Merge pull request 'build(fdroid): drop AGP dependency-metadata block; release v2.7.5' (#25) from release/v2.7.5 into main

Reviewed-on: #25

.gitea/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,23 @@
+---
+name: Bug report
+about: Something doesn't work the way it should
+title: ""
+labels:
+  - bug
+---
+
+### What happened
+
+
+### What you expected
+
+
+### Steps to reproduce
+1.
+2.
+3.
+
+### Environment
+- Calendula version: <!-- Settings → bottom of the screen -->
+- Android version:
+- Device:

.gitea/ISSUE_TEMPLATE/crash_report.md

@@ -0,0 +1,26 @@
+---
+name: Crash report
+about: Report a crash. Calendula can capture this for you (Settings → Report a problem, or the prompt after a crash) — it copies the report to your clipboard and prefills this form.
+title: "Crash: "
+labels:
+  - bug
+  - crash
+---
+
+<!--
+Thanks for reporting a crash in Calendula!
+
+If the app prefilled this for you, the crash report is already below — just add
+what you were doing and submit. Otherwise, paste the report from your clipboard
+into the code block. The report contains only app/Android/device versions and the
+stack trace — no personal data or calendar content.
+-->
+
+### What happened
+
+
+### Crash report
+
+```
+(paste the crash report here)
+```

.gitea/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea or improvement
+title: ""
+labels:
+  - enhancement
+---
+
+### What would you like Calendula to do?
+
+
+### Why — what problem does it solve?
+
+
+### Anything else
+<!-- mockups, examples from other apps, alternatives you considered -->

.gitea/workflows/ci.yaml

@@ -30,6 +30,12 @@ jobs:
           # Full history so the base..HEAD diff below has a merge-base.
           fetch-depth: 0
 
+      # Cheap, always-on guard: the release build must stay reproducible for the
+      # official F-Droid repo (no AGP VCS-info embedding). Runs regardless of
+      # change scope so a regression can't slip through on a "docs-only" PR.
+      - name: Reproducible-release invariant
+        run: bash scripts/check_reproducible_release.sh
+
       # Decide whether anything that affects the app build changed. Docs,
       # F-Droid metadata and the licence don't, so those PRs skip the SDK +
       # Gradle work below but still report a green `ci`.
@@ -38,10 +44,20 @@ jobs:
         run: |
           set -e
           BASE="${{ github.base_ref }}"
-          git fetch --no-tags --depth=1 origin "$BASE"
-          CHANGED=$(git diff --name-only "origin/$BASE...HEAD")
+          # Full (not --depth=1) base fetch so the merge-base is present even when
+          # the PR branch forked several commits back; a shallow tip has no merge
+          # base with a divergent branch and `git diff base...HEAD` aborts.
+          git fetch --no-tags origin "$BASE"
+          MB=$(git merge-base "origin/$BASE" HEAD 2>/dev/null || true)
+          if [ -z "$MB" ]; then
+            # No common ancestor available — don't risk skipping the build.
+            echo "No merge base with origin/$BASE — running the full build to be safe."
+            echo "code=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          CHANGED=$(git diff --name-only "$MB" HEAD)
           echo "Changed files:"; echo "$CHANGED"
-          if echo "$CHANGED" | grep -vE '(\.md$|^docs/|^fdroid-metadata/|^LICENSE$)' | grep -q .; then
+          if echo "$CHANGED" | grep -vE '(\.md$|^docs/|^fdroid-metadata/|^fastlane/|^LICENSE$)' | grep -q .; then
             echo "code=true" >> "$GITHUB_OUTPUT"
           else
             echo "code=false" >> "$GITHUB_OUTPUT"

.gitea/workflows/release.yaml

@@ -222,31 +222,27 @@ jobs:
           mkdir -p fdroid/repo
           cp app/build/outputs/apk/release/app-release.apk "fdroid/repo/calendula_v${VERSION}.apk"
 
-      - name: Copy metadata to F-Droid repo
+      # Per-version "What's New": ensure this version's changelog exists in the
+      # fastlane tree (committed at release-cut time for the official repo; this
+      # regenerates it from CHANGELOG.md so the self-hosted repo never depends on
+      # the commit having happened). The transform below then carries it across.
+      - name: Ensure this version's changelog is in the fastlane tree
+        if: env.IS_RELEASE == 'true'
+        run: bash scripts/sync_changelog_to_fastlane.sh
+
+      - name: Build F-Droid metadata from fastlane (single source of truth)
         run: |
           mkdir -p fdroid/metadata
-          cp -r fdroid-metadata/* fdroid/metadata/
-
-      # Per-version "What's New" for F-Droid clients: this version's CHANGELOG
-      # section written to changelogs/<versionCode>.txt (same extraction as the
-      # Gitea release notes). en-US only — F-Droid falls back to it for locales
-      # without their own changelog. fdroid update bakes this into the index.
-      - name: Generate F-Droid changelog for this version
-        if: env.IS_RELEASE == 'true'
-        run: |
-          set -e
-          awk -v ver="$VERSION" '
-            $0 ~ "^## \\[" ver "\\]" { flag = 1; next }
-            /^## \[/ { flag = 0 }
-            flag' CHANGELOG.md > /tmp/changelog.txt
-          sed -i -e '/./,$!d' /tmp/changelog.txt
-          if [ ! -s /tmp/changelog.txt ]; then
-            echo "See CHANGELOG.md for $VERSION." > /tmp/changelog.txt
-          fi
-          CL_DIR="fdroid/metadata/de.jeanlucmakiola.calendula/en-US/changelogs"
-          mkdir -p "$CL_DIR"
-          cp /tmp/changelog.txt "$CL_DIR/${VERSION_CODE}.txt"
-          echo "Wrote $CL_DIR/${VERSION_CODE}.txt"
+          # App-level control file (Categories/License/links) for the self-hosted
+          # repo's `fdroid update`.
+          cp fdroid-metadata/de.jeanlucmakiola.calendula.yml fdroid/metadata/
+          # Localized text + graphics + per-version changelogs come from the SAME
+          # fastlane tree the official F-Droid repo harvests from source,
+          # transformed into the F-Droid repo "localized" layout. One source of
+          # truth, both channels.
+          bash scripts/fastlane_to_fdroid_localized.sh \
+            fastlane/metadata/android \
+            fdroid/metadata/de.jeanlucmakiola.calendula
 
       - name: Generate F-Droid Index
         run: |

CHANGELOG.md

@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.7.5] — 2026-06-21
+
+### Changed
+- Further build cleanup for the official F-Droid repository: stopped embedding
+  AGP's dependency-metadata block in the APK, which F-Droid's reproducible-build
+  scanner rejects as an extra signing block. No functional or visible changes —
+  the same app as 2.7.4, just without that Play-oriented metadata blob.
+
+## [2.7.4] — 2026-06-21
+
+### Changed
+- Build cleanup that lets Calendula ship in the official F-Droid repository:
+  removed an unused Gradle toolchain-resolver plugin, which F-Droid's offline,
+  reproducible build process disallows. No functional or visible changes — this
+  is the same app as 2.7.3.
+
+## [2.7.3] — 2026-06-21
+
+### Fixed
+- Home-screen widgets no longer get stuck on a loading spinner in the published
+  (F-Droid) release build. They render via Android's background-work system, and
+  release optimisation (R8) was stripping a helper class it loads by name, so the
+  render job never ran. Added the missing keep rule — widgets now load normally.
+
+## [2.7.2] — 2026-06-21
+
+### Added
+- Crash reporting you control. If Calendula closes unexpectedly, it now captures
+  a technical report and, on the next launch, offers to send it as an issue on
+  the project's tracker. Nothing is uploaded automatically — the report stays on
+  your device until you choose to share it, it contains no personal data or
+  calendar content (only the app, Android and device versions plus the stack
+  trace), and you see the full text before sending. There's also a "Report a
+  problem" entry in Settings, and if the app ever fails to start repeatedly, a
+  minimal recovery screen still lets you send the report.
+
 ## [2.7.1] — 2026-06-21
 
