makiolaj/calendula
1
0
Fork 1
Code Issues Pull Requests 6 Actions Releases 23 Activity

build(fdroid): drop AGP dependency-metadata block; release v2.7.5
All checks were successful
CI / ci (pull_request) Successful in 5m57s
Details

Browse Source 
F-Droid's binary scanner (the fdroiddata `check apk` job) rejects any
"extra signing block". Our release APK carried AGP's dependency-metadata
block (id 0x504b4453, ~8 KB) in the APK Signing Block. Disable it with
`dependenciesInfo { includeInApk = false; includeInBundle = false }`.

The block lives in the signing block, not the zip entries, so removing it
changes no build output — v2.7.5 is functionally identical to 2.7.4 and
still reproduces byte-for-byte. Verified locally: a releaseTest build now
carries only the v2 signature + verity padding (no 0x504b4453 block).

This was the last F-Droid blocker: v2.7.5 now clears vcsInfo (since 2.7.3),
foojay (since 2.7.4) and the dependency-metadata block. Bumps versionName
to 2.7.5 and retargets the official recipe draft at v2.7.5.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jean-Luc Makiola
2026-06-21 20:48:59 +02:00
parent 0875e69c2d
commit 5c80f99179
4 changed files with 42 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
docs/fdroid-official/de.jeanlucmakiola.calendula.yml
View File

@@ -27,18 +27,20 @@ AutoName: Calendula
RepoType: git
Repo: https://gitea.jeanlucmakiola.de/makiolaj/calendula.git
# First build entry = v2.7.4, the first release that BOTH disables AGP VCS-info
# (`vcsInfo { include = false }`, since v2.7.3) AND drops the unused Gradle
# foojay toolchain-resolver plugin, which F-Droid's offline build scanner rejects
# (it can fetch a JDK over the network). The plugin was inert here (no toolchain
# block invoked it), so v2.7.4 is functionally identical to v2.7.3 and reproduces
# byte-for-byte from source. v2.7.3 and earlier either embed
# META-INF/version-control-info.textproto or trip the foojay scanner — do not
# target them. Subsequent versions are added automatically (AutoUpdateMode).
# First build entry = v2.7.5, the first release that clears ALL three F-Droid
# blockers: (1) AGP VCS-info disabled (`vcsInfo { include = false }`, since
# v2.7.3); (2) the unused Gradle foojay toolchain-resolver plugin removed (since
# v2.7.4) — the offline build scanner rejects it as it can fetch a JDK; (3) AGP's
# dependency-metadata block no longer embedded (`dependenciesInfo { includeInApk
# = false }`) — the binary scanner rejects it as an "extra signing block". All
# three live outside the zip entries or are inert, so v2.7.5 is functionally
# identical to v2.7.3 and reproduces byte-for-byte from source. v2.7.4 and
# earlier trip one of these checks — do not target them. Subsequent versions are
# added automatically (AutoUpdateMode).
Builds:
- versionName: 2.7.4
versionCode: 20704
commit: v2.7.4
- versionName: 2.7.5
versionCode: 20705
commit: v2.7.5
subdir: app
gradle:
- yes
@@ -51,7 +53,7 @@ Builds:
AllowedAPKSigningKeys: 5cdaee8eb31cb0df9157c646ae3ec8b3dc43b5bb72624e088c9ddea0c4eb5ec1
# Our own developer-signed APK for reproducible-build verification. %v -> the
# versionName, so v2.7.4 resolves to calendula_v2.7.4.apk on the self-hosted repo.
# versionName, so v2.7.5 resolves to calendula_v2.7.5.apk on the self-hosted repo.
Binaries: https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo/calendula_v%v.apk
# After this one-time submission F-Droid auto-tracks new vX.Y.Z tags and creates
@@ -59,5 +61,5 @@ Binaries: https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo/calendula_v%v.apk
# it to release tags only.
AutoUpdateMode: Version
UpdateCheckMode: Tags ^v[0-9.]+$
CurrentVersion: 2.7.4
CurrentVersionCode: 20704
CurrentVersion: 2.7.5
CurrentVersionCode: 20705