F-Droid: reproducible release build, signed APK on every release, fastlane metadata; 1.2.0 #33

Merged

backmeupplz merged 1 commit from fdroid-reproducible into main

2026-10-16 15:54:08 +00:00

backmeupplz commented

2026-10-16 15:31:41 +00:00

(Migrated from github.com)

Gets ABS+ ready for F-Droid with a reproducible build. F-Droid builds each tag itself and publishes our signed APK only if its own unsigned build matches it.

Unsigned without the key: release builds no longer fall back to the debug key, so a build without keystore.properties (F-Droid's build server) is unsigned.
No dependency block: dependenciesInfo { includeInApk = false }. F-Droid rejects APKs that carry Google's encrypted dependency-info signing block. Play still gets it from the bundle.
Release workflow: play.yml now also runs assembleRelease and attaches the signed absplus-<version>.apk to the GitHub release (same name pattern as absplus-1.1.2.apk). F-Droid's Binaries: URL points at it.
Fastlane metadata: fastlane/metadata/android/en-US symlinks the texts, icon, feature graphic and screenshots from play/ (fdroidserver follows symlinks that stay inside the repo). Only title.txt and changelogs/5.txt are new files.
README: a short release recipe.
1.2.0 (versionCode 5): main has a lot of user-facing Android changes since 1.1.2 (offline progress replay, per-server isolation, skips across files, About), so this is a minor bump, not a patch.

Checked locally: clean clones of this commit build byte-identical unsigned APKs, a key-signed build has no dependency block in its signing block, and the JDK 17 vs 21 comparison is in the PR comments.

🤖 Generated with Claude Code

Gets ABS+ ready for F-Droid with a reproducible build. F-Droid builds each tag itself and publishes our signed APK only if its own unsigned build matches it. - **Unsigned without the key:** release builds no longer fall back to the debug key, so a build without `keystore.properties` (F-Droid's build server) is unsigned. - **No dependency block:** `dependenciesInfo { includeInApk = false }`. F-Droid rejects APKs that carry Google's encrypted dependency-info signing block. Play still gets it from the bundle. - **Release workflow:** `play.yml` now also runs `assembleRelease` and attaches the signed `absplus-<version>.apk` to the GitHub release (same name pattern as `absplus-1.1.2.apk`). F-Droid's `Binaries:` URL points at it. - **Fastlane metadata:** `fastlane/metadata/android/en-US` symlinks the texts, icon, feature graphic and screenshots from `play/` (fdroidserver follows symlinks that stay inside the repo). Only `title.txt` and `changelogs/5.txt` are new files. - **README:** a short release recipe. - **1.2.0 (versionCode 5):** main has a lot of user-facing Android changes since 1.1.2 (offline progress replay, per-server isolation, skips across files, About), so this is a minor bump, not a patch. Checked locally: clean clones of this commit build byte-identical unsigned APKs, a key-signed build has no dependency block in its signing block, and the JDK 17 vs 21 comparison is in the PR comments. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

backmeupplz commented

2026-10-16 15:37:25 +00:00

(Migrated from github.com)

Reproducibility check on d6815a9 (macOS, AGP 9.4.1, Gradle 9.8.0):

Same output from every clean clone: three fresh clones built assembleRelease with no key, using Homebrew OpenJDK 21, 21 again and 17. All three gave the same unsigned app-release-unsigned.apk, sha256 0cfbe7a4e891cf727bbd9d8446fa4e446dd2c1c4e365f1c8b111c02ff8e9611f, so the JDK version doesn't change the bytes. F-Droid's buildserver is Debian trixie with default-jdk-headless (JDK 21), and play.yml uses Temurin 21.
No dependency block: a key-signed build (throwaway key) has only the v2 signature (0x7109871a) and verity padding (0x42726577) in its signing block. 1.1.2's APK also carried 0x504b4453.
F-Droid's check passes: apksigcopier compare of the key-signed build against the other clones' unsigned APKs passes for both the JDK 21 and the JDK 17 builds.
fdroiddata metadata: passes fdroid rewritemeta and fdroid lint with trixie's fdroidserver 2.4.2 and ruamel.yaml 0.18.10. That's the version fdroiddata CI installs, and it leaves Mesh+'s accepted metadata unchanged.

Reproducibility check on d6815a9 (macOS, AGP 9.4.1, Gradle 9.8.0): - **Same output from every clean clone:** three fresh clones built `assembleRelease` with no key, using Homebrew OpenJDK 21, 21 again and 17. All three gave the same unsigned `app-release-unsigned.apk`, sha256 `0cfbe7a4e891cf727bbd9d8446fa4e446dd2c1c4e365f1c8b111c02ff8e9611f`, so the JDK version doesn't change the bytes. F-Droid's buildserver is Debian trixie with `default-jdk-headless` (JDK 21), and `play.yml` uses Temurin 21. - **No dependency block:** a key-signed build (throwaway key) has only the v2 signature (0x7109871a) and verity padding (0x42726577) in its signing block. 1.1.2's APK also carried 0x504b4453. - **F-Droid's check passes:** `apksigcopier compare` of the key-signed build against the other clones' unsigned APKs passes for both the JDK 21 and the JDK 17 builds. - **fdroiddata metadata:** passes `fdroid rewritemeta` and `fdroid lint` with trixie's fdroidserver 2.4.2 and ruamel.yaml 0.18.10. That's the version fdroiddata CI installs, and it leaves Mesh+'s accepted metadata unchanged.