 ### Fixed

README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/icon.png" width="112" alt="Calendula icon">
+<img src="fastlane/metadata/android/en-US/images/icon.png" width="112" alt="Calendula icon">
 
 <h1>Calendula</h1>
 
@@ -16,11 +16,11 @@ Reads, writes, and reminds — on top of the system calendar, with zero network
 </p>
 
 <p>
-<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/phoneScreenshots/01-week.png" width="19%" alt="Week view">&nbsp;
-<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/phoneScreenshots/02-month.png" width="19%" alt="Month view">&nbsp;
-<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/phoneScreenshots/04-detail.png" width="19%" alt="Event detail">&nbsp;
-<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/phoneScreenshots/05-edit.png" width="19%" alt="Event form">&nbsp;
-<img src="fdroid-metadata/de.jeanlucmakiola.calendula/en-US/phoneScreenshots/06-onboarding.png" width="19%" alt="Reminder onboarding">
+<img src="fastlane/metadata/android/en-US/images/phoneScreenshots/01-week.png" width="19%" alt="Week view">&nbsp;
+<img src="fastlane/metadata/android/en-US/images/phoneScreenshots/02-month.png" width="19%" alt="Month view">&nbsp;
+<img src="fastlane/metadata/android/en-US/images/phoneScreenshots/04-detail.png" width="19%" alt="Event detail">&nbsp;
+<img src="fastlane/metadata/android/en-US/images/phoneScreenshots/05-edit.png" width="19%" alt="Event form">&nbsp;
+<img src="fastlane/metadata/android/en-US/images/phoneScreenshots/06-onboarding.png" width="19%" alt="Reminder onboarding">
 </p>
 
 </div>

app/build.gradle.kts

@@ -27,9 +27,9 @@ android {
         // a bumped versionName into main triggers .gitea/workflows/release.yaml,
         // which builds this version and then creates the matching vX.Y.Z tag +
         // release itself (versionCode is pinned to MAJOR*10000 + MINOR*100 +
-        // PATCH from versionName, e.g. 2.7.1 -> 20701). See docs/RELEASING.md.
-        versionCode = 20701
-        versionName = "2.7.1"
+        // PATCH from versionName, e.g. 2.7.2 -> 20702). See docs/RELEASING.md.
+        versionCode = 20705
+        versionName = "2.7.5"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
@@ -47,6 +47,11 @@ android {
 
     buildTypes {
         release {
+            // Keep release builds reproducible for F-Droid: don't let AGP embed
+            // build-environment git metadata (META-INF/version-control-info.textproto),
+            // whose `revision`/path content varies by build machine and is the only
+            // thing that otherwise differs from a clean from-source rebuild.
+            vcsInfo { include = false }
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(
@@ -87,6 +92,16 @@ android {
         compose = true
     }
 
+    // Don't embed AGP's dependency-metadata block in the APK signing block. It's
+    // a Play-oriented blob, and F-Droid's reproducible-build scanner rejects any
+    // "extra signing block" — so leaving it in blocks publishing to the official
+    // repo. It lives in the signing block, not the zip entries, so disabling it
+    // doesn't change the build output (reproducibility is unaffected).
+    dependenciesInfo {
+        includeInApk = false
+        includeInBundle = false
+    }
+
     packaging {
         resources {
             excludes += "/META-INF/{AL2.0,LGPL2.1}"

app/proguard-rules.pro

@@ -15,3 +15,14 @@
 # Keep the generated Room database implementations fully intact.
 -keep class * extends androidx.room.RoomDatabase { *; }
 -dontwarn androidx.room.paging.**
+
+# WorkManager instantiates an InputMerger reflectively (Class.newInstance) from
+# the fully-qualified class name persisted in the WorkSpec, so the class must
+# keep both its name and a no-arg constructor. Glance renders every widget
+# through a WorkManager worker (androidx.glance.session.SessionWorker) whose
+# default merger is androidx.work.OverwritingInputMerger. Under R8 full mode
+# (AGP 9 default) that unused no-arg constructor was stripped, so WorkManager
+# threw "OverwritingInputMerger has no zero argument constructor", the
+# SessionWorker never ran, and widgets were stuck on their loading layout
+# (a blank spinner) in release builds. Keep every InputMerger's name + ctor.
+-keep class * extends androidx.work.InputMerger { <init>(...); }

app/src/main/AndroidManifest.xml

@@ -68,6 +68,15 @@
                 android:resource="@xml/shortcuts" />
         </activity>
 
+        <!-- Standalone surface for a captured crash report. MainActivity routes
+             here on a startup crash-loop, so it stays clear of the app's Hilt
+             graph and Compose content. Not exported: launched only by us. -->
+        <activity
+            android:name=".ui.crash.CrashReportActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:launchMode="singleTask" />
+
         <!-- The provider broadcasts EVENT_REMINDER at reminder time but posts
              no notification itself — a calendar app must (v1.4, Etar model).
              Exported: the broadcast arrives from the provider's process. -->

app/src/main/java/de/jeanlucmakiola/calendula/CalendulaApp.kt

@@ -2,10 +2,19 @@ package de.jeanlucmakiola.calendula
 
 import android.app.Application
 import dagger.hilt.android.HiltAndroidApp
+import de.jeanlucmakiola.calendula.data.crash.CrashReporter
 
 /**
  * Application entry point. Registered as android:name=".CalendulaApp"
  * in AndroidManifest.xml. Hilt initializes its component graph here.
  */
 @HiltAndroidApp
-class CalendulaApp : Application()
+class CalendulaApp : Application() {
+
+    override fun onCreate() {
+        super.onCreate()
+        // Install first thing so startup crashes are captured too (privacy-
+        // respecting, on-device; the user submits the report by hand).
+        CrashReporter.install(this)
+    }
+}

app/src/main/java/de/jeanlucmakiola/calendula/MainActivity.kt

@@ -18,9 +18,13 @@ import androidx.core.net.toUri
 import androidx.hilt.navigation.compose.hiltViewModel
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import dagger.hilt.android.AndroidEntryPoint
+import de.jeanlucmakiola.calendula.data.crash.CrashReporter
 import de.jeanlucmakiola.calendula.data.prefs.ThemeMode
 import de.jeanlucmakiola.calendula.ui.RootScreen
 import de.jeanlucmakiola.calendula.ui.WidgetNavRequest
+import de.jeanlucmakiola.calendula.ui.crash.CrashReportActivity
+import de.jeanlucmakiola.calendula.ui.crash.CrashReportDialog
+import de.jeanlucmakiola.calendula.ui.crash.submitCrashReport
 import de.jeanlucmakiola.calendula.ui.settings.SettingsViewModel
 import de.jeanlucmakiola.calendula.ui.theme.CalendulaTheme
 import kotlinx.datetime.LocalDate
@@ -41,12 +45,31 @@ class MainActivity : AppCompatActivity() {
     // by CalendarHost's import flow.
     private var requestedImportUri by mutableStateOf<Uri?>(null)
 
