fix(android): load KMP files from app-external sources by jahorton · Pull Request #16392 · keymanapp/keyman

jahorton · 2026-08-17T20:42:11Z

This PR provides two main services:

It allows on-device KMP file providers (such as Chrome downloads or the local Files app) to smoothly pass those KMP files into Keyman for Android for installation.
It also removes wildcard-host http / https deep-links from the app manifest, as these are invalid.

Relates-to: #14854

Upon my investigation into related documentation, I've determined that with current versions of Android, setting up a general, "anywhere on the web" deep link for KMP files is not supported and should not be attempted.

How, then, do we facilitate external apps passing off KMP links or files to Keyman for Android? Turns out... we've already done the work for downloaded files with file: and content: scheme deep-links. The issue is that some of our permissions-checking code logic was bad. With a little work to correct them - removing the bad checks that never should have existed anyway - the files load nicely!

Build-bot: skip release:android

Notes: upon reviewing #10133 and #14122, it sounds like there may be variance among devices. Samsung is likely to be trickier to handle, while Google devices using plain Chrome may be more straightforward. I may need to alter the user tests accordingly.

User Testing

GROUP_API_28: Perform these tests on devices with Android API 28 (Android 9).
GROUP_API_30: Perform these tests on devices with Android API 30 (Android 11).
GROUP_API_33: Perform these tests on devices with Android API 33+ (Android 13).

TEST_DOWNLOAD_AND_INSTALL: Using Keyman for Android, download a KMP from within the Chrome app, then install it from Chrome's download section.

Navigate to https://jahorton.github.io and click the english_punct_rota.kmp link in order to download the file.
Once downloaded, go to the download section (if not displayed) and tap on the downloaded file.
Verify that Keyman for Android launches and opens the package installer without displaying an error or alert.
Install the package and verify that no errors result.

TEST_INSTALL_VIA_FILES: Using Keyman for Android, download a KMP from within the Chrome app, then install it from the device's Files app.

Navigate to https://jahorton.github.io and click the gesture_prototyping.kmp link in order to download the file.
Once downloaded, exit Chrome and use the device's Files app to find and "open" the downloaded file.
Verify that Keyman for Android launches and opens the package installer without displaying an error or alert.
Install the package and verify that no errors result.

This PR provides two main services: - It allows on-device KMP file providers (such as Chrome downloads or the local Files app) to smoothly pass those KMP files into Keyman for Android for installation. - It also removes wildcard-host http / https deep-links from the app manifest, as these are invalid. Fixes: #14854 Fixes: #10133 Upon my investigation into related documentation, I've determined that with current versions of Android, setting up a general, "anywhere on the web" deep link for KMP files is not supported and should not be attempted. How, then, do we facilitate external apps passing off KMP links or files to Keyman for Android? Turns out... we've already done the work for downloaded files with `file:` and `content:` scheme deep-links. The issue is that some of our permissions-checking code logic was bad. With a little work to correct them - removing the bad checks that never should have existed anyway - the files load nicely! Build-bot: skip release:android

keymanapp-test-bot · 2026-08-17T20:42:34Z

User Test Results

Test specification and instructions

⬜ GROUP_API_28: Perform these tests on devices with Android API 28 (Android 9).
- ✅ TEST_DOWNLOAD_AND_INSTALL (PASSED) (notes)
- ⬜ TEST_INSTALL_VIA_FILES (OPEN)
⬜ GROUP_API_30: Perform these tests on devices with Android API 30 (Android 11).
- ✅ TEST_DOWNLOAD_AND_INSTALL (PASSED) (notes)
- ⬜ TEST_INSTALL_VIA_FILES (OPEN)
⬜ GROUP_API_33: Perform these tests on devices with Android API 33+ (Android 13).
- ✅ TEST_DOWNLOAD_AND_INSTALL (PASSED) (notes)
- ⬜ TEST_INSTALL_VIA_FILES (OPEN)

Results Template

# Test Results

### GROUP_API_28: Perform these tests on devices with Android API 28 (Android 9).

* **TEST_INSTALL_VIA_FILES (OPEN):** notes

### GROUP_API_30: Perform these tests on devices with Android API 30 (Android 11).

* **TEST_INSTALL_VIA_FILES (OPEN):** notes

### GROUP_API_33: Perform these tests on devices with Android API 33+ (Android 13).

* **TEST_INSTALL_VIA_FILES (OPEN):** notes

Test Artifacts

Android

mcdurdin · 2026-08-18T05:22:12Z

Trying to install a .kmp on my phone from Samsung files gives an error

mcdurdin · 2026-08-18T06:54:29Z

I tested downloading a file from Chrome on my Samsung Galaxy A553 5G on Android 16 (One UI 8.0), Chrome version 151.0.7922.137 (11 Aug 2026). It worked fine -- Keyman appeared on the list of available apps to open the .kmp file, and no errors were encountered.

Samsung Files continues to fail with the error as shown above. 'Files by Google' works fine -- so suggest we recommend that as an alternative file manager on Samsung devices.

