The app becomes a product: EFB, MPL-2.0 relicense, weight and balance, and an end-to-end audit

.github/workflows/mockup-apk.yml → .github/workflows/android.yml

@@ -3,19 +3,19 @@
 # The APK is deliberately not committed to the repository: .gitignore excludes
 # *.apk on purpose, and a binary in git rots. This workflow is where the APK
 # comes from instead. Every run publishes it as a downloadable artifact, and
-# pushing a mockup-v* tag also attaches it to a GitHub release.
+# pushing a v* tag also attaches it to a GitHub release.
 #
-# SPDX-License-Identifier: GPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 
-name: Mockup APK
+name: Android
 
 on:
   push:
     branches: [main]
-    paths: ['app/mockup/**', '.github/workflows/mockup-apk.yml']
-    tags: ['mockup-v*']
+    paths: ['app/junco/**', '.github/workflows/mockup-apk.yml']
+    tags: ['v*']
   pull_request:
-    paths: ['app/mockup/**', '.github/workflows/mockup-apk.yml']
+    paths: ['app/junco/**', '.github/workflows/mockup-apk.yml']
   workflow_dispatch:
 
 permissions:
@@ -43,36 +43,48 @@ jobs:
             "platforms;android-34" "build-tools;35.0.0"
 
       - name: Build APK
-        run: ./app/mockup/android/build.sh
+        run: ./app/junco/android/build.sh
 
       - name: Check the APK is well formed
         run: |
-          APK=app/mockup/android/build/junco-pfd-mockup.apk
+          APK=app/junco/android/build/junco.apk
           BT="$ANDROID_HOME/build-tools/35.0.0"
           test -f "$APK"
           "$BT/apksigner" verify "$APK"
           # The whole point of the wrapper is that the web assets ship inside it.
-          for f in index.html manifest.webmanifest sw.js icon-192.png icon-512.png; do
+          for f in index.html profile.js net.js ops.js tiles.js airports.js manifest.webmanifest sw.js icon-192.png icon-512.png data/airports.json; do
             unzip -l "$APK" | grep -q "assets/$f" || { echo "missing assets/$f"; exit 1; }
           done
-          "$BT/aapt2" dump badging "$APK" | grep -q "package: name='org.junco.mockup'"
+          "$BT/aapt2" dump badging "$APK" | grep -q "package: name='com.keylinkit.junco'"
           echo "APK OK: $(du -h "$APK" | cut -f1)"
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
-          name: junco-pfd-mockup-apk
-          path: app/mockup/android/build/junco-pfd-mockup.apk
+          name: junco-apk
+          path: app/junco/android/build/junco.apk
           if-no-files-found: error
 
+      - name: Build release bundle
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          JUNCO_VERSION_NAME: ${{ github.ref_name }}
+          JUNCO_VERSION_CODE: ${{ github.run_number }}
+        run: |
+          # Unsigned here on purpose. The upload key never goes in CI unless you
+          # deliberately add it as a secret; an unsigned bundle is still useful
+          # for checking the release path builds.
+          cd app/junco/android && gradle bundleRelease --no-daemon
+
       - name: Attach to release
-        if: startsWith(github.ref, 'refs/tags/mockup-v')
+        if: startsWith(github.ref, 'refs/tags/v')
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           gh release create "${GITHUB_REF_NAME}" \
-            app/mockup/android/build/junco-pfd-mockup.apk \
+            app/junco/android/build/junco.apk \
+            app/junco/android/build/outputs/bundle/release/*.aab \
             --title "PFD layout mockup ${GITHUB_REF_NAME}" \
-            --notes "Layout mockup only. Not an instrument, not airworthy, not the Junco client. Debug-signed for sideloading; enable install from unknown sources. See app/mockup/README.md." \
+            --notes "Layout mockup only. Not an instrument, not airworthy, not the Junco client. Debug-signed for sideloading; enable install from unknown sources. See app/junco/README.md." \
             || gh release upload "${GITHUB_REF_NAME}" \
-                 app/mockup/android/build/junco-pfd-mockup.apk --clobber
+                 app/junco/android/build/junco.apk --clobber

.gitignore

@@ -34,3 +34,7 @@ logs/
 # OS
 .DS_Store
 Thumbs.db
+
+# Android signing — never commit an upload key
+*.jks
+upload-keystore.properties

CONTRIBUTING.md

@@ -34,22 +34,32 @@ be declined regardless of its merits elsewhere.
 
 ## Licensing your contribution
 
-Code is GPL-2.0-or-later, hardware is CERN-OHL-S-2.0, documentation and
-specifications are CC-BY-4.0. By opening a pull request you agree your
+Code is MPL-2.0, hardware is CERN-OHL-S-2.0, documentation and specifications
+are CC-BY-4.0. By opening a pull request you agree your
 contribution ships under the license covering that artifact.
 
+Sign your commits off with `git commit -s`, which appends:
+
+    Signed-off-by: Your Name <you@example.com>
+
+That is the Developer Certificate of Origin, the same one the Linux kernel uses.
+It is not a copyright assignment and it does not ask you to give anything up. It
+is a statement that you wrote the contribution or otherwise have the right to
+submit it under this license, which is what makes the project safe to
+redistribute, including through an app store.
+
 Every source file starts with:
 
-    SPDX-License-Identifier: GPL-2.0-or-later
+    SPDX-License-Identifier: MPL-2.0
 
-The "or later" is not optional and not decorative. It is what lets code move
-between Junco and MakerPlane's FIX-Gateway and pyEFIS, which are GPL v2 or
-later, and it keeps GPLv3 reachable if ArduPilot code is ever wanted. A file
-contributed as GPL-2.0-only would break both.
+MPL is per-file copyleft. Changing a Junco file means publishing that file's
+changes; everything you combine it with stays yours. It is also GPL-compatible,
+so code still moves both ways with MakerPlane's FIX-Gateway and pyEFIS.
 
 Do not paste in code from a permissively licensed project without checking that
-the attribution requirements survive the relicensing, and do not paste in code
-from a GPLv3-only project at all.
+its attribution requirements survive. Do not paste in GPL code: MPL can be
+combined with GPL downstream, but pulling GPL code in would force the whole work
+to GPL and put Junco back where it could not ship on iOS.
 
 ## Specifications before implementations