+    // A captured crash report awaiting the user's decision, surfaced as a dialog
+    // over the calendar on the next launch (the single-crash path). A startup
+    // crash-loop is handled out of band, before setContent — see below.
+    private var pendingCrashReport by mutableStateOf<String?>(null)
+
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
+
+        // If the app keeps crashing as it starts, the main UI can't be trusted
+        // to come up — route to the standalone report screen instead of
+        // re-entering the crashing graph.
+        if (CrashReporter.isCrashLoop(this)) {
+            startActivity(
+                Intent(this, CrashReportActivity::class.java)
+                    .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK),
+            )
+            finish()
+            return
+        }
+
         enableEdgeToEdge()
         requestedDetailKey = intent.detailKeyOrNull()
         requestedNav = intent.navRequestOrNull()
         requestedImportUri = intent.importUriOrNull()
+        if (CrashReporter.shouldPrompt(this)) pendingCrashReport = CrashReporter.pendingReport(this)
         setContent {
             // One activity-scoped SettingsViewModel drives both the theme here
             // and the Settings screen, so a theme change applies app-wide at once.
@@ -70,9 +93,31 @@ class MainActivity : AppCompatActivity() {
                     requestedImportUri = requestedImportUri,
                     onImportConsumed = { requestedImportUri = null },
                 )
+                pendingCrashReport?.let { report ->
+                    CrashReportDialog(
+                        report = report,
+                        onSend = {
+                            submitCrashReport(this@MainActivity, report)
+                            CrashReporter.clearReport(this@MainActivity)
+                            pendingCrashReport = null
+                        },
+                        onDismiss = {
+                            // Keep the report (Settings can still reach it); just
+                            // stop it popping on every launch.
+                            CrashReporter.dismissPrompt(this@MainActivity)
+                            pendingCrashReport = null
+                        },
+                    )
                 }
             }
         }
+    }
+
+    override fun onResume() {
+        super.onResume()
+        // Reaching a running UI means startup succeeded; reset the loop trail.
+        CrashReporter.markHealthy(this)
+    }
 
     override fun onNewIntent(intent: Intent) {
         super.onNewIntent(intent)

app/src/main/java/de/jeanlucmakiola/calendula/data/calendar/CalendarDataSource.kt

@@ -245,7 +245,8 @@ class AndroidCalendarDataSource @Inject constructor(
             putDescription(description)
         }
         val uri = resolver.insert(localCalendarsUri(), values)
-            ?: throw WriteFailedException("create local calendar '$name'")
+            // No calendar name in the message — it can reach a crash report.
+            ?: throw WriteFailedException("create local calendar")
         return ContentUris.parseId(uri)
     }
 
@@ -727,7 +728,8 @@ class AndroidCalendarDataSource @Inject constructor(
                     is String -> cv.put(column, value)
                     is Long -> cv.put(column, value)
                     is Int -> cv.put(column, value)
-                    else -> error("Unsupported value for $column: $value")
+                    // Only the type, never the value — a cell value can be event content.
+                    else -> error("Unsupported value type for column '$column': ${value::class.simpleName}")
                 }
             }
         }

app/src/main/java/de/jeanlucmakiola/calendula/data/crash/CrashReporter.kt

@@ -0,0 +1,188 @@
+package de.jeanlucmakiola.calendula.data.crash
+
+import android.content.Context
+import android.content.pm.PackageInfo
+import android.os.Build
+import androidx.core.content.pm.PackageInfoCompat
+import java.io.File
+import java.io.PrintWriter
+import java.io.StringWriter
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.util.Locale
+
+/**
+ * Privacy-respecting crash capture (prod-readiness item 10). On an uncaught
+ * exception it writes a self-contained report to the app's private storage and
+ * then chains to the platform's default handler, so the process still dies
+ * normally (and the OS shows its own "stopped" dialog). Nothing is uploaded —
+ * the app holds no `INTERNET` permission. The user submits the report later,
+ * by hand, as a Gitea issue (see the ui/crash surfaces).
+ *
+ * The report is built from a fixed [CrashContext] allowlist — app/Android/device
+ * version, locale, time, and the stack trace — and **nothing else**: no device
+ * identifiers, no account names, no calendar/event content, no logcat. The user
+ * is always shown the full text before it leaves the device.
+ */
+object CrashReporter {
+
+    /**
+     * Install the handler. Called first thing in `CalendulaApp.onCreate()` so it
+     * also catches crashes during startup. The handler swallows nothing — it
+     * persists, then delegates to the previously-registered handler.
+     */
+    fun install(context: Context) {
+        val appContext = context.applicationContext
+        val previous = Thread.getDefaultUncaughtExceptionHandler()
+        Thread.setDefaultUncaughtExceptionHandler { thread, throwable ->
+            // Capturing must never mask the original crash, so guard every step.
+            runCatching {
+                val now = System.currentTimeMillis()
+                writeReport(appContext, buildCrashReport(CrashContext.from(appContext), throwable, now))
+                recordCrashTime(appContext, now)
+            }
+            previous?.uncaughtException(thread, throwable)
+        }
+    }
+
+    /** The persisted report from the last crash, or null if there is none. */
+    fun pendingReport(context: Context): String? {
+        val file = reportFile(context)
+        return if (file.exists()) runCatching { file.readText() }.getOrNull()?.takeIf { it.isNotBlank() } else null
+    }
+
+    /**
+     * Whether to surface the report unprompted (on the next launch): a report
+     * exists and the user hasn't already waved this one away. Settings reaches
+     * the report via [pendingReport] regardless, so "Not now" only stops the
+     * auto-prompt — it doesn't discard the report.
+     */
+    fun shouldPrompt(context: Context): Boolean =
+        reportFile(context).exists() && !dismissedFile(context).exists()
+
+    /** Stop auto-prompting for the current report without discarding it. */
+    fun dismissPrompt(context: Context) {
+        runCatching { dismissedFile(context).apply { parentFile?.mkdirs() }.writeText("") }
+    }
+
+    /** Drop the persisted report once the user has reported it (or from Settings). */
+    fun clearReport(context: Context) {
+        runCatching { reportFile(context).delete() }
+        runCatching { dismissedFile(context).delete() }
+    }
+
+    /**
+     * Whether the app appears to be in a startup crash-loop: at least
+     * [LOOP_THRESHOLD] crashes inside [LOOP_WINDOW_MS]. In that case the main UI
+     * can't be trusted to start, so the caller routes straight to the standalone
+     * report screen instead of re-entering the crashing graph.
+     */
+    fun isCrashLoop(context: Context): Boolean {
+        val times = readCrashTimes(context)
+        if (times.size < LOOP_THRESHOLD) return false
+        val recent = times.sortedDescending()
+        return recent[0] - recent[LOOP_THRESHOLD - 1] <= LOOP_WINDOW_MS
+    }
+
+    /**
+     * Mark the app as having started successfully, resetting the loop counter so
+     * an ordinary single crash much later never trips loop detection. The
+     * pending report itself is kept — only the timing trail is cleared.
+     */
+    fun markHealthy(context: Context) {
+        runCatching { timesFile(context).delete() }
+    }
+
+    // --- persistence -------------------------------------------------------
+
+    private fun writeReport(context: Context, report: String) {
+        val file = reportFile(context).apply { parentFile?.mkdirs() }
+        file.writeText(report.take(MAX_REPORT_CHARS))
+        // A fresh crash should prompt again, even if the previous one was waved away.
+        runCatching { dismissedFile(context).delete() }
+    }
+
+    private fun recordCrashTime(context: Context, nowMillis: Long) {
+        val kept = (readCrashTimes(context) + nowMillis).takeLast(MAX_TIMES)
+        timesFile(context).apply { parentFile?.mkdirs() }
+            .writeText(kept.joinToString("\n"))
+    }
+
+    private fun readCrashTimes(context: Context): List<Long> {
+        val file = timesFile(context)
+        if (!file.exists()) return emptyList()
+        return runCatching { file.readLines().mapNotNull { it.trim().toLongOrNull() } }.getOrDefault(emptyList())
+    }
+
+    private fun crashDir(context: Context) = File(context.filesDir, CRASH_DIR)
+    private fun reportFile(context: Context) = File(crashDir(context), REPORT_FILE)
+    private fun timesFile(context: Context) = File(crashDir(context), TIMES_FILE)
+    private fun dismissedFile(context: Context) = File(crashDir(context), DISMISSED_FILE)
+
+    private const val CRASH_DIR = "crash"
+    private const val REPORT_FILE = "last_crash.txt"
+    private const val TIMES_FILE = "crash_times.txt"
+    private const val DISMISSED_FILE = "dismissed"
+    private const val MAX_TIMES = 5
+    private const val MAX_REPORT_CHARS = 64 * 1024
+    private const val LOOP_THRESHOLD = 2
+    private const val LOOP_WINDOW_MS = 10_000L
+}
+
+/**
+ * The allowlist of non-personal facts that go into a crash report. Built from
+ * [Build] and the app's own [PackageInfo]; deliberately holds no identifiers.
+ */
+data class CrashContext(
+    val appVersionName: String,
+    val appVersionCode: Long,
+    val sdkInt: Int,
+    val androidRelease: String,
+    val manufacturer: String,
+    val model: String,
+    val locale: String,
+) {
+    companion object {
+        fun from(context: Context): CrashContext {
+            val pkg = runCatching {
+                context.packageManager.getPackageInfo(context.packageName, 0)
+            }.getOrNull()
+            return CrashContext(
+                appVersionName = pkg?.versionName ?: "?",
+                appVersionCode = pkg?.let { PackageInfoCompat.getLongVersionCode(it) } ?: 0L,
+                sdkInt = Build.VERSION.SDK_INT,
+                androidRelease = Build.VERSION.RELEASE ?: "?",
+                manufacturer = Build.MANUFACTURER ?: "?",
+                model = Build.MODEL ?: "?",
+                locale = Locale.getDefault().toLanguageTag(),
+            )
+        }
+    }
+}
+
+/**
+ * Render a crash report from the [ctx] allowlist, the [throwable]'s full stack
+ * trace, and the crash [nowMillis]. Pure (no Android, no I/O) so it is unit
+ * tested. The leading marker doubles as the file's sanity check in
+ * [CrashReporter.pendingReport].
+ */
+fun buildCrashReport(ctx: CrashContext, throwable: Throwable, nowMillis: Long): String {
+    val trace = StringWriter().also { throwable.printStackTrace(PrintWriter(it)) }.toString().trim()
+    val time = runCatching {
+        Instant.ofEpochMilli(nowMillis).atZone(ZoneId.systemDefault()).format(TIME_FORMAT)
+    }.getOrDefault(nowMillis.toString())
+    return buildString {
+        appendLine("Calendula crash report")
+        appendLine("App version: ${ctx.appVersionName} (${ctx.appVersionCode})")
+        appendLine("Android: ${ctx.androidRelease} (API ${ctx.sdkInt})")
+        appendLine("Device: ${ctx.manufacturer} ${ctx.model}")
+        appendLine("Locale: ${ctx.locale}")
+        appendLine("Time: $time")
+        appendLine()
+        appendLine("Stack trace:")
+        append(trace)
+    }
+}
+
+private val TIME_FORMAT = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss")