See also: #10967 (comment)

mcdurdin · 2026-08-18T08:25:21Z

I think we should have a user test for:

installing a keyboard from keyman.com (in a browser, not within Keyman)

We should at some point also test, once we have a stable release build:

the normal keyboard + app install flow from keyman.com (via Play Store)

…ent-filters Fixes: #14122

jahorton · 2026-08-18T16:44:38Z

I think we should have a user test for:
* installing a keyboard from keyman.com (in a browser, not within Keyman) 

Would the test be for it to download, then install from download? Or would it be to instantly load into the Keyman app package-install process?

mcdurdin · 2026-08-18T17:10:13Z

Or would it be to instantly load into the Keyman app package-install process?

I think this -- we want to verify that existing package install pathways have not been impacted (not that I think they have -- but for the avoidance of unpleasant surprises...)

jahorton · 2026-08-18T17:43:17Z

Or would it be to instantly load into the Keyman app package-install process?

I think this -- we want to verify that existing package install pathways have not been impacted (not that I think they have -- but for the avoidance of unpleasant surprises...)

They were, but by other changes - we internationalized keyman.com, which prefixes the language code onto all paths. I'm working on this now.

mcdurdin · 2026-08-18T18:42:08Z

They were, but by other changes - we internationalized keyman.com, which prefixes the language code onto all paths. I'm working on this now.

Can you open an issue as a first step?

mcdurdin

The AndroidManifest.xml still seems a bit chaotic. It would be good to review each intent-filter and ensure that the comments make sense, and group them appropriately.

mcdurdin · 2026-08-19T07:28:25Z

+      // No special permissions are needed.
+      // - https://developer.android.com/reference/android/Manifest.permission#READ_EXTERNAL_STORAGE
+      // - https://stackoverflow.com/a/73630987
    }


Let's just delete the empty else statement. We can have a note in the commit history for the change.

mcdurdin · 2026-08-19T07:30:07Z

+        <data
+          android:mimeType="application/vnd.keyman"
+          android:scheme="content" />


This is not a registered mime type.

Suggested change

<data

android:mimeType="application/vnd.keyman"

android:scheme="content" />

mcdurdin · 2026-08-19T07:30:32Z

+        <data
+          android:mimeType="application/vnd.keyman.kmp+zip"
+          android:scheme="content" />


Repeated

Suggested change

<data

android:mimeType="application/vnd.keyman.kmp+zip"

android:scheme="content" />

mcdurdin · 2026-08-19T07:32:48Z

        <data
          android:host="keyman-staging.com"
          android:scheme="http"
          android:pathPrefix="/keyboards/install" />


Not sure why this is http

Is the staging server usually https: when live? If so, yeah, I should update that.

I inferred the http:// because of existing entries like this one:

keyman/android/KMAPro/kMAPro/src/main/AndroidManifest.xml

Lines 195 to 198 in 82d5580

<data

android:host="keyman-staging.com"

android:scheme="http"

android:pathPrefix="/go/package/download" />

Because of how AndroidManifest.xml works, if there was a separate https: host set within the same <intent-filter>, it would also check against AndroidManifest.xml. That's relying on quirky, unintuitive behaviors; I think we'd prefer to be explicit here.

Is the staging server usually https: when live? If so, yeah, I should update that.

Always https:, yes. And generally always live.

mcdurdin · 2026-08-19T07:32:57Z

      </intent-filter>

-      <intent-filter android:priority="50">
+      <intent-filter android:priority="50" android:autoVerify="true">


What is this change for?

https://developer.android.com/training/app-links/verify-applinks

We probably don't need to implement this because we have another <intent-filter> entry that does verify the same domains... but that's a happy accident and shouldn't be what we rely upon.

Hmm, please make sure you call out changes like this in the PR description because it's definitely not related to the core purpose of the PR, and it is a significant change!

Actually, can you please split this into a separate PR for test and review? There's a fair bit of detail there that we should be careful about changing and testing.

mcdurdin · 2026-08-19T07:38:46Z

        <category android:name="android.intent.category.DEFAULT" />

        <data android:scheme="file" />
+        <data android:scheme="content" />


What does this do?

Matches both file:/// and content:// URIs. Often times, what we get between apps appears to be the content:// one.

It's an OR, not an AND - allowing us to share the host and pathPattern entries for both protocols.

I am not sure what this is fixing though -- does this impact the underlying reported issue?

…ve empty else - https://developer.android.com/reference/android/Manifest.permission#READ_EXTERNAL_STORAGE - https://stackoverflow.com/a/73630987

Meng-Heng · 2026-08-20T04:28:33Z

Test Results

GROUP_API_28:

Test Specs

Pixel 3a XL, API 28 (Android 9)
keyman-19.0.268-alpha-test-16392.apk

TEST_DOWNLOAD_AND_INSTALL (PASSED):

Navigate to https://jahorton.github.io and download the english_punct_rota.kmp file.
Once downloaded -> Open the file location -> Tap on the downloaded file -> Allow "Full Access to Files"
VERIFIED: Keyman for Android launches and opens the package installer without displaying an error or alert
Follow through the installation dialogs of the keyboard package
VERIFIED: No errors result. Dictionary installed alongside the keyboard.
Typing and predictive text work as expected.

