivityManager.getAllNetworks()) {
+				NetworkCapabilities caps =
+						connectivityManager.getNetworkCapabilities(net);
+				if (caps != null && caps.hasTransport(TRANSPORT_WIFI)) {
+					return net.getSocketFactory();
+				}
 			}
+		} catch (SecurityException e) {
+			logException(LOG, WARNING, e);
 		}
 		LOG.warning("Could not find suitable socket factory");
 		return SocketFactory.getDefault();

bramble-android/src/main/java/org/briarproject/bramble/plugin/tcp/AndroidLanTcpPluginFactory.java

@@ -4,7 +4,6 @@ import android.app.Application;
 
 import org.briarproject.bramble.api.event.EventBus;
 import org.briarproject.bramble.api.lifecycle.IoExecutor;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.Backoff;
 import org.briarproject.bramble.api.plugin.BackoffFactory;
 import org.briarproject.bramble.api.plugin.PluginCallback;
@@ -12,6 +11,7 @@ import org.briarproject.bramble.api.plugin.TransportId;
 import org.briarproject.bramble.api.plugin.duplex.DuplexPlugin;
 import org.briarproject.bramble.api.plugin.duplex.DuplexPluginFactory;
 import org.briarproject.bramble.api.system.WakefulIoExecutor;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.concurrent.Executor;
 

bramble-android/src/main/java/org/briarproject/bramble/plugin/tor/AndroidTorPlugin.java

@@ -7,8 +7,6 @@ import android.content.pm.PackageManager.NameNotFoundException;
 
 import org.briarproject.bramble.api.battery.BatteryManager;
 import org.briarproject.bramble.api.network.NetworkManager;
-import org.briarproject.bramble.api.nullsafety.MethodsNotNullByDefault;
-import org.briarproject.bramble.api.nullsafety.ParametersNotNullByDefault;
 import org.briarproject.bramble.api.plugin.Backoff;
 import org.briarproject.bramble.api.plugin.PluginCallback;
 import org.briarproject.bramble.api.system.AndroidWakeLock;
@@ -17,6 +15,8 @@ import org.briarproject.bramble.api.system.Clock;
 import org.briarproject.bramble.api.system.LocationUtils;
 import org.briarproject.bramble.api.system.ResourceProvider;
 import org.briarproject.bramble.util.AndroidUtils;
+import org.briarproject.nullsafety.MethodsNotNullByDefault;
+import org.briarproject.nullsafety.ParametersNotNullByDefault;
 
 import java.io.File;
 import java.io.FileInputStream;
@@ -31,6 +31,8 @@ import java.util.zip.ZipInputStream;
 
 import javax.net.SocketFactory;
 
+import androidx.annotation.ChecksSdkIntAtLeast;
+
 import static android.os.Build.VERSION.SDK_INT;
 import static java.util.Arrays.asList;
 import static java.util.logging.Level.INFO;
@@ -45,13 +47,14 @@ class AndroidTorPlugin extends TorPlugin {
 
 	private static final String TOR_LIB_NAME = "libtor.so";
 	private static final String OBFS4_LIB_NAME = "libobfs4proxy.so";
+	private static final String SNOWFLAKE_LIB_NAME = "libsnowflake.so";
 
 	private static final Logger LOG =
 			getLogger(AndroidTorPlugin.class.getName());
 
 	private final Application app;
 	private final AndroidWakeLock wakeLock;
-	private final File torLib, obfs4Lib;
+	private final File torLib, obfs4Lib, snowflakeLib;
 
 	AndroidTorPlugin(Executor ioExecutor,
 			Executor wakefulIoExecutor,
@@ -83,6 +86,7 @@ class AndroidTorPlugin extends TorPlugin {
 		String nativeLibDir = app.getApplicationInfo().nativeLibraryDir;
 		torLib = new File(nativeLibDir, TOR_LIB_NAME);
 		obfs4Lib = new File(nativeLibDir, OBFS4_LIB_NAME);
+		snowflakeLib = new File(nativeLibDir, SNOWFLAKE_LIB_NAME);
 	}
 
 	@Override
@@ -108,6 +112,12 @@ class AndroidTorPlugin extends TorPlugin {
 		if (!enable) wakeLock.release();
 	}
 
+	@Override
+	@ChecksSdkIntAtLeast(api = 25)
+	protected boolean canVerifyLetsEncryptCerts() {
+		return SDK_INT >= 25;
+	}
+
 	@Override
 	public void stop() {
 		super.stop();
@@ -124,39 +134,43 @@ class AndroidTorPlugin extends TorPlugin {
 		return obfs4Lib.exists() ? obfs4Lib : super.getObfs4ExecutableFile();
 	}
 
+	@Override
+	protected File getSnowflakeExecutableFile() {
+		return snowflakeLib.exists()
+				? snowflakeLib : super.getSnowflakeExecutableFile();
+	}
+
 	@Override
 	protected void installTorExecutable() throws IOException {
-		File extracted = super.getTorExecutableFile();
-		if (torLib.exists()) {
-			// If an older version left behind a Tor binary, delete it
-			if (extracted.exists()) {
-				if (extracted.delete()) LOG.info("Deleted Tor binary");
-				else LOG.info("Failed to delete Tor binary");
-			}
-		} else if (SDK_INT < 29) {
-			// The binary wasn't extracted at install time. Try to extract it
-			extractLibraryFromApk(TOR_LIB_NAME, extracted);
-		} else {
-			// No point extracting the binary, we won't be allowed to execute it
-			throw new FileNotFoundException(torLib.getAbsolutePath());
-		}
+		installExecutable(super.getTorExecutableFile(), torLib, TOR_LIB_NAME);
 	}
 
 	@Override
 	protected void installObfs4Executable() throws IOException {
-		File extracted = super.getObfs4ExecutableFile();
-		if (obfs4Lib.exists()) {
-			// If an older version left behind an obfs4 binary, delete it
+		installExecutable(super.getObfs4ExecutableFile(), obfs4Lib,
+				OBFS4_LIB_NAME);
+	}
+
+	@Override
+	protected void installSnowflakeExecutable() throws IOException {
+		installExecutable(super.getSnowflakeExecutableFile(), snowflakeLib,
+				SNOWFLAKE_LIB_NAME);
+	}
+
+	private void installExecutable(File extracted, File lib, String libName)
+			throws IOException {
+		if (lib.exists()) {
+			// If an older version left behind a binary, delete it
 			if (extracted.exists()) {
-				if (extracted.delete()) LOG.info("Deleted obfs4 binary");
-				else LOG.info("Failed to delete obfs4 binary");
+				if (extracted.delete()) LOG.info("Deleted old binary");
+				else LOG.info("Failed to delete old binary");
 			}
 		} else if (SDK_INT < 29) {
 			// The binary wasn't extracted at install time. Try to extract it
-			extractLibraryFromApk(OBFS4_LIB_NAME, extracted);
+			extractLibraryFromApk(libName, extracted);
 		} else {
 			// No point extracting the binary, we won't be allowed to execute it
-			throw new FileNotFoundException(obfs4Lib.getAbsolutePath());
+			throw new FileNotFoundException(lib.getAbsolutePath());
 		}
 	}
 

bramble-android/src/main/java/org/briarproject/bramble/plugin/tor/AndroidTorPluginFactory.java

