Phase 1 of the shared-kit plan: Calendula becomes the second core-time consumer.
floret-kit is embedded as a git submodule and wired with includeBuild, so the
app depends on de.jeanlucmakiola.floret:core-time and Gradle substitutes the
local source module (built from source).
- Remove the app's TimeBridge (Instant <-> epoch millis) + its test; the helpers
now live in core-time. Repoint the 7 call sites to de.jeanlucmakiola.floret.time.
- Calendula's richer time formatting (TimeFormat, 24h CompositionLocal) stays
app-local by design.
Reproducible-build handling (Calendula publishes via official F-Droid repro):
- Pin the submodule to a foojay-free kit commit (the resolver would let a build
fetch a JDK -> non-reproducible; the kit never used a toolchain block).
- Harden scripts/check_reproducible_release.sh to scan the included build's
Gradle scripts for the toolchain-resolver invariant.
- Draft fdroiddata recipe: submodules: true (else F-Droid checks out an empty
floret-kit/ and the from-source build fails).
- CI build checkouts fetch submodules recursively.
Clean composite build + unit tests + lintDebug + repro guard all green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The reproducible-release CI guard only asserted `vcsInfo { include = false }`.
F-Droid review surfaced two more invariants that, if they regress, silently
stall official publishing (fails safe — stuck on an old version):
- no foojay toolchain resolver in any Gradle script (the offline source
scanner rejects org.gradle.toolchains.foojay-resolver — it can fetch a JDK
over the network), and
- `dependenciesInfo { includeInApk = false }` (else AGP embeds a "Dependency
metadata" block, id 0x504b4453, in the APK Signing Block, which the binary
scanner rejects as an extra signing block).
The script now checks all three, accumulates failures (reports every broken
invariant in one run, not just the first), and exits non-zero if any fails.
Verified positive + one negative per invariant + all-three-broken.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
v2.7.3 is the first release built with `vcsInfo { include = false }` and is
verified reproducible: a clean from-source build matched the published
calendula_v2.7.3.apk byte-for-byte across all 1382 zip entries (only the
signature block differs, which F-Droid copies).
- Point the fdroiddata recipe's Builds entry + CurrentVersion at v2.7.3
(was the 2.7.2 placeholder, which lacks the fix and would fail verification).
- UpdateCheckMode: Tags ^v[0-9.]+$ — after this one-time submission F-Droid
auto-tracks new release tags and adds build entries itself; no manual recipe
edits per release.
- Add scripts/check_reproducible_release.sh + an always-on CI step asserting the
release build keeps VCS-info disabled, so reproducibility can't silently
regress and quietly stop official-repo publishing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