app/src/main/java/de/jeanlucmakiola/calendula/data/ics/IcsExporter.kt

@@ -24,7 +24,8 @@ class IcsExporter @Inject constructor(
     fun writeDocument(uri: Uri, content: String) {
         context.contentResolver.openOutputStream(uri)?.use { out ->
             out.write(content.toByteArray(Charsets.UTF_8))
-        } ?: throw IOException("Could not open $uri for writing")
+            // Only the scheme — the full Uri can embed the user's chosen filename.
+        } ?: throw IOException("Could not open output stream for export (scheme=${uri.scheme})")
     }
 
     /**

app/src/main/java/de/jeanlucmakiola/calendula/ui/crash/CrashReportActivity.kt

@@ -0,0 +1,59 @@
+package de.jeanlucmakiola.calendula.ui.crash
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.activity.enableEdgeToEdge
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.ui.Modifier
+import de.jeanlucmakiola.calendula.data.crash.CrashReporter
+import de.jeanlucmakiola.calendula.ui.theme.CalendulaTheme
+
+/**
+ * A deliberately minimal, standalone surface for a captured crash report.
+ * `MainActivity` routes here when it detects a startup crash-loop (see
+ * [CrashReporter.isCrashLoop]): the main UI can't be trusted to start, so this
+ * screen stays clear of the app's Hilt graph, DataStore-backed theme and
+ * Compose content — it only reads the report file and shows the report dialog.
+ * Plain [CalendulaTheme] defaults (follow-system, dynamic colour) avoid touching
+ * anything that might be the cause of the crash.
+ */
+class CrashReportActivity : ComponentActivity() {
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val report = CrashReporter.pendingReport(this)
+        if (report == null) {
+            finish()
+            return
+        }
+        enableEdgeToEdge()
+        setContent {
+            CalendulaTheme {
+                // Opaque backdrop so the dialog doesn't float over a bare task.
+                Surface(Modifier.fillMaxSize(), color = MaterialTheme.colorScheme.surface) {}
+                CrashReportDialog(
+                    report = report,
+                    onSend = {
+                        submitCrashReport(this, report)
+                        CrashReporter.clearReport(this)
+                        finish()
+                    },
+                    onDismiss = {
+                        CrashReporter.clearReport(this)
+                        finish()
+                    },
+                )
+            }
+        }
+    }
+
+    override fun onResume() {
+        super.onResume()
+        // Reaching this screen breaks the loop; reset the timing trail so a
+        // later ordinary crash isn't mistaken for a loop.
+        CrashReporter.markHealthy(this)
+    }
+}

app/src/main/java/de/jeanlucmakiola/calendula/ui/crash/CrashReportDialog.kt

@@ -0,0 +1,75 @@
+package de.jeanlucmakiola.calendula.ui.crash
+
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.BugReport
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.unit.dp
+import de.jeanlucmakiola.calendula.R
+
+/**
+ * Asks the user to send a captured crash report as an issue. The full report is
+ * shown verbatim in a scrollable panel — the user sees exactly what will leave
+ * the device before choosing to share it (the privacy backstop). [onSend] hands
+ * off to [submitCrashReport]; [onDismiss] declines.
+ */
+@Composable
+fun CrashReportDialog(
+    report: String,
+    onSend: () -> Unit,
+    onDismiss: () -> Unit,
+) {
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        icon = { Icon(Icons.Default.BugReport, contentDescription = null) },
+        title = { Text(stringResource(R.string.crash_dialog_title)) },
+        text = {
+            Column {
+                Text(
+                    text = stringResource(R.string.crash_dialog_message),
+                    style = MaterialTheme.typography.bodyMedium,
+                )
+                Spacer(Modifier.height(12.dp))
+                Surface(
+                    color = MaterialTheme.colorScheme.surfaceContainerHighest,
+                    shape = RoundedCornerShape(12.dp),
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    Text(
+                        text = report,
+                        style = MaterialTheme.typography.bodySmall,
+                        fontFamily = FontFamily.Monospace,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        modifier = Modifier
+                            .heightIn(max = 220.dp)
+                            .verticalScroll(rememberScrollState())
+                            .padding(12.dp),
+                    )
+                }
+            }
+        },
+        confirmButton = {
+            TextButton(onClick = onSend) { Text(stringResource(R.string.crash_dialog_report)) }
+        },
+        dismissButton = {
+            TextButton(onClick = onDismiss) { Text(stringResource(R.string.crash_dialog_dismiss)) }
+        },
+    )
+}