@@ -7,66 +7,39 @@ import org.briarproject.bramble.api.crypto.CryptoComponent;
 import org.briarproject.bramble.api.event.EventBus;
 import org.briarproject.bramble.api.lifecycle.IoExecutor;
 import org.briarproject.bramble.api.network.NetworkManager;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.Backoff;
 import org.briarproject.bramble.api.plugin.BackoffFactory;
 import org.briarproject.bramble.api.plugin.PluginCallback;
-import org.briarproject.bramble.api.plugin.TorConstants;
 import org.briarproject.bramble.api.plugin.TorControlPort;
 import org.briarproject.bramble.api.plugin.TorDirectory;
 import org.briarproject.bramble.api.plugin.TorSocksPort;
-import org.briarproject.bramble.api.plugin.TransportId;
-import org.briarproject.bramble.api.plugin.duplex.DuplexPlugin;
-import org.briarproject.bramble.api.plugin.duplex.DuplexPluginFactory;
 import org.briarproject.bramble.api.system.AndroidWakeLockManager;
 import org.briarproject.bramble.api.system.Clock;
 import org.briarproject.bramble.api.system.LocationUtils;
 import org.briarproject.bramble.api.system.ResourceProvider;
 import org.briarproject.bramble.api.system.WakefulIoExecutor;
-import org.briarproject.bramble.util.AndroidUtils;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.File;
 import java.util.concurrent.Executor;
-import java.util.logging.Logger;
 
+import javax.annotation.Nullable;
 import javax.annotation.concurrent.Immutable;
 import javax.inject.Inject;
 import javax.net.SocketFactory;
 
+import static org.briarproject.bramble.util.AndroidUtils.getSupportedArchitectures;
+
 @Immutable
 @NotNullByDefault
-public class AndroidTorPluginFactory implements DuplexPluginFactory {
+public class AndroidTorPluginFactory extends TorPluginFactory {
 
-	private static final Logger LOG =
-			Logger.getLogger(AndroidTorPluginFactory.class.getName());
-
-	private static final int MAX_LATENCY = 30 * 1000; // 30 seconds
-	private static final int MAX_IDLE_TIME = 30 * 1000; // 30 seconds
-	private static final int MIN_POLLING_INTERVAL = 60 * 1000; // 1 minute
-	private static final int MAX_POLLING_INTERVAL = 10 * 60 * 1000; // 10 mins
-	private static final double BACKOFF_BASE = 1.2;
-
-	private final Executor ioExecutor, wakefulIoExecutor;
 	private final Application app;
-	private final NetworkManager networkManager;
-	private final LocationUtils locationUtils;
-	private final EventBus eventBus;
-	private final SocketFactory torSocketFactory;
-	private final BackoffFactory backoffFactory;
-	private final ResourceProvider resourceProvider;
-	private final CircumventionProvider circumventionProvider;
-	private final BatteryManager batteryManager;
 	private final AndroidWakeLockManager wakeLockManager;
-	private final Clock clock;
-	private final File torDirectory;
-	private int torSocksPort;
-	private int torControlPort;
-	private final CryptoComponent crypto;
 
 	@Inject
 	AndroidTorPluginFactory(@IoExecutor Executor ioExecutor,
 			@WakefulIoExecutor Executor wakefulIoExecutor,
-			Application app,
 			NetworkManager networkManager,
 			LocationUtils locationUtils,
 			EventBus eventBus,
@@ -75,80 +48,43 @@ public class AndroidTorPluginFactory implements DuplexPluginFactory {
 			ResourceProvider resourceProvider,
 			CircumventionProvider circumventionProvider,
 			BatteryManager batteryManager,
-			AndroidWakeLockManager wakeLockManager,
 			Clock clock,
+			CryptoComponent crypto,
 			@TorDirectory File torDirectory,
 			@TorSocksPort int torSocksPort,
 			@TorControlPort int torControlPort,
-			CryptoComponent crypto) {
-		this.ioExecutor = ioExecutor;
-		this.wakefulIoExecutor = wakefulIoExecutor;
+			Application app,
+			AndroidWakeLockManager wakeLockManager) {
+		super(ioExecutor, wakefulIoExecutor, networkManager, locationUtils,
+				eventBus, torSocketFactory, backoffFactory, resourceProvider,
+				circumventionProvider, batteryManager, clock, crypto,
+				torDirectory, torSocksPort, torControlPort);
 		this.app = app;
-		this.networkManager = networkManager;
-		this.locationUtils = locationUtils;
-		this.eventBus = eventBus;
-		this.torSocketFactory = torSocketFactory;
-		this.backoffFactory = backoffFactory;
-		this.resourceProvider = resourceProvider;
-		this.circumventionProvider = circumventionProvider;
-		this.batteryManager = batteryManager;
 		this.wakeLockManager = wakeLockManager;
-		this.clock = clock;
-		this.torDirectory = torDirectory;
-		this.torSocksPort = torSocksPort;
-		this.torControlPort = torControlPort;
-		this.crypto = crypto;
 	}
 
+	@Nullable
 	@Override
-	public TransportId getId() {
-		return TorConstants.ID;
-	}
-
-	@Override
-	public long getMaxLatency() {
-		return MAX_LATENCY;
-	}
-
-	@Override
-	public DuplexPlugin createPlugin(PluginCallback callback) {
-
-		// Check that we have a Tor binary for this architecture
-		String architecture = null;
-		for (String abi : AndroidUtils.getSupportedArchitectures()) {
-			if (abi.startsWith("x86_64")) {
-				architecture = "x86_64";
-				break;
-			} else if (abi.startsWith("x86")) {
-				architecture = "x86";
-				break;
-			} else if (abi.startsWith("arm64")) {
-				architecture = "arm64";
-				break;
-			} else if (abi.startsWith("armeabi")) {
-				architecture = "arm";
-				break;
-			}
+	String getArchitectureForTorBinary() {
+		for (String abi : getSupportedArchitectures()) {
+			if (abi.startsWith("x86_64")) return "x86_64_pie";
+			else if (abi.startsWith("x86")) return "x86_pie";
+			else if (abi.startsWith("arm64")) return "arm64_pie";
+			else if (abi.startsWith("armeabi")) return "arm_pie";
 		}
-		if (architecture == null) {
-			LOG.info("Tor is not supported on this architecture");
-			return null;
-		}
-		// Use position-independent executable
-		architecture += "_pie";
+		return null;
+	}
 
-		Backoff backoff = backoffFactory.createBackoff(MIN_POLLING_INTERVAL,
-				MAX_POLLING_INTERVAL, BACKOFF_BASE);
-		TorRendezvousCrypto torRendezvousCrypto =
-				new TorRendezvousCryptoImpl(crypto);
-		AndroidTorPlugin plugin = new AndroidTorPlugin(ioExecutor,
+	@Override
+	TorPlugin createPluginInstance(Backoff backoff,
+			TorRendezvousCrypto torRendezvousCrypto, PluginCallback callback,
+			String architecture) {
+		return new AndroidTorPlugin(ioExecutor,
 				wakefulIoExecutor, app, networkManager, locationUtils,
 				torSocketFactory, clock, resourceProvider,
 				circumventionProvider, batteryManager, wakeLockManager,
 				backoff, torRendezvousCrypto, callback, architecture,
 				MAX_LATENCY, MAX_IDLE_TIME, torDirectory, torSocksPort,
 				torControlPort);
-		eventBus.addListener(plugin);
-		return plugin;
 	}
 }

bramble-android/src/main/java/org/briarproject/bramble/system/AlarmConstants.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.system;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 interface AlarmConstants {

bramble-android/src/main/java/org/briarproject/bramble/system/AndroidLocationUtils.java

@@ -6,8 +6,8 @@ import android.content.Context;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.system.LocationUtils;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.Locale;
 import java.util.logging.Logger;

bramble-android/src/main/java/org/briarproject/bramble/system/AndroidResourceProvider.java

@@ -4,8 +4,8 @@ import android.app.Application;
 import android.content.Context;
 import android.content.res.Resources;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.system.ResourceProvider;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.InputStream;
 

bramble-android/src/main/java/org/briarproject/bramble/system/AndroidSecureRandomProvider.java

@@ -11,7 +11,7 @@ import android.os.Parcel;
 import android.os.StrictMode;
 import android.provider.Settings;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.DataOutputStream;
 import java.io.IOException;

bramble-android/src/main/java/org/briarproject/bramble/system/AndroidTaskScheduler.java

