From 5c80f99179b8bf3362b7649cc4662435da5acc50 Mon Sep 17 00:00:00 2001 From: Jean-Luc Makiola Date: Sun, 21 Jun 2026 20:48:59 +0200 Subject: [PATCH] build(fdroid): drop AGP dependency-metadata block; release v2.7.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit F-Droid's binary scanner (the fdroiddata `check apk` job) rejects any "extra signing block". Our release APK carried AGP's dependency-metadata block (id 0x504b4453, ~8 KB) in the APK Signing Block. Disable it with `dependenciesInfo { includeInApk = false; includeInBundle = false }`. The block lives in the signing block, not the zip entries, so removing it changes no build output — v2.7.5 is functionally identical to 2.7.4 and still reproduces byte-for-byte. Verified locally: a releaseTest build now carries only the v2 signature + verity padding (no 0x504b4453 block). This was the last F-Droid blocker: v2.7.5 now clears vcsInfo (since 2.7.3), foojay (since 2.7.4) and the dependency-metadata block. Bumps versionName to 2.7.5 and retargets the official recipe draft at v2.7.5. Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 8 +++++ app/build.gradle.kts | 14 +++++++-- .../de.jeanlucmakiola.calendula.yml | 30 ++++++++++--------- .../android/en-US/changelogs/20705.txt | 6 ++++ 4 files changed, 42 insertions(+), 16 deletions(-) create mode 100644 fastlane/metadata/android/en-US/changelogs/20705.txt diff --git a/CHANGELOG.md b/CHANGELOG.md index 55a7b4a..fc7f709 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [2.7.5] — 2026-06-21 + +### Changed +- Further build cleanup for the official F-Droid repository: stopped embedding + AGP's dependency-metadata block in the APK, which F-Droid's reproducible-build + scanner rejects as an extra signing block. No functional or visible changes — + the same app as 2.7.4, just without that Play-oriented metadata blob. + ## [2.7.4] — 2026-06-21 ### Changed diff --git a/app/build.gradle.kts b/app/build.gradle.kts index 2835966..28b8251 100644 --- a/app/build.gradle.kts +++ b/app/build.gradle.kts @@ -28,8 +28,8 @@ android { // which builds this version and then creates the matching vX.Y.Z tag + // release itself (versionCode is pinned to MAJOR*10000 + MINOR*100 + // PATCH from versionName, e.g. 2.7.2 -> 20702). See docs/RELEASING.md. - versionCode = 20704 - versionName = "2.7.4" + versionCode = 20705 + versionName = "2.7.5" testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner" } @@ -92,6 +92,16 @@ android { compose = true } + // Don't embed AGP's dependency-metadata block in the APK signing block. It's + // a Play-oriented blob, and F-Droid's reproducible-build scanner rejects any + // "extra signing block" — so leaving it in blocks publishing to the official + // repo. It lives in the signing block, not the zip entries, so disabling it + // doesn't change the build output (reproducibility is unaffected). + dependenciesInfo { + includeInApk = false + includeInBundle = false + } + packaging { resources { excludes += "/META-INF/{AL2.0,LGPL2.1}" diff --git a/docs/fdroid-official/de.jeanlucmakiola.calendula.yml b/docs/fdroid-official/de.jeanlucmakiola.calendula.yml index 8a17f1b..5588023 100644 --- a/docs/fdroid-official/de.jeanlucmakiola.calendula.yml +++ b/docs/fdroid-official/de.jeanlucmakiola.calendula.yml @@ -27,18 +27,20 @@ AutoName: Calendula RepoType: git Repo: https://gitea.jeanlucmakiola.de/makiolaj/calendula.git -# First build entry = v2.7.4, the first release that BOTH disables AGP VCS-info -# (`vcsInfo { include = false }`, since v2.7.3) AND drops the unused Gradle -# foojay toolchain-resolver plugin, which F-Droid's offline build scanner rejects -# (it can fetch a JDK over the network). The plugin was inert here (no toolchain -# block invoked it), so v2.7.4 is functionally identical to v2.7.3 and reproduces -# byte-for-byte from source. v2.7.3 and earlier either embed -# META-INF/version-control-info.textproto or trip the foojay scanner — do not -# target them. Subsequent versions are added automatically (AutoUpdateMode). +# First build entry = v2.7.5, the first release that clears ALL three F-Droid +# blockers: (1) AGP VCS-info disabled (`vcsInfo { include = false }`, since +# v2.7.3); (2) the unused Gradle foojay toolchain-resolver plugin removed (since +# v2.7.4) — the offline build scanner rejects it as it can fetch a JDK; (3) AGP's +# dependency-metadata block no longer embedded (`dependenciesInfo { includeInApk +# = false }`) — the binary scanner rejects it as an "extra signing block". All +# three live outside the zip entries or are inert, so v2.7.5 is functionally +# identical to v2.7.3 and reproduces byte-for-byte from source. v2.7.4 and +# earlier trip one of these checks — do not target them. Subsequent versions are +# added automatically (AutoUpdateMode). Builds: - - versionName: 2.7.4 - versionCode: 20704 - commit: v2.7.4 + - versionName: 2.7.5 + versionCode: 20705 + commit: v2.7.5 subdir: app gradle: - yes @@ -51,7 +53,7 @@ Builds: AllowedAPKSigningKeys: 5cdaee8eb31cb0df9157c646ae3ec8b3dc43b5bb72624e088c9ddea0c4eb5ec1 # Our own developer-signed APK for reproducible-build verification. %v -> the -# versionName, so v2.7.4 resolves to calendula_v2.7.4.apk on the self-hosted repo. +# versionName, so v2.7.5 resolves to calendula_v2.7.5.apk on the self-hosted repo. Binaries: https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo/calendula_v%v.apk # After this one-time submission F-Droid auto-tracks new vX.Y.Z tags and creates @@ -59,5 +61,5 @@ Binaries: https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo/calendula_v%v.apk # it to release tags only. AutoUpdateMode: Version UpdateCheckMode: Tags ^v[0-9.]+$ -CurrentVersion: 2.7.4 -CurrentVersionCode: 20704 +CurrentVersion: 2.7.5 +CurrentVersionCode: 20705 diff --git a/fastlane/metadata/android/en-US/changelogs/20705.txt b/fastlane/metadata/android/en-US/changelogs/20705.txt new file mode 100644 index 0000000..ef8da4a --- /dev/null +++ b/fastlane/metadata/android/en-US/changelogs/20705.txt @@ -0,0 +1,6 @@ +### Changed +- Further build cleanup for the official F-Droid repository: stopped embedding + AGP's dependency-metadata block in the APK, which F-Droid's reproducible-build + scanner rejects as an extra signing block. No functional or visible changes — + the same app as 2.7.4, just without that Play-oriented metadata blob. +