app/src/main/java/de/jeanlucmakiola/calendula/ui/crash/CrashReportSubmit.kt

@@ -0,0 +1,61 @@
+package de.jeanlucmakiola.calendula.ui.crash
+
+import android.content.ClipData
+import android.content.ClipboardManager
+import android.content.Context
+import android.content.Intent
+import android.widget.Toast
+import androidx.core.net.toUri
+import de.jeanlucmakiola.calendula.R
+
+/**
+ * Hand the captured crash report off to the user's chosen channel: the report
+ * is copied to the clipboard (the reliable path for a full stack trace) and the
+ * project's Gitea "new issue" page is opened with the body prefilled. Nothing is
+ * sent automatically — the app has no network access; the user reviews and
+ * submits the issue themselves.
+ */
+fun submitCrashReport(context: Context, report: String) {
+    copyReportToClipboard(context, report)
+    val opened = runCatching {
+        context.startActivity(Intent(Intent.ACTION_VIEW, buildIssueUri(context, report)))
+    }.isSuccess
+    val message = if (opened) R.string.crash_report_copied else R.string.crash_report_open_failed
+    Toast.makeText(context, message, Toast.LENGTH_LONG).show()
+}
+
+/** Open the issue tracker's template chooser for a manual (non-crash) report. */
+fun openIssueTracker(context: Context) {
+    val uri = context.getString(R.string.report_issue_choose_url).toUri()
+    runCatching { context.startActivity(Intent(Intent.ACTION_VIEW, uri)) }
+}
+
+private fun copyReportToClipboard(context: Context, report: String) {
+    val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as? ClipboardManager ?: return
+    val label = context.getString(R.string.crash_report_clip_label)
+    clipboard.setPrimaryClip(ClipData.newPlainText(label, report))
+}
+
+/**
+ * The Gitea `issues/new` URL with `title` and `body` prefilled. A full report
+ * can blow past URL-length limits, so an over-long one is left out of the link
+ * (with a "paste from clipboard" placeholder) — the clipboard copy is the
+ * source of truth in that case.
+ */
+private fun buildIssueUri(context: Context, report: String) =
+    context.getString(R.string.report_issue_url).toUri().buildUpon()
+        .appendQueryParameter("title", context.getString(R.string.crash_report_issue_title))
+        .appendQueryParameter("body", buildIssueBody(context, report))
+        .build()
+
+private fun buildIssueBody(context: Context, report: String): String {
+    val block = if (report.length > MAX_URL_REPORT_CHARS) {
+        context.getString(R.string.crash_report_body_paste)
+    } else {
+        "```\n$report\n```"
+    }
+    return context.getString(R.string.crash_report_body_template, block)
+}
+
+/** Keep the prefilled body comfortably under common URL-length ceilings. */
+private const val MAX_URL_REPORT_CHARS = 6_000

app/src/main/java/de/jeanlucmakiola/calendula/ui/settings/SettingsScreen.kt

@@ -33,6 +33,7 @@ import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.BugReport
 import androidx.compose.material.icons.filled.CalendarMonth
 import androidx.compose.material.icons.filled.Check
 import androidx.compose.material.icons.filled.ExpandLess
@@ -73,10 +74,14 @@ import androidx.lifecycle.LifecycleEventObserver
 import androidx.lifecycle.compose.LocalLifecycleOwner
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import de.jeanlucmakiola.calendula.R
+import de.jeanlucmakiola.calendula.data.crash.CrashReporter
 import de.jeanlucmakiola.calendula.data.prefs.CalendarReminderOverride
 import de.jeanlucmakiola.calendula.data.prefs.ThemeMode
 import de.jeanlucmakiola.calendula.data.prefs.WeekStartPref
 import de.jeanlucmakiola.calendula.domain.EventFormField
+import de.jeanlucmakiola.calendula.ui.crash.CrashReportDialog
+import de.jeanlucmakiola.calendula.ui.crash.openIssueTracker
+import de.jeanlucmakiola.calendula.ui.crash.submitCrashReport
 import de.jeanlucmakiola.calendula.ui.common.CollapsingScaffold
 import de.jeanlucmakiola.calendula.ui.common.GroupedRow
 import de.jeanlucmakiola.calendula.ui.common.CalendarColorChip
@@ -196,12 +201,48 @@ private fun SettingsHub(
             leading = { CategoryIcon(Icons.Default.CalendarMonth, ChipAccent.Tertiary) },
             onClick = onManageCalendars,
         )
-        LanguageRow(position = Position.Bottom)
+        LanguageRow(position = Position.Middle)
+        ReportProblemRow(position = Position.Bottom)
 
         AppVersionText()
     }
 }
 
+/**
+ * Opens the project's issue tracker to report a problem. If a crash report was
+ * captured (and not yet sent), it surfaces that report first via the same
+ * dialog the next-launch prompt uses; otherwise it opens the issue template
+ * chooser. No data leaves the device until the user submits the issue.
+ */
+@Composable
+private fun ReportProblemRow(position: Position) {
+    val context = LocalContext.current
+    var report by remember { mutableStateOf<String?>(null) }
+
+    GroupedRow(
+        title = stringResource(R.string.settings_report_problem),
+        summary = stringResource(R.string.settings_report_problem_hint),
+        position = position,
+        leading = { CategoryIcon(Icons.Default.BugReport, ChipAccent.Neutral) },
+        onClick = {
+            val pending = CrashReporter.pendingReport(context)
+            if (pending != null) report = pending else openIssueTracker(context)
+        },
+    )
+
+    report?.let { pending ->
+        CrashReportDialog(
+            report = pending,
+            onSend = {
+                submitCrashReport(context, pending)
+                CrashReporter.clearReport(context)
+                report = null
+            },
+            onDismiss = { report = null },
+        )
+    }
+}
+
 @Composable
 private fun LanguageRow(position: Position) {
     val context = LocalContext.current

app/src/main/res/values-de/strings.xml

@@ -282,6 +282,8 @@
     <string name="settings_about_source">Quellcode</string>
     <string name="settings_about_version">Version %1$s</string>
     <string name="settings_about_logo_desc">Calendula-App-Symbol</string>
+    <string name="settings_report_problem">Problem melden</string>
+    <string name="settings_report_problem_hint">Absturzbericht senden oder Issue-Tracker öffnen</string>
 
     <!-- Calendar manager -->
     <string name="calendars_title">Kalender</string>
@@ -337,4 +339,16 @@
         <item quantity="one">%d bereits in diesem Kalender übersprungen.</item>
         <item quantity="other">%d bereits in diesem Kalender übersprungen.</item>
     </plurals>
+
+    <!-- Absturzberichte: vom Nutzer selbst als Gitea-Issue einreichbar -->
+    <string name="crash_dialog_title">Calendula ist abgestürzt</string>
+    <string name="crash_dialog_message">Calendula wurde beim letzten Mal unerwartet beendet. Du kannst bei der Behebung helfen, indem du diesen Bericht als Issue sendest. Er bleibt auf deinem Gerät, bis du ihn teilst, und enthält keine persönlichen Daten oder Kalenderinhalte — nur die technischen Angaben unten.</string>
+    <string name="crash_dialog_report">Melden</string>
+    <string name="crash_dialog_dismiss">Nicht jetzt</string>
+    <string name="crash_report_issue_title">Absturzbericht</string>
+    <string name="crash_report_clip_label">Calendula-Absturzbericht</string>
+    <string name="crash_report_copied">Bericht in die Zwischenablage kopiert</string>
+    <string name="crash_report_open_failed">Der Issue-Tracker konnte nicht geöffnet werden. Der Bericht ist in deiner Zwischenablage.</string>
+    <string name="crash_report_body_template">Danke, dass du einen Absturz in Calendula meldest. Bitte ergänze, was du gerade getan hast, und sende dann ab.\n\n### Was ist passiert\n\n\n### Absturzbericht\n%1$s\n</string>
+    <string name="crash_report_body_paste">_(Der Bericht war zu lang für diesen Link — füge ihn aus deiner Zwischenablage hier ein.)_</string>
 </resources>

app/src/main/res/values/strings.xml

@@ -279,6 +279,8 @@
     <string name="settings_about_source">Source</string>
     <string name="settings_about_version">Version %1$s</string>
     <string name="settings_about_logo_desc">Calendula app icon</string>
+    <string name="settings_report_problem">Report a problem</string>
+    <string name="settings_report_problem_hint">Send a crash report or open the issue tracker</string>
 
     <!-- Calendar manager -->
     <string name="calendars_title">Calendars</string>
@@ -340,4 +342,19 @@
 