@@ -8,12 +8,13 @@ import android.content.Intent;
 import android.os.Process;
 import android.os.SystemClock;
 
+import org.briarproject.bramble.api.Cancellable;
 import org.briarproject.bramble.api.lifecycle.Service;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.system.AlarmListener;
 import org.briarproject.bramble.api.system.AndroidWakeLockManager;
 import org.briarproject.bramble.api.system.TaskScheduler;
 import org.briarproject.bramble.api.system.Wakeful;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -116,10 +117,12 @@ class AndroidTaskScheduler implements TaskScheduler, Service, AlarmListener {
 		long dueMillis = now + MILLISECONDS.convert(delay, unit);
 		Runnable wakeful = () ->
 				wakeLockManager.executeWakefully(task, executor, "TaskHandoff");
-		Future<?> check = scheduleCheckForDueTasks(delay, unit);
-		ScheduledTask s = new ScheduledTask(wakeful, dueMillis, check,
-				cancelled);
+		// Acquire the lock before scheduling the check to ensure the check
+		// doesn't access the task queue before the task has been added
+		ScheduledTask s;
 		synchronized (lock) {
+			Future<?> check = scheduleCheckForDueTasks(delay, unit);
+			s = new ScheduledTask(wakeful, dueMillis, check, cancelled);
 			tasks.add(s);
 		}
 		return s;
@@ -136,6 +139,7 @@ class AndroidTaskScheduler implements TaskScheduler, Service, AlarmListener {
 		return schedule(wrapped, executor, delay, unit, cancelled);
 	}
 
+	@GuardedBy("lock")
 	private Future<?> scheduleCheckForDueTasks(long delay, TimeUnit unit) {
 		Runnable wakeful = () -> wakeLockManager.runWakefully(
 				this::runDueTasks, "TaskScheduler");
@@ -206,7 +210,7 @@ class AndroidTaskScheduler implements TaskScheduler, Service, AlarmListener {
 		private final Future<?> check;
 		private final AtomicBoolean cancelled;
 
-		public ScheduledTask(Runnable task, long dueMillis,
+		private ScheduledTask(Runnable task, long dueMillis,
 				Future<?> check, AtomicBoolean cancelled) {
 			this.task = task;
 			this.dueMillis = dueMillis;

bramble-android/src/main/java/org/briarproject/bramble/system/AndroidWakeLockImpl.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.system;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.system.AndroidWakeLock;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.logging.Logger;

bramble-android/src/main/java/org/briarproject/bramble/system/AndroidWakeLockManagerImpl.java

@@ -5,9 +5,9 @@ import android.content.Context;
 import android.content.pm.PackageManager;
 import android.os.PowerManager;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.system.AndroidWakeLock;
 import org.briarproject.bramble.api.system.AndroidWakeLockManager;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.concurrent.Executor;
 import java.util.concurrent.ScheduledExecutorService;
@@ -18,7 +18,7 @@ import static android.content.Context.POWER_SERVICE;
 import static android.os.PowerManager.PARTIAL_WAKE_LOCK;
 import static java.util.concurrent.TimeUnit.MINUTES;
 import static java.util.concurrent.TimeUnit.SECONDS;
-import static org.briarproject.bramble.api.nullsafety.NullSafety.requireNonNull;
+import static org.briarproject.nullsafety.NullSafety.requireNonNull;
 
 @NotNullByDefault
 class AndroidWakeLockManagerImpl implements AndroidWakeLockManager {

bramble-android/src/main/java/org/briarproject/bramble/system/RenewableWakeLock.java

@@ -3,7 +3,7 @@ package org.briarproject.bramble.system;
 import android.os.PowerManager;
 import android.os.PowerManager.WakeLock;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.concurrent.Future;
 import java.util.concurrent.ScheduledExecutorService;
@@ -18,7 +18,7 @@ import static java.util.logging.Level.FINE;
 import static java.util.logging.Level.INFO;
 import static java.util.logging.Level.WARNING;
 import static java.util.logging.Logger.getLogger;
-import static org.briarproject.bramble.api.nullsafety.NullSafety.requireNonNull;
+import static org.briarproject.nullsafety.NullSafety.requireNonNull;
 
 @ThreadSafe
 @NotNullByDefault

bramble-android/src/main/java/org/briarproject/bramble/system/SharedWakeLock.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.system;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.system.AndroidWakeLock;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 interface SharedWakeLock {

bramble-android/src/main/java/org/briarproject/bramble/util/AndroidUtils.java

@@ -4,10 +4,11 @@ import android.annotation.SuppressLint;
 import android.bluetooth.BluetoothAdapter;
 import android.content.Context;
 import android.os.Build;
+import android.os.Looper;
 import android.provider.Settings;
 
 import org.briarproject.bramble.api.Pair;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.File;
 import java.io.IOException;
@@ -25,7 +26,7 @@ import static android.content.Context.MODE_PRIVATE;
 import static android.os.Build.VERSION.SDK_INT;
 import static java.lang.Runtime.getRuntime;
 import static java.util.Arrays.asList;
-import static org.briarproject.bramble.api.nullsafety.NullSafety.requireNonNull;
+import static org.briarproject.nullsafety.NullSafety.requireNonNull;
 
 @NotNullByDefault
 public class AndroidUtils {
@@ -134,4 +135,8 @@ public class AndroidUtils {
 			return null;
 		}
 	}
+
+	public static boolean isUiThread() {
+		return Looper.myLooper() == Looper.getMainLooper();
+	}
 }

