makiolaj/calendula
1
0
Fork 1
Code Actions Releases 35 Activity
713 Commits 14 Branches 50 Tags
f70aa6a35836bf7e8948846ccfba037fb5151163
Commit Graph
5 Commits
Author SHA1 Message Date
Jean-Luc Makiola d5c53df6b5 Publish the release bundle to Google Play (#84) (#100)
Release — F-Droid repo + Gitea/Codeberg release + Play / detect (push) Successful in 6s
Details
Release — F-Droid repo + Gitea/Codeberg release + Play / release (push) Has been skipped
Details
Release — F-Droid repo + Gitea/Codeberg release + Play / play (push) Has been skipped
Details 
Reviewed-on: https://codeberg.org/jlmakiola/calendula/pulls/100
 2026-07-30 13:59:43 +02:00
Jean-Luc Makiola a3d136f55d Write a contributing guide, and fix what the forge move left stale (#96)
Release — F-Droid repo + Gitea/Codeberg release / detect (push) Successful in 27s
Details
Release — F-Droid repo + Gitea/Codeberg release / release (push) Has been skipped
Details 
(docs) Update all the docs to be up to date with current status quo
 2026-07-30 10:40:07 +02:00
makiolajandClaude Opus 4.8 bb7954d026 Remove superpowers planning docs; ignore CLAUDE.md
Release — F-Droid repo + Gitea release / detect (push) Successful in 6s
Details
Release — F-Droid repo + Gitea release / release (push) Successful in 7m3s
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-06 17:43:22 +02:00
makiolajandClaude Opus 4.8 e5be5f1ae5 security(release): rotate compromised F-Droid repo key; keep key out of served tree
CI / ci (push) Successful in 5m17s
Details 
The F-Droid repo signing key (keystore.p12) and its config.yml — including
the keystore passwords in cleartext — were publicly downloadable at
apps.dev.jeanlucmakiola.de/dev/fdroid/ because the release workflow uploaded
the entire fdroid/ working dir into the web-served path. The webserver has
since been locked down to repo/ only; this rotates the now-compromised key
and removes the root cause.

- release.yaml: restore the repo key + config from new CI secrets
  (FDROID_KEYSTORE_BASE64, FDROID_CONFIG_BASE64) instead of the box; upload
  ONLY repo/ so the key never re-enters the served tree.
- release.yaml: fail loudly when the repo key secrets are unset, replacing
  `fdroid update --create-key`, which silently minted a NEW repo key on a
  wiped server and would have broken every user's pinned fingerprint.
- README: publish the new repo fingerprint (C2C0…3425). Existing users must
  remove and re-add the repo.
- .gitignore: ignore *.p12 and the whole /fdroid/ working dir.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-14 12:01:00 +02:00
Jean-Luc MakiolaandClaude Opus 4.7 a8ba6e32e2 chore: add repo meta files (LICENSE, README, CHANGELOG, gitignore) 
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-06-08 14:54:40 +02:00