     <string name="about_source_url" translatable="false">https://gitea.jeanlucmakiola.de/makiolaj/calendula</string>
     <string name="about_license_url" translatable="false">https://gitea.jeanlucmakiola.de/makiolaj/calendula/src/branch/main/LICENSE</string>
+
+    <!-- Crash reporting: a captured report the user can submit, by hand, as a
+         Gitea issue (the app sends nothing automatically). -->
+    <string name="crash_dialog_title">Calendula crashed</string>
+    <string name="crash_dialog_message">Calendula closed unexpectedly last time. You can help fix it by sending this report as an issue. It stays on your device until you choose to share it, and includes no personal data or calendar content — only the technical details below.</string>
+    <string name="crash_dialog_report">Report</string>
+    <string name="crash_dialog_dismiss">Not now</string>
+    <string name="crash_report_issue_title">Crash report</string>
+    <string name="crash_report_clip_label">Calendula crash report</string>
+    <string name="crash_report_copied">Report copied to your clipboard</string>
+    <string name="crash_report_open_failed">Couldn\'t open the issue tracker. The report is on your clipboard.</string>
+    <string name="crash_report_body_template">Thanks for reporting a crash in Calendula. Please add anything you remember about what you were doing, then submit.\n\n### What happened\n\n\n### Crash report\n%1$s\n</string>
+    <string name="crash_report_body_paste">_(The report was too long for this link — paste it from your clipboard here.)_</string>
+    <string name="report_issue_url" translatable="false">https://gitea.jeanlucmakiola.de/makiolaj/calendula/issues/new</string>
+    <string name="report_issue_choose_url" translatable="false">https://gitea.jeanlucmakiola.de/makiolaj/calendula/issues/new/choose</string>
 </resources>

app/src/test/java/de/jeanlucmakiola/calendula/data/crash/CrashReportBuilderTest.kt

@@ -0,0 +1,56 @@
+package de.jeanlucmakiola.calendula.data.crash
+
+import com.google.common.truth.Truth.assertThat
+import org.junit.jupiter.api.Test
+
+class CrashReportBuilderTest {
+
+    private val context = CrashContext(
+        appVersionName = "2.7.0",
+        appVersionCode = 20700,
+        sdkInt = 34,
+        androidRelease = "14",
+        manufacturer = "Google",
+        model = "Pixel 7",
+        locale = "en-DE",
+    )
+
+    @Test
+    fun `report carries the allowlisted facts and the stack trace`() {
+        val report = buildCrashReport(context, IllegalStateException("boom"), nowMillis = 0L)
+
+        assertThat(report).startsWith("Calendula crash report")
+        assertThat(report).contains("App version: 2.7.0 (20700)")
+        assertThat(report).contains("Android: 14 (API 34)")
+        assertThat(report).contains("Device: Google Pixel 7")
+        assertThat(report).contains("Locale: en-DE")
+        // The exception type + message and a frame from this test are present.
+        assertThat(report).contains("IllegalStateException")
+        assertThat(report).contains("boom")
+        assertThat(report).contains("CrashReportBuilderTest")
+    }
+
+    @Test
+    fun `nested causes are included`() {
+        val cause = NullPointerException("inner")
+        val report = buildCrashReport(context, RuntimeException("outer", cause), nowMillis = 0L)
+
+        assertThat(report).contains("outer")
+        assertThat(report).contains("Caused by")
+        assertThat(report).contains("inner")
+    }
+
+    @Test
+    fun `report holds only the allowlisted lines before the stack trace`() {
+        val report = buildCrashReport(context, Exception("x"), nowMillis = 0L)
+        val header = report.substringBefore("Stack trace:").trim().lines()
+
+        // No identifiers, accounts, or extra fields ever creep into the header:
+        // it is exactly the six allowlisted lines plus the title.
+        assertThat(header).hasSize(6)
+        assertThat(header.first()).isEqualTo("Calendula crash report")
+        assertThat(header.map { it.substringBefore(":") }).containsExactly(
+            "Calendula crash report", "App version", "Android", "Device", "Locale", "Time",
+        ).inOrder()
+    }
+}

docs/README.md

@@ -12,7 +12,9 @@ Where to look for what:
 | [`../.planning/STATE.md`](../.planning/STATE.md) | Snapshot of where development currently stands |
 | [`superpowers/specs/`](superpowers/specs/) | The original design spec (2026-06-08) — historical record, not updated |
 | [`superpowers/plans/`](superpowers/plans/) | Per-milestone implementation plans with task checklists — historical record of how each slice was built, including provider lessons learned |
-| [`../fdroid-metadata/`](../fdroid-metadata/) | F-Droid/fastlane store metadata: descriptions, icon, screenshots (DE + EN) |
+| [`../fastlane/metadata/android/`](../fastlane/metadata/android/) | Store metadata (single source of truth): descriptions, title, icon, screenshots (DE + EN). Harvested directly by the official F-Droid repo; transformed into the self-hosted repo layout at release time by [`../scripts/fastlane_to_fdroid_localized.sh`](../scripts/fastlane_to_fdroid_localized.sh) |
+| [`../fdroid-metadata/`](../fdroid-metadata/) | App-level F-Droid control file (`*.yml`: Categories, License, links) for the self-hosted repo's `fdroid update` |
+| [`fdroid-official/`](fdroid-official/) | Draft recipe + notes for publishing to the **official** F-Droid repo (reproducible build + developer-signed binary) |
 
 Conventions: plans and specs under `superpowers/` are point-in-time
 artifacts of the agentic workflow that built each milestone — they get

docs/RELEASING.md

@@ -33,7 +33,15 @@ Published version codes so far: `v0.1.0`→100 … `v1.0.0`→10000 … `v2.0.0`
    the F-Droid per-version changelog.
 3. Bump the committed `versionName` (and `versionCode`) in
    `app/build.gradle.kts` to the new version. **This bump is what triggers the
-   release** when the branch merges to `main`.
+   release** when the branch merges to `main`. Then run
+   ```bash
+   scripts/sync_changelog_to_fastlane.sh
+   ```
+   and commit the generated
+   `fastlane/metadata/android/en-US/changelogs/<versionCode>.txt`. This is what
+   makes the **official** F-Droid repo show this version's changelog (it reads
+   the changelog from the tagged source tree). The self-hosted pipeline
+   regenerates it regardless, so forgetting only affects the official listing.
 4. **Verify the release build on a real device** — the mandatory gate. The
    shipped APK is R8-shrunk/obfuscated, and bugs that only appear there, or
    only on first run, never show up in the debug build or on a device that