bramble-android/witness.gradle

@@ -1,5 +1,6 @@
 dependencyVerification {
     verify = [
+        'androidx.annotation:annotation:1.5.0:annotation-1.5.0.jar:261fb7c0210858500bab66d34354972a75166ab4182add283780b05513d6ec4a',
         'cglib:cglib:3.2.8:cglib-3.2.8.jar:3f64de999ecc5595dc84ca8ff0879d8a34c8623f9ef3c517a53ed59023fcb9db',
         'com.android.tools.analytics-library:protos:30.0.3:protos-30.0.3.jar:f62b89dcd9de719c6a7b7e15fb1dd20e45b57222e675cf633607bd0ed6bca7e7',
         'com.android.tools.analytics-library:shared:30.0.3:shared-30.0.3.jar:05aa9ba3cc890354108521fdf99802565aae5dd6ca44a6ac8bb8d594d1c1cd15',
@@ -87,8 +88,9 @@ dependencyVerification {
         'org.apache.httpcomponents:httpmime:4.5.6:httpmime-4.5.6.jar:0b2b1102c18d3c7e05a77214b9b7501a6f6056174ae5604e0e256776eda7553e',
         'org.bouncycastle:bcpkix-jdk15on:1.56:bcpkix-jdk15on-1.56.jar:7043dee4e9e7175e93e0b36f45b1ec1ecb893c5f755667e8b916eb8dd201c6ca',
         'org.bouncycastle:bcprov-jdk15on:1.56:bcprov-jdk15on-1.56.jar:963e1ee14f808ffb99897d848ddcdb28fa91ddda867eb18d303e82728f878349',
-        'org.briarproject:obfs4proxy-android:0.0.12:obfs4proxy-android-0.0.12.jar:84159d2a4668abc40e3fccaa1f6fa0c04892863f9eb80a866ac8928d9f9a7e89',
-        'org.briarproject:tor-android:0.4.5.12-2:tor-android-0.4.5.12-2.jar:8545dbcef2bb6aa89c32bb6f8ac51f7a64bce3ae85845b3578ffdeb9b206feb9',
+        'org.briarproject:obfs4proxy-android:0.0.14:obfs4proxy-android-0.0.14.jar:ad9b1ee4757b05867a19e993147bbb018bddd1f26ce3da746d5f037d5991a8c8',
+        'org.briarproject:snowflake-android:2.3.1:snowflake-android-2.3.1.jar:1f83c9a070f87b7074af13627709a8b5aced5460104be7166af736b1bb73c293',
+        'org.briarproject:tor-android:0.4.5.14:tor-android-0.4.5.14.jar:7cf1beaa6c1db51fc8fac263aba9624ef289c3db29772509efcbc59f7057330a',
         'org.checkerframework:checker-compat-qual:2.5.3:checker-compat-qual-2.5.3.jar:d76b9afea61c7c082908023f0cbc1427fab9abd2df915c8b8a3e7a509bccbc6d',
         'org.checkerframework:checker-qual:2.5.2:checker-qual-2.5.2.jar:64b02691c8b9d4e7700f8ee2e742dce7ea2c6e81e662b7522c9ee3bf568c040a',
         'org.checkerframework:checker-qual:3.5.0:checker-qual-3.5.0.jar:729990b3f18a95606fc2573836b6958bcdb44cb52bfbd1b7aa9c339cff35a5a4',
@@ -129,10 +131,12 @@ dependencyVerification {
         'org.jetbrains.kotlin:kotlin-reflect:1.4.32:kotlin-reflect-1.4.32.jar:dbf19e9cdaa9c3c170f3f6f6ce3922f38dfc1d7fa1cab5b7c23a19da8b5eec5b',
         'org.jetbrains.kotlin:kotlin-stdlib-common:1.4.20:kotlin-stdlib-common-1.4.20.jar:a7112c9b3cefee418286c9c9372f7af992bd1e6e030691d52f60cb36dbec8320',
         'org.jetbrains.kotlin:kotlin-stdlib-common:1.4.32:kotlin-stdlib-common-1.4.32.jar:e1ff6f55ee9e7591dcc633f7757bac25a7edb1cc7f738b37ec652f10f66a4145',
+        'org.jetbrains.kotlin:kotlin-stdlib-common:1.7.10:kotlin-stdlib-common-1.7.10.jar:19f102efe9629f8eabc63853ad15c533e47c47f91fca09285c5bde86e59f91d4',
         'org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.4.32:kotlin-stdlib-jdk7-1.4.32.jar:5f801e75ca27d8791c14b07943c608da27620d910a8093022af57f543d5d98b6',
         'org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.4.32:kotlin-stdlib-jdk8-1.4.32.jar:adc43e54757b106e0cd7b3b7aa257dff471b61efdabe067fc02b2f57e2396262',
         'org.jetbrains.kotlin:kotlin-stdlib:1.4.20:kotlin-stdlib-1.4.20.jar:b8ab1da5cdc89cb084d41e1f28f20a42bd431538642a5741c52bbfae3fa3e656',
         'org.jetbrains.kotlin:kotlin-stdlib:1.4.32:kotlin-stdlib-1.4.32.jar:13e9fd3e69dc7230ce0fc873a92a4e5d521d179bcf1bef75a6705baac3bfecba',
+        'org.jetbrains.kotlin:kotlin-stdlib:1.7.10:kotlin-stdlib-1.7.10.jar:e771fe74250a943e8f6346713201ff1d8cb95c3a5d1a91a22b65a9e04f6a8901',
         'org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.1.0:kotlinx-metadata-jvm-0.1.0.jar:9753bb39efef35957c5c15df9a3cb769aabf2cdfa74b47afcb7760e5146be3b5',
         'org.jetbrains:annotations:13.0:annotations-13.0.jar:ace2a10dc8e2d5fd34925ecac03e4988b2c0f851650c94b8cef49ba1bd111478',
         'org.jmock:jmock-imposters:2.12.0:jmock-imposters-2.12.0.jar:3b836269745a137c9b2347e8d7c2104845b126ef04f012d6bfd94f1a7dea7b09',

bramble-api/build.gradle

@@ -7,6 +7,8 @@ apply plugin: 'witness'
 apply from: 'witness.gradle'
 
 dependencies {
+	api 'org.briarproject:null-safety:0.1'
+
 	implementation "com.google.dagger:dagger:$dagger_version"
 	implementation 'com.google.code.findbugs:jsr305:3.0.2'
 	implementation "com.fasterxml.jackson.core:jackson-annotations:$jackson_version"

bramble-api/src/main/java/org/briarproject/bramble/api/Bytes.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.util.StringUtils;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.Arrays;
 

bramble-api/src/main/java/org/briarproject/bramble/api/Cancellable.java

@@ -0,0 +1,6 @@
+package org.briarproject.bramble.api;
+
+public interface Cancellable {
+
+	void cancel();
+}

bramble-api/src/main/java/org/briarproject/bramble/api/Consumer.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface Consumer<T> {

bramble-api/src/main/java/org/briarproject/bramble/api/Multiset.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.Collections;
 import java.util.HashMap;

bramble-api/src/main/java/org/briarproject/bramble/api/Nameable.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface Nameable {

bramble-api/src/main/java/org/briarproject/bramble/api/Pair.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/Predicate.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface Predicate<T> {

bramble-api/src/main/java/org/briarproject/bramble/api/StringMap.java

@@ -1,8 +1,14 @@
 package org.briarproject.bramble.api;
 
+import org.briarproject.bramble.util.StringUtils;
+
+import java.util.ArrayList;
 import java.util.Hashtable;
+import java.util.List;
 import java.util.Map;
 
+import javax.annotation.Nullable;
+
 public abstract class StringMap extends Hashtable<String, String> {
 
 	protected StringMap(Map<String, String> m) {
@@ -52,4 +58,31 @@ public abstract class StringMap extends Hashtable<String, String> {
 	public void putLong(String key, long value) {
 		put(key, String.valueOf(value));
 	}
+
+	@Nullable
+	public int[] getIntArray(String key) {
+		String s = get(key);
+		if (s == null) return null;
+		// Handle empty string because "".split(",") returns {""}
+		if (s.length() == 0) return new int[0];
+		String[] intStrings = s.split(",");
+		int[] ints = new int[intStrings.length];
+		try {
+			for (int i = 0; i < ints.length; i++) {
+				ints[i] = Integer.parseInt(intStrings[i]);
+			}
+		} catch (NumberFormatException e) {
+			return null;
+		}
+		return ints;
+	}
+
+	public void putIntArray(String key, int[] value) {
+		List<String> intStrings = new ArrayList<>();
+		for (int integer : value) {
+			intStrings.add(String.valueOf(integer));
+		}
+		// Puts empty string if input array value is empty
+		put(key, StringUtils.join(intStrings, ","));
+	}
 }

bramble-api/src/main/java/org/briarproject/bramble/api/UniqueId.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.ThreadSafe;
 

bramble-api/src/main/java/org/briarproject/bramble/api/WeakSingletonProvider.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.lang.ref.WeakReference;
 

bramble-api/src/main/java/org/briarproject/bramble/api/account/AccountManager.java

@@ -3,7 +3,7 @@ package org.briarproject.bramble.api.account;
 import org.briarproject.bramble.api.crypto.DecryptionException;
 import org.briarproject.bramble.api.crypto.SecretKey;
 import org.briarproject.bramble.api.identity.IdentityManager;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.Nullable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/cleanup/CleanupHook.java

@@ -3,9 +3,9 @@ package org.briarproject.bramble.api.cleanup;
 import org.briarproject.bramble.api.db.DatabaseComponent;
 import org.briarproject.bramble.api.db.DbException;
 import org.briarproject.bramble.api.db.Transaction;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.GroupId;
 import org.briarproject.bramble.api.sync.MessageId;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.Collection;
 

bramble-api/src/main/java/org/briarproject/bramble/api/cleanup/CleanupManager.java