GROUP_API_30:

Test Specs

Pixel 5, API 30 (Android 11)
keyman-19.0.268-alpha-test-16392.apk

TEST_DOWNLOAD_AND_INSTALL (PASSED):

Navigate to https://jahorton.github.io and download the english_punct_rota.kmp file.
Once downloaded -> Open the file location -> Tap on the downloaded file -> Receive an error about "Storage Permission"
Go to Android Settings -> Permission Manager -> Files and media permission -> Allow files and media only for Keyman
Tap on the downloaded file
VERIFIED: Keyman for Android launches and opens the package installer without displaying an error or alert
Follow through the installation dialogs of the keyboard package
VERIFIED: No errors result. Dictionary installed alongside the keyboard.
Typing and predictive text work as expected.

GROUP_API_33:

Test Specs

Pixel 6a, API 33 (Android 13.0)
keyman-19.0.268-alpha-test-16392.apk

TEST_DOWNLOAD_AND_INSTALL (PASSED):

Launch and Exit Keyman
Navigate to https://jahorton.github.io and download the english_punct_rota.kmp file.
Once downloaded -> Open the file location -> Tap on the downloaded file
VERIFIED: Keyman for Android launches and opens the package installer without displaying an error or alert
Follow through the installation dialogs of the keyboard package
VERIFIED: No errors result. Dictionary installed alongside the keyboard.
Predictive text and typing work as expected.

TEST_INSTALL_VIA_FILES (OPEN):

Meng-Heng · 2026-08-20T04:29:28Z

Hello, @jahorton. Could you help confirm the steps for the TEST_INSTALL_VIA_FILES are the same as TEST_DOWNLOAD_AND_INSTALL?

jahorton · 2026-08-20T13:32:15Z

Hello, @jahorton. Could you help confirm the steps for the TEST_INSTALL_VIA_FILES are the same as TEST_DOWNLOAD_AND_INSTALL?

Sorry about that. I've updated the instructions for that test now.

jahorton requested review from darcywong00 and mcdurdin August 17, 2026 20:42

github-project-automation Bot added this to Keyman Aug 17, 2026

github-project-automation Bot moved this to Todo in Keyman Aug 17, 2026

github-actions Bot added android/ android/app/ fix labels Aug 17, 2026

keymanapp-test-bot Bot added has-user-test user-test-required User tests have not been completed labels Aug 17, 2026

keymanapp-test-bot Bot added this to the A19S36 milestone Aug 17, 2026

mcdurdin mentioned this pull request Aug 18, 2026

bug(android): attempting to open a package from Samsung 'My Files' app results in an error 'You don't have any apps that can open this type of file' #10133

Open

8 tasks

change(web): add vnd.keyman.kmp+zip mime type to file-association int…

90b2e45

…ent-filters Fixes: #14122

mcdurdin requested changes Aug 19, 2026

View reviewed changes

change(android): clean up AndroidManifest.xml MIME-type entries, remo…

ba76704

…ve empty else - https://developer.android.com/reference/android/Manifest.permission#READ_EXTERNAL_STORAGE - https://stackoverflow.com/a/73630987

jahorton requested a review from mcdurdin August 19, 2026 17:08

keymanapp-test-bot Bot added the user-test-failed label Aug 20, 2026

keymanapp-test-bot Bot removed the user-test-failed label Aug 20, 2026

	<data
	android:mimeType="application/vnd.keyman"
	android:scheme="content" />

	<data
	android:host="keyman-staging.com"
	android:scheme="http"
	android:pathPrefix="/go/package/download" />

Uh oh!

Uh oh!

Conversation

jahorton commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User Testing

Uh oh!

keymanapp-test-bot Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User Test Results

Test Artifacts

Uh oh!

mcdurdin commented Aug 18, 2026

Uh oh!

mcdurdin commented Aug 18, 2026

Uh oh!

mcdurdin commented Aug 18, 2026

Uh oh!

jahorton commented Aug 18, 2026

Uh oh!

mcdurdin commented Aug 18, 2026

Uh oh!

jahorton commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mcdurdin commented Aug 18, 2026

Uh oh!

mcdurdin left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Meng-Heng commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

GROUP_API_28:

Test Specs

GROUP_API_30:

Test Specs

GROUP_API_33:

Test Specs

Uh oh!

Meng-Heng commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jahorton commented Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

jahorton commented Aug 17, 2026 •

edited

Loading

keymanapp-test-bot Bot commented Aug 17, 2026 •

edited

Loading

jahorton commented Aug 18, 2026 •

edited

Loading

Meng-Heng commented Aug 20, 2026 •

edited

Loading

Meng-Heng commented Aug 20, 2026 •

edited

Loading