docs/fdroid-official/README.md

@@ -0,0 +1,94 @@
+# Official F-Droid submission (draft)
+
+Goal: publish Calendula to the **official F-Droid repo** *alongside* the
+self-hosted repo, as **one app** — same signed binary in both channels, so
+existing self-hosted users migrate with no reinstall and no data loss.
+
+This folder holds the **draft** fdroiddata recipe. Nothing here is submitted
+yet. The self-hosted pipeline (`../../fdroid-metadata/`, `.gitea/workflows/release.yaml`)
+is unaffected by these files.
+
+## Publishing model: reproducible build + developer-signed binary
+
+F-Droid builds Calendula from source on its buildserver, then verifies the
+output is byte-for-byte identical to **our** signed APK (fetched via the
+`Binaries` URL). On a match it publishes **our** binary, signed with **our**
+key — identified by `AllowedAPKSigningKeys`. Result: official and self-hosted
+both carry the same signature. If a build ever fails to match, F-Droid simply
+skips that version (fails safe — no bad publish).
+
+## Verification status (2026-06-21)
+
+- ✅ **Run-to-run reproducible** — `v2.7.0` built twice from a clean worktree
+  (R8 minify + resource-shrink, build cache off) → byte-for-byte identical
+  (`sha256 568c944a…`).
+- ✅ **Cross-JDK reproducible** — rebuilt with JDK 17 and JDK 21 → identical
+  APK. JDK version is not a sensitivity, so it need not be pinned.
+- ✅ **Tag self-consistent** — committed `versionCode`/`versionName` already
+  equal the tag-derived values, so F-Droid building the tag as-is matches the
+  CI-published binary (CI's `sed` substitution is a no-op).
+- ✅ **App signing cert SHA-256 extracted** from published APKs (identical
+  across v1.0.0 / v2.0.0 / v2.4.0): `5cdaee8e…`. No keystore needed.
+- ✅ **Eligibility** — MIT, 100% FOSS deps (no Play Services / Firebase /
+  analytics / billing), no `INTERNET` permission, no native code.
+- ✅ **End-to-end reproducible vs the DISTRIBUTED binary** — built tag `v2.7.1`
+  from source and compared against the published `calendula_v2.7.1.apk`: every
+  app entry (dex / resources / assets / manifest) byte-identical. The only
+  difference was `META-INF/version-control-info.textproto` (AGP's git metadata,
+  env-dependent). Fixed with `vcsInfo { include = false }` on the release build;
+  re-validated → 0 non-signature differences. **Takes effect from the first
+  release built after that change — submit the recipe starting at that version**
+  (v2.7.1 and earlier still embed the textproto and won't verify).
+- ⚠️ **Not yet proven**: cross-host / fixed-build-path reproducibility on
+  F-Droid's buildserver (low risk for a no-NDK pure-JVM app; with vcsInfo
+  disabled, the env-dependent field is gone; F-Droid confirms at review).
+- ✅ **Buildserver toolchain supported** (checked 2026-06-21):
+  - **Gradle 9.5.1** is in F-Droid's gradle-transparency-log (`checksums.json`)
+    with a verified sha256, so `gradlew.py` will download + verify + run it.
+  - **AGP 9.2** is in `gradlew.py`'s `MIN_GRADLE_VERSION` map (`9.2 -> 9.4.1`).
+  - **JDK 17** is standard on the buildserver (AGP 9.2 requires exactly 17).
+  - **build-tools 36.0.0 / android-37**: not statically preinstalled (baseline
+    stops at 33), but `provision-android-sdk` makes `$ANDROID_HOME/build-tools`
+    and `/platforms` group-writable so AGP/Gradle install newer ones on demand.
+
+## Before submitting — checklist
+
+1. Confirm the `Binaries` URL is publicly reachable and stable long-term, e.g.
+   `https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo/calendula_v2.7.0.apk`
+   resolves to the dev-signed APK. F-Droid re-fetches it on every build.
+2. Confirm F-Droid's buildserver supports the toolchain (see timing risk).
+3. (Recommended) Reproduce one published release end-to-end: build the tag from
+   source, strip signatures, and diff against the downloaded `calendula_v<ver>.apk`
+   to confirm the from-source build matches the *distributed* binary — not just
+   another local build.
+
+## Submission steps (fdroiddata, GitLab)
+
+1. Fork `https://gitlab.com/fdroid/fdroiddata`.
+2. Copy `de.jeanlucmakiola.calendula.yml` to `metadata/` in the fork.
+3. Test locally with `fdroid build -v de.jeanlucmakiola.calendula` and
+   `fdroid lint de.jeanlucmakiola.calendula` (and `fdroid readmeta`).
+4. Open a Merge Request. Initial review can take weeks to months; the
+   self-hosted repo keeps serving in the meantime, so there's no rush.
+
+## Listing metadata (descriptions, screenshots, icon)
+
+These are **not** in the recipe `.yml`. F-Droid's `fdroid update` harvests them
+automatically from the fastlane tree in the app's source repo:
+
+    fastlane/metadata/android/<locale>/
+      short_description.txt   full_description.txt   title.txt
+      images/icon.png         images/phoneScreenshots/*.png
+      changelogs/<versionCode>.txt   (optional, per release)
+
+This is the single source of truth: en-US + de-DE already exist there, and the
+self-hosted repo is generated from the same tree at release time via
+`scripts/fastlane_to_fdroid_localized.sh`. Nothing extra to add to fdroiddata —
+F-Droid picks the listing up from source. (Screenshots may not be committed to
+the fdroiddata repo anyway, so the source-tree fastlane layout is required.)
+
+Per-version changelogs: the self-hosted release workflow generates
+`changelogs/<versionCode>.txt` at release time. For the official repo to show a
+changelog, that file must be committed into `fastlane/metadata/android/<locale>/changelogs/`
+at the tagged commit — wire this into the release/version-bump step, or accept
+no in-client changelog for the official listing initially.

docs/fdroid-official/de.jeanlucmakiola.calendula.yml

@@ -0,0 +1,65 @@
+# ---------------------------------------------------------------------------
+# DRAFT fdroiddata metadata for the OFFICIAL F-Droid repository.
+#
+# This is NOT the self-hosted metadata (that lives in ../../fdroid-metadata/).
+# When submitting, this file's contents go to fdroiddata on GitLab as
+#   metadata/de.jeanlucmakiola.calendula.yml
+# See README.md in this folder for the verification status and submission steps.
+#
+# Publishing model: REPRODUCIBLE BUILD + developer-signed binary.
+# F-Droid builds from source on its buildserver, then verifies the result is
+# identical to our own signed APK (fetched via `Binaries`). If it matches,
+# F-Droid publishes OUR binary signed with OUR key (`AllowedAPKSigningKeys`),
+# so the official and self-hosted channels carry the SAME signature and users
+# migrate between them with no reinstall / no data loss.
+# ---------------------------------------------------------------------------
+
+Categories:
+  - Calendar & Agenda
+License: MIT
+AuthorName: Jean-Luc Makiola
+SourceCode: https://gitea.jeanlucmakiola.de/makiolaj/calendula
+IssueTracker: https://gitea.jeanlucmakiola.de/makiolaj/calendula/issues
+Changelog: https://gitea.jeanlucmakiola.de/makiolaj/calendula/src/branch/main/CHANGELOG.md
+
+AutoName: Calendula
+
+RepoType: git
+Repo: https://gitea.jeanlucmakiola.de/makiolaj/calendula.git
+
+# First build entry = v2.7.5, the first release that clears ALL three F-Droid
+# blockers: (1) AGP VCS-info disabled (`vcsInfo { include = false }`, since
+# v2.7.3); (2) the unused Gradle foojay toolchain-resolver plugin removed (since
+# v2.7.4) — the offline build scanner rejects it as it can fetch a JDK; (3) AGP's
+# dependency-metadata block no longer embedded (`dependenciesInfo { includeInApk
+# = false }`) — the binary scanner rejects it as an "extra signing block". All
+# three live outside the zip entries or are inert, so v2.7.5 is functionally
+# identical to v2.7.3 and reproduces byte-for-byte from source. v2.7.4 and
+# earlier trip one of these checks — do not target them. Subsequent versions are
+# added automatically (AutoUpdateMode).
+Builds:
+  - versionName: 2.7.5
+    versionCode: 20705
+    commit: v2.7.5
+    subdir: app
+    gradle:
+      - yes
+    # No NDK / no flavors. The release buildType applies a signingConfig only
+    # when key.properties exists; on the buildserver it does not, so this
+    # produces the unsigned APK F-Droid compares against our binary.
+
+# SHA-256 of our app signing certificate (public; embedded in every published
+# APK). Locks F-Droid to publish only binaries signed with our key.
+AllowedAPKSigningKeys: 5cdaee8eb31cb0df9157c646ae3ec8b3dc43b5bb72624e088c9ddea0c4eb5ec1
+
+# Our own developer-signed APK for reproducible-build verification. %v -> the
+# versionName, so v2.7.5 resolves to calendula_v2.7.5.apk on the self-hosted repo.
+Binaries: https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo/calendula_v%v.apk
+
+# After this one-time submission F-Droid auto-tracks new vX.Y.Z tags and creates
+# build entries itself — no manual recipe edits per release. The tag regex keeps
+# it to release tags only.
+AutoUpdateMode: Version
+UpdateCheckMode: Tags ^v[0-9.]+$
+CurrentVersion: 2.7.5
+CurrentVersionCode: 20705

fastlane/metadata/android/de-DE/title.txt

@@ -0,0 +1 @@
+Calendula

fastlane/metadata/android/en-US/changelogs/20701.txt

@@ -0,0 +1,8 @@
+### Fixed
+- Fixed the app crashing immediately on launch whenever calendar access hadn't
+  been granted yet (a fresh install, or after revoking the permission). The app
+  set up its live calendar-change listener before the permission screen could
+  appear, which newer Android versions reject outright — so the app died before
+  you could grant access. The listener now waits for the permission and attaches
+  itself the moment it's granted.
+