@@ -5,9 +5,9 @@ import org.briarproject.bramble.api.crypto.SecretKey;
 import org.briarproject.bramble.api.db.DatabaseComponent;
 import org.briarproject.bramble.api.db.Transaction;
 import org.briarproject.bramble.api.lifecycle.LifecycleManager;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.ClientId;
 import org.briarproject.bramble.api.sync.MessageId;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 /**
  * The CleanupManager is responsible for tracking the cleanup deadlines of

bramble-api/src/main/java/org/briarproject/bramble/api/cleanup/event/CleanupTimerStartedEvent.java

@@ -1,8 +1,8 @@
 package org.briarproject.bramble.api.cleanup.event;
 
 import org.briarproject.bramble.api.event.Event;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.MessageId;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/client/BdfIncomingMessageHook.java

@@ -8,10 +8,10 @@ import org.briarproject.bramble.api.db.DatabaseComponent;
 import org.briarproject.bramble.api.db.DbException;
 import org.briarproject.bramble.api.db.Metadata;
 import org.briarproject.bramble.api.db.Transaction;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.InvalidMessageException;
 import org.briarproject.bramble.api.sync.Message;
 import org.briarproject.bramble.api.sync.validation.IncomingMessageHook;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/client/BdfMessageContext.java

@@ -1,8 +1,8 @@
 package org.briarproject.bramble.api.client;
 
 import org.briarproject.bramble.api.data.BdfDictionary;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.MessageId;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.Collection;
 import java.util.Collections;

bramble-api/src/main/java/org/briarproject/bramble/api/client/BdfMessageValidator.java

@@ -4,13 +4,13 @@ import org.briarproject.bramble.api.FormatException;
 import org.briarproject.bramble.api.data.BdfList;
 import org.briarproject.bramble.api.data.MetadataEncoder;
 import org.briarproject.bramble.api.db.Metadata;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.Group;
 import org.briarproject.bramble.api.sync.InvalidMessageException;
 import org.briarproject.bramble.api.sync.Message;
 import org.briarproject.bramble.api.sync.MessageContext;
 import org.briarproject.bramble.api.sync.validation.MessageValidator;
 import org.briarproject.bramble.api.system.Clock;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.logging.Logger;
 

bramble-api/src/main/java/org/briarproject/bramble/api/client/ClientHelper.java

@@ -9,20 +9,20 @@ import org.briarproject.bramble.api.data.BdfList;
 import org.briarproject.bramble.api.db.DbException;
 import org.briarproject.bramble.api.db.Transaction;
 import org.briarproject.bramble.api.identity.Author;
-import org.briarproject.bramble.api.mailbox.MailboxPropertiesUpdate;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.mailbox.MailboxUpdate;
+import org.briarproject.bramble.api.mailbox.MailboxVersion;
 import org.briarproject.bramble.api.plugin.TransportId;
 import org.briarproject.bramble.api.properties.TransportProperties;
 import org.briarproject.bramble.api.sync.GroupId;
 import org.briarproject.bramble.api.sync.Message;
 import org.briarproject.bramble.api.sync.MessageId;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.security.GeneralSecurityException;
 import java.util.Collection;
+import java.util.List;
 import java.util.Map;
 
-import javax.annotation.Nullable;
-
 @NotNullByDefault
 public interface ClientHelper {
 
@@ -127,16 +127,17 @@ public interface ClientHelper {
 			BdfDictionary properties) throws FormatException;
 
 	/**
-	 * Parse and validate the property dictionary of a Mailbox property update
-	 * message.
+	 * Parse and validate the elements of a Mailbox update message.
 	 *
-	 * @return the properties for using the Mailbox, or null if there is no
-	 * Mailbox available
-	 * @throws FormatException if the properties are not valid
+	 * @return the parsed update message
+	 * @throws FormatException if the message elements are invalid
 	 */
-	@Nullable
-	MailboxPropertiesUpdate parseAndValidateMailboxPropertiesUpdate(
-			BdfDictionary properties) throws FormatException;
+	MailboxUpdate parseAndValidateMailboxUpdate(BdfList clientSupports,
+			BdfList serverSupports, BdfDictionary properties)
+			throws FormatException;
+
+	List<MailboxVersion> parseMailboxVersionList(BdfList bdfList)
+			throws FormatException;
 
 	/**
 	 * Retrieves the contact ID from the group metadata of the given contact

bramble-api/src/main/java/org/briarproject/bramble/api/client/ContactGroupFactory.java

@@ -2,9 +2,9 @@ package org.briarproject.bramble.api.client;
 
 import org.briarproject.bramble.api.contact.Contact;
 import org.briarproject.bramble.api.identity.AuthorId;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.sync.ClientId;
 import org.briarproject.bramble.api.sync.Group;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface ContactGroupFactory {

bramble-api/src/main/java/org/briarproject/bramble/api/connection/ConnectionManager.java

@@ -2,11 +2,12 @@ package org.briarproject.bramble.api.connection;
 
 import org.briarproject.bramble.api.contact.ContactId;
 import org.briarproject.bramble.api.contact.PendingContactId;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.TransportConnectionReader;
 import org.briarproject.bramble.api.plugin.TransportConnectionWriter;
 import org.briarproject.bramble.api.plugin.TransportId;
 import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
+import org.briarproject.bramble.api.sync.OutgoingSessionRecord;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface ConnectionManager {
@@ -16,6 +17,17 @@ public interface ConnectionManager {
 	 */
 	void manageIncomingConnection(TransportId t, TransportConnectionReader r);
 
+	/**
+	 * Manages an incoming connection from a contact via a mailbox.
+	 * <p>
+	 * This method does not mark the tag as recognised until after the data
+	 * has been read from the {@link TransportConnectionReader}, at which
+	 * point the {@link TagController} is called to decide whether the tag
+	 * should be marked as recognised.
+	 */
+	void manageIncomingConnection(TransportId t, TransportConnectionReader r,
+			TagController c);
+
 	/**
 	 * Manages an incoming connection from a contact over a duplex transport.
 	 */
@@ -34,6 +46,14 @@ public interface ConnectionManager {
 	void manageOutgoingConnection(ContactId c, TransportId t,
 			TransportConnectionWriter w);
 
+	/**
+	 * Manages an outgoing connection to a contact via a mailbox. The IDs of
+	 * any messages sent or acked are added to the given
+	 * {@link OutgoingSessionRecord}.
+	 */
+	void manageOutgoingConnection(ContactId c, TransportId t,
+			TransportConnectionWriter w, OutgoingSessionRecord sessionRecord);
+
 	/**
 	 * Manages an outgoing connection to a contact over a duplex transport.
 	 */
@@ -46,4 +66,21 @@ public interface ConnectionManager {
 	 */
 	void manageOutgoingConnection(PendingContactId p, TransportId t,
 			DuplexTransportConnection d);
+
+	/**
+	 * An interface for controlling whether a tag should be marked as
+	 * recognised.
+	 */
+	interface TagController {
+		/**
+		 * This method is only called if a tag was read from the corresponding
+		 * {@link TransportConnectionReader} and recognised.
+		 *
+		 * @param exception True if an exception was thrown while reading from
+		 * the {@link TransportConnectionReader}, after successfully reading
+		 * and recognising the tag.
+		 * @return True if the tag should be marked as recognised.
+		 */
+		boolean shouldMarkTagAsRecognised(boolean exception);
+	}
 }

bramble-api/src/main/java/org/briarproject/bramble/api/connection/ConnectionRegistry.java

