F-Droid prep: dependency-info blob, reproducibility, metadata - #1
Merged
Conversation
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds distributionSha256Sum for gradle-8.13-bin.zip so the wrapper verifies the downloaded distribution, hardening build reproducibility for F-Droid. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
versionCode 1 was already used by the v2.0 and v2.0.1 GitHub tags; bump to 2 for the first F-Droid build. versionName matches the v2.0.2 tag. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Point the F-Droid build metadata at the v2.0.2 tag (to be cut on the merge commit), which is the first commit to include the dependency-info-blob fix and Gradle SHA pin. The previous 'commit: v2.0' referenced a tag that predated the F-Droid metadata entirely. Adds the matching versionCode 2 changelog. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares the repo for an F-Droid inclusion request. IzzyOnDroid's APK scan flagged only the dependency-info blob; this branch clears that and tightens reproducibility + metadata.
Changes
a42249cbuild: disable dependency info blob — addsdependenciesInfo { includeInApk = false; includeInBundle = false }. Clears IzzyOnDroid's only finding. Verified withassembleDebug.2e27498build: pin Gradle distribution SHA-256 — addsdistributionSha256Sumforgradle-8.13-bin.zipso the wrapper verifies the download (reproducibility hardening).bc327bfbuild: bump version to 2.0.2 (versionCode 2) —versionCode 1was already used by thev2.0/v2.0.1GitHub tags; bumped for the first F-Droid build.cb4a1d8docs(fdroid): target v2.0.2 / versionCode 2 — the metadata previously pointed atcommit: v2.0, a tag that predated the F-Droid metadata entirely and lacked the fix. Now targetsv2.0.2+ adds the matching changelog.Audit results (this branch)
clean assembleRelease×3 (incl.--no-build-cache --rerun-tasks) produced byte-for-byte identical unsigned APKs. No build-time timestamp/path injection; release stays unsigned without a keystore.The F-Droid metadata points at tag
v2.0.2, which does not exist yet. After merging, cut it on the merge commit:Then the
fdroiddataMR can be opened against this commit.🤖 Generated with Claude Code