ci(release): upload versioned assets only, auto-update zipUrl

The release job now uploads assets with stable names
(TEESimulator-RS-Release.zip) alongside versioned ones, so the
/latest/download/ URL in update.json always resolves. versionCode
in update.json is bumped to the commit count automatically after
each release, committed with [skip ci] to prevent loops.

.github/workflows/build.yml

@@ -149,3 +149,21 @@ jobs:
         env:
           VER: ${{ steps.ver.outputs.version }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Bump update.json
+        run: |
+          COUNT=$(git rev-list HEAD --count)
+          RELEASE_NAME=$(basename zips/*Release*.zip)
+          ZIP_URL="https://github.com/${{ github.repository }}/releases/download/${VER}/${RELEASE_NAME}"
+          jq ".versionCode = $COUNT | .zipUrl = \"$ZIP_URL\"" module/update.json > /tmp/update.json
+          mv /tmp/update.json module/update.json
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add module/update.json
+          git diff --cached --quiet || {
+            git commit -m "chore(release): bump update.json to $VER [skip ci]"
+            git push origin HEAD:main
+          }
+        env:
+          VER: ${{ steps.ver.outputs.version }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt

@@ -7,6 +7,7 @@ import android.os.IBinder
 import android.os.ServiceManager
 import java.io.File
 import java.util.concurrent.ConcurrentHashMap
+import org.matrix.TEESimulator.attestation.DeviceAttestationService
 import org.matrix.TEESimulator.logging.SystemLogger
 import org.matrix.TEESimulator.pki.KeyBoxManager
 
@@ -102,7 +103,7 @@ object ConfigurationManager {
             when (packageModes[pkg]) {
                 Mode.GENERATE -> return Mode.GENERATE
                 Mode.PATCH -> return Mode.PATCH
-                Mode.AUTO -> return Mode.AUTO
+                Mode.AUTO -> return if (DeviceAttestationService.isTeeFunctional) Mode.PATCH else Mode.GENERATE
                 null -> continue
             }
         }
@@ -165,7 +166,7 @@ object ConfigurationManager {
                         newKeyboxes[pkg] = currentKeybox
                     }
                     else -> {
-                        newModes[trimmedLine] = Mode.GENERATE
+                        newModes[trimmedLine] = Mode.AUTO
                         newKeyboxes[trimmedLine] = currentKeybox
                     }
                 }

module/changelog.md

@@ -13,6 +13,11 @@ Repository consolidation release. All tee-rebuild work merged as the new main br
 - Oversized transactions routed to software gen instead of crashing
 - Operation-time params (BLOCK_MODE, PADDING, DIGEST) passed through to CipherPrimitive
 
+### Banking App Compatibility
+- Bare `target.txt` entries now default to AUTO mode, resolved at config level to PATCH (working TEE) or GENERATE (broken TEE)
+- Fixes BHIM and similar banking apps that require TEE-backed attestation keys
+- Restores v5.0 behavior where AUTO was resolved before the interceptor dispatch, avoiding the non-deterministic `raceTeePatch` path
+
 ### Infrastructure
 - Version scheme changed to semver (v6.0.0)
 - Repository moved to TEESimulator-RS as canonical source

module/update.json

@@ -1,6 +1,6 @@
 {
   "version": "v6.0.0",
-	"versionCode": 155,
+  "versionCode": 160,
   "zipUrl": "https://github.com/Enginex0/TEESimulator-RS/releases/latest/download/TEESimulator-RS-Release.zip",
   "changelog": "https://raw.githubusercontent.com/Enginex0/TEESimulator-RS/main/module/changelog.md"
 }