@@ -2,7 +2,6 @@ package org.briarproject.bramble.api.connection;
 
 import org.briarproject.bramble.api.contact.ContactId;
 import org.briarproject.bramble.api.contact.PendingContactId;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.PluginConfig;
 import org.briarproject.bramble.api.plugin.TransportId;
 import org.briarproject.bramble.api.plugin.event.ConnectionClosedEvent;
@@ -12,6 +11,7 @@ import org.briarproject.bramble.api.plugin.event.ContactDisconnectedEvent;
 import org.briarproject.bramble.api.rendezvous.event.RendezvousConnectionClosedEvent;
 import org.briarproject.bramble.api.rendezvous.event.RendezvousConnectionOpenedEvent;
 import org.briarproject.bramble.api.sync.Priority;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.Collection;
 

bramble-api/src/main/java/org/briarproject/bramble/api/connection/InterruptibleConnection.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.connection;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 /**
  * A duplex sync connection that can be closed by interrupting its outgoing

bramble-api/src/main/java/org/briarproject/bramble/api/contact/Contact.java

@@ -3,7 +3,7 @@ package org.briarproject.bramble.api.contact;
 import org.briarproject.bramble.api.crypto.PublicKey;
 import org.briarproject.bramble.api.identity.Author;
 import org.briarproject.bramble.api.identity.AuthorId;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.Nullable;
 import javax.annotation.concurrent.Immutable;

bramble-api/src/main/java/org/briarproject/bramble/api/contact/ContactExchangeManager.java

@@ -3,8 +3,8 @@ package org.briarproject.bramble.api.contact;
 import org.briarproject.bramble.api.crypto.SecretKey;
 import org.briarproject.bramble.api.db.ContactExistsException;
 import org.briarproject.bramble.api.db.DbException;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.duplex.DuplexTransportConnection;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 

bramble-api/src/main/java/org/briarproject/bramble/api/contact/ContactId.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.contact;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.Nullable;
 import javax.annotation.concurrent.Immutable;

bramble-api/src/main/java/org/briarproject/bramble/api/contact/ContactManager.java

@@ -12,7 +12,7 @@ import org.briarproject.bramble.api.db.Transaction;
 import org.briarproject.bramble.api.identity.Author;
 import org.briarproject.bramble.api.identity.AuthorId;
 import org.briarproject.bramble.api.lifecycle.LifecycleManager;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.security.GeneralSecurityException;
 import java.util.Collection;

bramble-api/src/main/java/org/briarproject/bramble/api/contact/HandshakeManager.java

@@ -2,8 +2,8 @@ package org.briarproject.bramble.api.contact;
 
 import org.briarproject.bramble.api.crypto.SecretKey;
 import org.briarproject.bramble.api.db.DbException;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.transport.StreamWriter;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 import java.io.InputStream;

bramble-api/src/main/java/org/briarproject/bramble/api/contact/PendingContact.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api.contact;
 
 import org.briarproject.bramble.api.crypto.PublicKey;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/contact/PendingContactId.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api.contact;
 
 import org.briarproject.bramble.api.UniqueId;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.ThreadSafe;
 

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/ContactAddedEvent.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.api.contact.event;
 
 import org.briarproject.bramble.api.contact.ContactId;
 import org.briarproject.bramble.api.event.Event;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/ContactAliasChangedEvent.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.api.contact.event;
 
 import org.briarproject.bramble.api.contact.ContactId;
 import org.briarproject.bramble.api.event.Event;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.Nullable;
 import javax.annotation.concurrent.Immutable;

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/ContactRemovedEvent.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.api.contact.event;
 
 import org.briarproject.bramble.api.contact.ContactId;
 import org.briarproject.bramble.api.event.Event;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/ContactVerifiedEvent.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.api.contact.event;
 
 import org.briarproject.bramble.api.contact.ContactId;
 import org.briarproject.bramble.api.event.Event;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/PendingContactAddedEvent.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.api.contact.event;
 
 import org.briarproject.bramble.api.contact.PendingContact;
 import org.briarproject.bramble.api.event.Event;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/PendingContactRemovedEvent.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.api.contact.event;
 
 import org.briarproject.bramble.api.contact.PendingContactId;
 import org.briarproject.bramble.api.event.Event;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/contact/event/PendingContactStateChangedEvent.java

@@ -3,7 +3,7 @@ package org.briarproject.bramble.api.contact.event;
 import org.briarproject.bramble.api.contact.PendingContactId;
 import org.briarproject.bramble.api.contact.PendingContactState;
 import org.briarproject.bramble.api.event.Event;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/AgreementPrivateKey.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api.crypto;
 
 import org.briarproject.bramble.api.Bytes;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/AgreementPublicKey.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api.crypto;
 
 import org.briarproject.bramble.api.Bytes;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/CryptoComponent.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api.crypto;
 
 import org.briarproject.bramble.api.UniqueId;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.security.GeneralSecurityException;
 import java.security.SecureRandom;

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/DecryptionException.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public class DecryptionException extends Exception {

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/KeyPair.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/KeyParser.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.security.GeneralSecurityException;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/KeyStrengthener.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 /**
  * Interface for strengthening a password-based key, for example by using a

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/PasswordStrengthEstimator.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface PasswordStrengthEstimator {

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/PrivateKey.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 /**
  * The private half of a public/private {@link KeyPair}.

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/PublicKey.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 /**
  * The public half of a public/private {@link KeyPair}.

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/SignaturePrivateKey.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api.crypto;
 
 import org.briarproject.bramble.api.Bytes;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/SignaturePublicKey.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api.crypto;
 
 import org.briarproject.bramble.api.Bytes;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.concurrent.Immutable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/StreamDecrypter.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/StreamDecrypterFactory.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.transport.StreamContext;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.InputStream;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/StreamEncrypter.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 

bramble-api/src/main/java/org/briarproject/bramble/api/crypto/StreamEncrypterFactory.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api.crypto;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.transport.StreamContext;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.OutputStream;
 

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfEntry.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.data;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.Map.Entry;
 

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfReader.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.data;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.IOException;
 

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfReaderFactory.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.data;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.InputStream;
 

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfStringUtils.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.api.data;
 
 import org.briarproject.bramble.api.Bytes;
 import org.briarproject.bramble.api.FormatException;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.List;
 import java.util.Map;

bramble-api/src/main/java/org/briarproject/bramble/api/data/BdfWriterFactory.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.data;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.OutputStream;
 

bramble-api/src/main/java/org/briarproject/bramble/api/data/MetadataEncoder.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.api.data;
 
 import org.briarproject.bramble.api.FormatException;
 import org.briarproject.bramble.api.db.Metadata;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface MetadataEncoder {

bramble-api/src/main/java/org/briarproject/bramble/api/data/MetadataParser.java

@@ -2,7 +2,7 @@ package org.briarproject.bramble.api.data;
 
 import org.briarproject.bramble.api.FormatException;
 import org.briarproject.bramble.api.db.Metadata;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface MetadataParser {

bramble-api/src/main/java/org/briarproject/bramble/api/db/DatabaseComponent.java

@@ -10,7 +10,6 @@ import org.briarproject.bramble.api.crypto.SecretKey;
 import org.briarproject.bramble.api.identity.Author;
 import org.briarproject.bramble.api.identity.AuthorId;
 import org.briarproject.bramble.api.identity.Identity;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
 import org.briarproject.bramble.api.plugin.TransportId;
 import org.briarproject.bramble.api.settings.Settings;
 import org.briarproject.bramble.api.sync.Ack;
@@ -27,17 +26,25 @@ import org.briarproject.bramble.api.sync.validation.MessageState;
 import org.briarproject.bramble.api.transport.KeySetId;
 import org.briarproject.bramble.api.transport.TransportKeySet;
 import org.briarproject.bramble.api.transport.TransportKeys;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.util.Collection;
 import java.util.List;
 import java.util.Map;
 
 import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
 
 /**
  * Encapsulates the database implementation and exposes high-level operations
  * to other components.
+ * <p>
+ * With the exception of the {@link #open(SecretKey, MigrationListener)} and
+ * {@link #close()} methods, which must not be called concurrently, the
+ * database can be accessed from any thread. See {@link TransactionManager}
+ * for locking behaviour.
  */
+@ThreadSafe
 @NotNullByDefault
 public interface DatabaseComponent extends TransactionManager {
 