fastlane/metadata/android/en-US/changelogs/20703.txt

@@ -0,0 +1,6 @@
+### Fixed
+- Home-screen widgets no longer get stuck on a loading spinner in the published
+  (F-Droid) release build. They render via Android's background-work system, and
+  release optimisation (R8) was stripping a helper class it loads by name, so the
+  render job never ran. Added the missing keep rule — widgets now load normally.
+

fastlane/metadata/android/en-US/changelogs/20704.txt

@@ -0,0 +1,6 @@
+### Changed
+- Build cleanup that lets Calendula ship in the official F-Droid repository:
+  removed an unused Gradle toolchain-resolver plugin, which F-Droid's offline,
+  reproducible build process disallows. No functional or visible changes — this
+  is the same app as 2.7.3.
+

fastlane/metadata/android/en-US/changelogs/20705.txt

@@ -0,0 +1,6 @@
+### Changed
+- Further build cleanup for the official F-Droid repository: stopped embedding
+  AGP's dependency-metadata block in the APK, which F-Droid's reproducible-build
+  scanner rejects as an extra signing block. No functional or visible changes —
+  the same app as 2.7.4, just without that Play-oriented metadata blob.
+

fastlane/metadata/android/en-US/title.txt

@@ -0,0 +1 @@
+Calendula

scripts/check_reproducible_release.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Reproducibility guard for the official F-Droid repo.
+#
+# F-Droid only republishes OUR signed binary if a from-source build reproduces
+# it byte-for-byte. AGP's VCS-info injection writes
+# META-INF/version-control-info.textproto with build-environment git metadata
+# (commit hash / path) — env-dependent, and the one thing that broke
+# reproducibility before we disabled it. It MUST stay off on the release build,
+# or new versions silently stop publishing to the official repo (fails safe, but
+# you'd be stuck on an old version without noticing). Fail loudly if it regresses.
+set -euo pipefail
+F="app/build.gradle.kts"
+
+# Match `vcsInfo { ... include = false ... }` within the block, tolerant of
+# whitespace/newlines (-z: whole file as one record; [^}] stays inside the block).
+if grep -Pzoq 'vcsInfo\s*\{[^}]*include\s*=\s*false' "$F"; then
+  echo "OK: release build disables AGP VCS-info — stays reproducible for F-Droid."
+else
+  echo "ERROR: '$F' release build is missing 'vcsInfo { include = false }'." >&2
+  echo "AGP would embed env-dependent git metadata (version-control-info.textproto)," >&2
+  echo "breaking F-Droid reproducible builds. Restore it. See docs/fdroid-official/." >&2
+  exit 1
+fi

scripts/fastlane_to_fdroid_localized.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Single source of truth: fastlane/metadata/android/<locale>/ feeds BOTH the
+# official F-Droid repo (harvested from source automatically) and the
+# self-hosted repo. This script transforms the fastlane layout into the F-Droid
+# "localized" layout that the self-hosted `fdroid update` consumes, so we don't
+# maintain two copies.
+#
+#   usage: fastlane_to_fdroid_localized.sh <fastlane_android_dir> <out_localized_dir>
+#   e.g.   scripts/fastlane_to_fdroid_localized.sh \
+#              fastlane/metadata/android \
+#              fdroid/metadata/de.jeanlucmakiola.calendula
+#
+# Mapping (fastlane -> F-Droid repo localized):
+#   short_description.txt        -> summary.txt
+#   full_description.txt         -> description.txt
+#   title.txt                    -> name.txt
+#   images/icon.png              -> icon.png
+#   images/phoneScreenshots/*    -> phoneScreenshots/*
+#   changelogs/<versionCode>.txt -> changelogs/<versionCode>.txt
+# (changelogs are seeded into the fastlane tree by
+#  scripts/sync_changelog_to_fastlane.sh.)
+set -euo pipefail
+
+SRC="${1:?need fastlane android dir, e.g. fastlane/metadata/android}"
+OUT="${2:?need output localized dir, e.g. fdroid/metadata/<appid>}"
+
+shopt -s nullglob
+for locdir in "$SRC"/*/; do
+  loc="$(basename "$locdir")"
+  dst="$OUT/$loc"
+  mkdir -p "$dst"
+  [ -f "$locdir/short_description.txt" ] && cp "$locdir/short_description.txt" "$dst/summary.txt"
+  [ -f "$locdir/full_description.txt"  ] && cp "$locdir/full_description.txt"  "$dst/description.txt"
+  [ -f "$locdir/title.txt"             ] && cp "$locdir/title.txt"             "$dst/name.txt"
+  [ -f "$locdir/images/icon.png"       ] && cp "$locdir/images/icon.png"       "$dst/icon.png"
+  if [ -d "$locdir/images/phoneScreenshots" ]; then
+    mkdir -p "$dst/phoneScreenshots"
+    cp "$locdir"images/phoneScreenshots/* "$dst/phoneScreenshots/"
+  fi
+  # Per-version changelogs live in the same fastlane tree (see
+  # scripts/sync_changelog_to_fastlane.sh) and map straight across.
+  if [ -d "$locdir/changelogs" ]; then
+    mkdir -p "$dst/changelogs"
+    cp "$locdir"changelogs/* "$dst/changelogs/"
+  fi
+done
+
+echo "Built F-Droid localized metadata in '$OUT' from '$SRC'"

scripts/sync_changelog_to_fastlane.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Write the current version's CHANGELOG.md section into the fastlane changelog
+# file that F-Droid harvests: fastlane/metadata/android/en-US/changelogs/<code>.txt
+# (en-US is F-Droid's fallback locale, so it covers every language).
+#
+# Run this when cutting a release (after editing CHANGELOG.md and bumping
+# versionName in app/build.gradle.kts) and COMMIT the result, so the OFFICIAL
+# F-Droid repo — which reads the changelog from the tagged source tree — shows
+# this version's "What's New". The self-hosted release pipeline also runs it so
+# its changelog never depends on the file having been committed. Idempotent.
+#
+# Extraction matches the awk used for the Gitea release notes so all three
+# (release notes, self-hosted changelog, official changelog) stay in sync.
+set -euo pipefail
+cd "$(dirname "$0")/.."   # repo root
+
+VERSION=$(grep -oP 'versionName\s*=\s*"\K[^"]+' app/build.gradle.kts)
+[ -n "$VERSION" ] || { echo "No versionName in app/build.gradle.kts" >&2; exit 1; }
+MAJOR=${VERSION%%.*}; rest=${VERSION#*.}; MINOR=${rest%%.*}; PATCH=${rest##*.}
+MAJOR=${MAJOR:-0}; MINOR=${MINOR:-0}; PATCH=${PATCH:-0}
+VERSION_CODE=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))
+
+CL_DIR="fastlane/metadata/android/en-US/changelogs"
+mkdir -p "$CL_DIR"
+OUT="$CL_DIR/${VERSION_CODE}.txt"
+
+awk -v ver="$VERSION" '
+  $0 ~ "^## \\[" ver "\\]" { flag = 1; next }
+  /^## \[/ { flag = 0 }
+  flag' CHANGELOG.md > "$OUT"
+# Trim leading blank lines (same as the pipeline did).
+sed -i -e '/./,$!d' "$OUT"
+if [ ! -s "$OUT" ]; then
+  echo "See CHANGELOG.md for $VERSION." > "$OUT"
+fi
+
+CHARS=$(wc -m < "$OUT" | tr -d ' ')
+echo "Wrote $OUT (version $VERSION, code $VERSION_CODE, ${CHARS} chars)"
+if [ "$CHARS" -gt 500 ]; then
+  echo "  note: >500 chars — F-Droid may truncate this changelog in-client." >&2
+fi

settings.gradle.kts

@@ -11,9 +11,6 @@ pluginManagement {
         gradlePluginPortal()
     }
 }
-plugins {
-    id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
-}
 
 dependencyResolutionManagement {
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)