@@ -119,16 +126,11 @@ public interface DatabaseComponent extends TransactionManager {
 			TransportKeys k) throws DbException;
 
 	/**
-	 * Returns true if there are any acks or messages to send to the given
-	 * contact over a transport with the given maximum latency.
+	 * Returns true if there are any acks to send to the given contact.
 	 * <p/>
 	 * Read-only.
-	 *
-	 * @param eager True if messages that are not yet due for retransmission
-	 * should be included
 	 */
-	boolean containsAnythingToSend(Transaction txn, ContactId c,
-			long maxLatency, boolean eager) throws DbException;
+	boolean containsAcksToSend(Transaction txn, ContactId c) throws DbException;
 
 	/**
 	 * Returns true if the database contains the given contact for the given
@@ -154,6 +156,18 @@ public interface DatabaseComponent extends TransactionManager {
 	 */
 	boolean containsIdentity(Transaction txn, AuthorId a) throws DbException;
 
+	/**
+	 * Returns true if there are any messages to send to the given contact
+	 * over a transport with the given maximum latency.
+	 * <p/>
+	 * Read-only.
+	 *
+	 * @param eager True if messages that are not yet due for retransmission
+	 * should be included
+	 */
+	boolean containsMessagesToSend(Transaction txn, ContactId c,
+			long maxLatency, boolean eager) throws DbException;
+
 	/**
 	 * Returns true if the database contains the given pending contact.
 	 * <p/>
@@ -193,26 +207,15 @@ public interface DatabaseComponent extends TransactionManager {
 			throws DbException;
 
 	/**
-	 * Returns a batch of messages for the given contact, with a total length
-	 * less than or equal to the given length, for transmission over a
-	 * transport with the given maximum latency. Returns null if there are no
-	 * sendable messages that fit in the given length.
+	 * Returns a batch of messages for the given contact, for transmission over
+	 * a transport with the given maximum latency. The total length of the
+	 * messages, including record headers, will be no more than the given
+	 * capacity. Returns null if there are no sendable messages that would fit
+	 * in the given capacity.
 	 */
 	@Nullable
 	Collection<Message> generateBatch(Transaction txn, ContactId c,
-			int maxLength, long maxLatency) throws DbException;
-
-	/**
-	 * Returns a batch of messages for the given contact containing the
-	 * messages with the given IDs, for transmission over a transport with
-	 * the given maximum latency.
-	 * <p/>
-	 * If any of the given messages are not in the database or are not visible
-	 * to the contact, they are omitted from the batch without throwing an
-	 * exception.
-	 */
-	Collection<Message> generateBatch(Transaction txn, ContactId c,
-			Collection<MessageId> ids, long maxLatency) throws DbException;
+			long capacity, long maxLatency) throws DbException;
 
 	/**
 	 * Returns an offer for the given contact for transmission over a
@@ -232,15 +235,16 @@ public interface DatabaseComponent extends TransactionManager {
 			throws DbException;
 
 	/**
-	 * Returns a batch of messages for the given contact, with a total length
-	 * less than or equal to the given length, for transmission over a
-	 * transport with the given maximum latency. Only messages that have been
-	 * requested by the contact are returned. Returns null if there are no
-	 * sendable messages that fit in the given length.
+	 * Returns a batch of messages for the given contact, for transmission over
+	 * a transport with the given maximum latency. Only messages that have been
+	 * requested by the contact are returned. The total length of the messages,
+	 * including record headers, will be no more than the given capacity.
+	 * Returns null if there are no sendable messages that have been requested
+	 * by the contact and would fit in the given capacity.
 	 */
 	@Nullable
 	Collection<Message> generateRequestedBatch(Transaction txn, ContactId c,
-			int maxLength, long maxLatency) throws DbException;
+			long capacity, long maxLatency) throws DbException;
 
 	/**
 	 * Returns the contact with the given ID.
@@ -279,6 +283,13 @@ public interface DatabaseComponent extends TransactionManager {
 	 */
 	Group getGroup(Transaction txn, GroupId g) throws DbException;
 
+	/**
+	 * Returns the ID of the group containing the given message.
+	 * <p/>
+	 * Read-only.
+	 */
+	GroupId getGroupId(Transaction txn, MessageId m) throws DbException;
+
 	/**
 	 * Returns the metadata for the given group.
 	 * <p/>
@@ -344,6 +355,30 @@ public interface DatabaseComponent extends TransactionManager {
 	Collection<MessageId> getMessageIds(Transaction txn, GroupId g,
 			Metadata query) throws DbException;
 
+	/**
+	 * Returns the IDs of all messages received from the given contact that
+	 * need to be acknowledged.
+	 * <p/>
+	 * Read-only.
+	 */
+	Collection<MessageId> getMessagesToAck(Transaction txn, ContactId c)
+			throws DbException;
+
+	/**
+	 * Returns the IDs of some messages that are eligible to be sent to the
+	 * given contact over a transport with the given maximum latency. The total
+	 * length of the messages including record headers will be no more than the
+	 * given capacity.
+	 * <p/>
+	 * Unlike {@link #getUnackedMessagesToSend(Transaction, ContactId)} this
+	 * method does not return messages that have already been sent unless they
+	 * are due for retransmission.
+	 * <p/>
+	 * Read-only.
+	 */
+	Collection<MessageId> getMessagesToSend(Transaction txn, ContactId c,
+			long capacity, long maxLatency) throws DbException;
+
 	/**
 	 * Returns the IDs of any messages that need to be validated.
 	 * <p/>
@@ -460,15 +495,32 @@ public interface DatabaseComponent extends TransactionManager {
 	MessageStatus getMessageStatus(Transaction txn, ContactId c, MessageId m)
 			throws DbException;
 
+	/**
+	 * Returns the message with the given ID for transmission to the given
+	 * contact over a transport with the given maximum latency. Returns null
+	 * if the message is no longer visible to the contact.
+	 * <p/>
+	 * Read-only if {@code markAsSent} is false.
+	 *
+	 * @param markAsSent True if the message should be marked as sent.
+	 * If false it can be marked as sent by calling
+	 * {@link #setMessagesSent(Transaction, ContactId, Collection, long)}.
+	 */
+	@Nullable
+	Message getMessageToSend(Transaction txn, ContactId c, MessageId m,
+			long maxLatency, boolean markAsSent) throws DbException;
+
 	/**
 	 * Returns the IDs of all messages that are eligible to be sent to the
-	 * given contact, together with their raw lengths. This may include
-	 * messages that have already been sent and are not yet due for
-	 * retransmission.
+	 * given contact.
+	 * <p>
+	 * Unlike {@link #getMessagesToSend(Transaction, ContactId, long, long)}
+	 * this method may return messages that have already been sent and are
+	 * not yet due for retransmission.
 	 * <p/>
 	 * Read-only.
 	 */
-	Map<MessageId, Integer> getUnackedMessagesToSend(Transaction txn,
+	Collection<MessageId> getUnackedMessagesToSend(Transaction txn,
 			ContactId c) throws DbException;
 
 	/**
@@ -498,15 +550,18 @@ public interface DatabaseComponent extends TransactionManager {
 	 */
 	long getNextCleanupDeadline(Transaction txn) throws DbException;
 
-	/*
+	/**
 	 * Returns the next time (in milliseconds since the Unix epoch) when a
-	 * message is due to be sent to the given contact. The returned value may
-	 * be zero if a message is due to be sent immediately, or Long.MAX_VALUE if
-	 * no messages are scheduled to be sent.
+	 * message is due to be sent to the given contact over a transport with
+	 * the given latency.
+	 * <p>
+	 * The returned value may be zero if a message is due to be sent
+	 * immediately, or Long.MAX_VALUE if no messages are scheduled to be sent.
 	 * <p/>
 	 * Read-only.
 	 */
-	long getNextSendTime(Transaction txn, ContactId c) throws DbException;
+	long getNextSendTime(Transaction txn, ContactId c, long maxLatency)
+			throws DbException;
 
 	/**
 	 * Returns the pending contact with the given ID.
@@ -648,6 +703,13 @@ public interface DatabaseComponent extends TransactionManager {
 	void removeTransportKeys(Transaction txn, TransportId t, KeySetId k)
 			throws DbException;
 
+	/**
+	 * Records an ack for the given messages as having been sent to the given
+	 * contact.
+	 */
+	void setAckSent(Transaction txn, ContactId c, Collection<MessageId> acked)
+			throws DbException;
+
 	/**
 	 * Sets the cleanup timer duration for the given message. This does not
 	 * start the message's cleanup timer.
@@ -694,6 +756,13 @@ public interface DatabaseComponent extends TransactionManager {
 	void setMessageState(Transaction txn, MessageId m, MessageState state)
 			throws DbException;
 
+	/**
+	 * Records the given messages as having been sent to the given contact
+	 * over a transport with the given maximum latency.
+	 */
+	void setMessagesSent(Transaction txn, ContactId c,
+			Collection<MessageId> sent, long maxLatency) throws DbException;
+
 	/**
 	 * Adds dependencies for a message
 	 */

bramble-api/src/main/java/org/briarproject/bramble/api/db/DatabaseConfig.java

@@ -1,7 +1,7 @@
 package org.briarproject.bramble.api.db;
 
 import org.briarproject.bramble.api.crypto.KeyStrengthener;
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import java.io.File;
 

bramble-api/src/main/java/org/briarproject/bramble/api/db/DatabaseExecutor.java

@@ -18,6 +18,10 @@ import static java.lang.annotation.RetentionPolicy.RUNTIME;
  * submitted, tasks are not run concurrently, and submitting a task will never
  * block. Tasks must not run indefinitely. Tasks submitted during shutdown are
  * discarded.
+ * <p>
+ * It is not mandatory to use this executor for database tasks. The database
+ * can be accessed from any thread, but this executor's guarantee that tasks
+ * are run in the order they're submitted may be useful in some cases.
  */
 @Qualifier
 @Target({FIELD, METHOD, PARAMETER})

bramble-api/src/main/java/org/briarproject/bramble/api/db/DbCallable.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.db;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface DbCallable<R, E extends Exception> {

bramble-api/src/main/java/org/briarproject/bramble/api/db/DbRunnable.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.db;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 @NotNullByDefault
 public interface DbRunnable<E extends Exception> {

bramble-api/src/main/java/org/briarproject/bramble/api/db/NullableDbCallable.java

@@ -1,6 +1,6 @@
 package org.briarproject.bramble.api.db;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.Nullable;
 

bramble-api/src/main/java/org/briarproject/bramble/api/db/Transaction.java

@@ -45,6 +45,9 @@ public class Transaction {
 	/**
 	 * Attaches an event to be broadcast when the transaction has been
 	 * committed. The event will be broadcast on the {@link EventExecutor}.
+	 * Events and {@link #attach(Runnable) tasks} are submitted to the
+	 * {@link EventExecutor} in the order they were attached to the
+	 * transaction.
 	 */
 	public void attach(Event e) {
 		if (actions == null) actions = new ArrayList<>();
@@ -54,6 +57,9 @@ public class Transaction {
 	/**
 	 * Attaches a task to be executed when the transaction has been
 	 * committed. The task will be run on the {@link EventExecutor}.
+	 * {@link #attach(Event) Events} and tasks are submitted to the
+	 * {@link EventExecutor} in the order they were attached to the
+	 * transaction.
 	 */
 	public void attach(Runnable r) {
 		if (actions == null) actions = new ArrayList<>();

bramble-api/src/main/java/org/briarproject/bramble/api/db/TransactionManager.java

@@ -1,51 +1,95 @@
 package org.briarproject.bramble.api.db;
 
-import org.briarproject.bramble.api.nullsafety.NotNullByDefault;
+import org.briarproject.bramble.api.event.EventExecutor;
+import org.briarproject.nullsafety.NotNullByDefault;
 
 import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
 
+/**
+ * An interface for managing database transactions.
+ * <p>
+ * Read-only transactions may access the database concurrently. Read-write
+ * transactions access the database exclusively, so starting a read-only or
+ * read-write transaction will block until there are no read-write
+ * transactions in progress.
+ * <p>
+ * Failing to {@link #endTransaction(Transaction) end} a transaction will
+ * prevent other callers from accessing the database, so it is recommended to
+ * use the {@link #transaction(boolean, DbRunnable)},
+ * {@link #transactionWithResult(boolean, DbCallable)} and
+ * {@link #transactionWithNullableResult(boolean, NullableDbCallable)} methods
+ * where possible, which handle committing or aborting the transaction on the
+ * caller's behalf.
+ * <p>
+ * Transactions are not reentrant, i.e. it is not permitted to start a
+ * transaction on a thread that already has a transaction in progress.
+ */
+@ThreadSafe
 @NotNullByDefault
 public interface TransactionManager {
 
 	/**
-	 * Starts a new transaction and returns an object representing it.
-	 * <p/>
-	 * This method acquires locks, so it must not be called while holding a
-	 * lock.
+	 * Starts a new transaction and returns an object representing it. This
+	 * method acquires the database lock, which is held until
+	 * {@link #endTransaction(Transaction)} is called.
 	 *
-	 * @param readOnly true if the transaction will only be used for reading.
+	 * @param readOnly True if the transaction will only be used for reading,
+	 * in which case the database lock can be shared with other read-only
+	 * transactions.
 	 */
 	Transaction startTransaction(boolean readOnly) throws DbException;
 
 	/**
 	 * Commits a transaction to the database.
+	 * {@link #endTransaction(Transaction)} must be called to release the
+	 * database lock.
 	 */
 	void commitTransaction(Transaction txn) throws DbException;
 
 	/**
-	 * Ends a transaction. If the transaction has not been committed,
-	 * it will be aborted. If the transaction has been committed,
-	 * any events attached to the transaction are broadcast.
-	 * The database lock will be released in either case.
+	 * Ends a transaction. If the transaction has not been committed by
+	 * calling {@link #commitTransaction(Transaction)}, it is aborted and the
+	 * database lock is released.
+	 * <p>
+	 * If the transaction has been committed, any
+	 * {@link Transaction#attach events} attached to the transaction are
+	 * broadcast and any {@link Transaction#attach(Runnable) tasks} attached
+	 * to the transaction are submitted to the {@link EventExecutor}. The
+	 * database lock is then released.
 	 */
 	void endTransaction(Transaction txn);
 
 	/**
-	 * Runs the given task within a transaction.
+	 * Runs the given task within a transaction. The database lock is held
+	 * while running the task.
+	 *
+	 * @param readOnly True if the transaction will only be used for reading,
+	 * in which case the database lock can be shared with other read-only
+	 * transactions.
 	 */
 	<E extends Exception> void transaction(boolean readOnly,
 			DbRunnable<E> task) throws DbException, E;
 
 	/**
 	 * Runs the given task within a transaction and returns the result of the
-	 * task.
+	 * task. The database lock is held while running the task.
+	 *
+	 * @param readOnly True if the transaction will only be used for reading,
+	 * in which case the database lock can be shared with other read-only
+	 * transactions.
 	 */
 	<R, E extends Exception> R transactionWithResult(boolean readOnly,
 			DbCallable<R, E> task) throws DbException, E;
 
 	/**
 	 * Runs the given task within a transaction and returns the result of the
-	 * task, which may be null.
+	 * task, which may be null. The database lock is held while running the
+	 * task.
+	 *
+	 * @param readOnly True if the transaction will only be used for reading,
+	 * in which case the database lock can be shared with other read-only
+	 * transactions.
 	 */
 	@Nullable
 	<R, E extends Exception> R transactionWithNullableResult(boolean readOnly,