Merge pull request 'build(fdroid): drop AGP dependency-metadata block; release v2.7.5' (#25) from release/v2.7.5 into main

Reviewed-on: #25

CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.7.5] — 2026-06-21
+
+### Changed
+- Further build cleanup for the official F-Droid repository: stopped embedding
+  AGP's dependency-metadata block in the APK, which F-Droid's reproducible-build
+  scanner rejects as an extra signing block. No functional or visible changes —
+  the same app as 2.7.4, just without that Play-oriented metadata blob.
+
+## [2.7.4] — 2026-06-21
+
+### Changed
+- Build cleanup that lets Calendula ship in the official F-Droid repository:
+  removed an unused Gradle toolchain-resolver plugin, which F-Droid's offline,
+  reproducible build process disallows. No functional or visible changes — this
+  is the same app as 2.7.3.
+
 ## [2.7.3] — 2026-06-21
 
 ### Fixed

app/build.gradle.kts

@@ -28,8 +28,8 @@ android {
         // which builds this version and then creates the matching vX.Y.Z tag +
         // release itself (versionCode is pinned to MAJOR*10000 + MINOR*100 +
         // PATCH from versionName, e.g. 2.7.2 -> 20702). See docs/RELEASING.md.
-        versionCode = 20703
+        versionCode = 20705
-        versionName = "2.7.3"
+        versionName = "2.7.5"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
@@ -92,6 +92,16 @@ android {
         compose = true
     }
 
+    // Don't embed AGP's dependency-metadata block in the APK signing block. It's
+    // a Play-oriented blob, and F-Droid's reproducible-build scanner rejects any
+    // "extra signing block" — so leaving it in blocks publishing to the official
+    // repo. It lives in the signing block, not the zip entries, so disabling it
+    // doesn't change the build output (reproducibility is unaffected).
+    dependenciesInfo {
+        includeInApk = false
+        includeInBundle = false
+    }
+
     packaging {
         resources {
             excludes += "/META-INF/{AL2.0,LGPL2.1}"

docs/fdroid-official/de.jeanlucmakiola.calendula.yml

@@ -15,7 +15,7 @@
 # ---------------------------------------------------------------------------
 
 Categories:
-  - Time
+  - Calendar & Agenda
 License: MIT
 AuthorName: Jean-Luc Makiola
 SourceCode: https://gitea.jeanlucmakiola.de/makiolaj/calendula
@@ -27,16 +27,20 @@ AutoName: Calendula
 RepoType: git
 Repo: https://gitea.jeanlucmakiola.de/makiolaj/calendula.git
 
-# First build entry = v2.7.3, the first release with `vcsInfo { include = false }`.
+# First build entry = v2.7.5, the first release that clears ALL three F-Droid
-# VERIFIED reproducible (2026-06-21): a clean from-source build of tag v2.7.3
+# blockers: (1) AGP VCS-info disabled (`vcsInfo { include = false }`, since
-# matched the published calendula_v2.7.3.apk byte-for-byte across all 1382 zip
+# v2.7.3); (2) the unused Gradle foojay toolchain-resolver plugin removed (since
-# entries (only the signature block differs, which F-Droid copies). v2.7.2 and
+# v2.7.4) — the offline build scanner rejects it as it can fetch a JDK; (3) AGP's
-# earlier embed META-INF/version-control-info.textproto and will NOT verify — do
+# dependency-metadata block no longer embedded (`dependenciesInfo { includeInApk
-# not target them. Subsequent versions are added automatically (AutoUpdateMode).
+# = false }`) — the binary scanner rejects it as an "extra signing block". All
+# three live outside the zip entries or are inert, so v2.7.5 is functionally
+# identical to v2.7.3 and reproduces byte-for-byte from source. v2.7.4 and
+# earlier trip one of these checks — do not target them. Subsequent versions are
+# added automatically (AutoUpdateMode).
 Builds:
-  - versionName: 2.7.3
+  - versionName: 2.7.5
-    versionCode: 20703
+    versionCode: 20705
-    commit: v2.7.3
+    commit: v2.7.5
     subdir: app
     gradle:
       - yes
@@ -49,13 +53,13 @@ Builds:
 AllowedAPKSigningKeys: 5cdaee8eb31cb0df9157c646ae3ec8b3dc43b5bb72624e088c9ddea0c4eb5ec1
 
 # Our own developer-signed APK for reproducible-build verification. %v -> the
-# versionName, so v2.7.3 resolves to calendula_v2.7.3.apk on the self-hosted repo.
+# versionName, so v2.7.5 resolves to calendula_v2.7.5.apk on the self-hosted repo.
 Binaries: https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo/calendula_v%v.apk
 
 # After this one-time submission F-Droid auto-tracks new vX.Y.Z tags and creates
 # build entries itself — no manual recipe edits per release. The tag regex keeps
 # it to release tags only.
-AutoUpdateMode: Version v%v
+AutoUpdateMode: Version
 UpdateCheckMode: Tags ^v[0-9.]+$
-CurrentVersion: 2.7.3
+CurrentVersion: 2.7.5
-CurrentVersionCode: 20703
+CurrentVersionCode: 20705

fastlane/metadata/android/en-US/changelogs/20704.txt

@@ -0,0 +1,6 @@
+### Changed
+- Build cleanup that lets Calendula ship in the official F-Droid repository:
+  removed an unused Gradle toolchain-resolver plugin, which F-Droid's offline,
+  reproducible build process disallows. No functional or visible changes — this
+  is the same app as 2.7.3.
+

fastlane/metadata/android/en-US/changelogs/20705.txt

@@ -0,0 +1,6 @@
+### Changed
+- Further build cleanup for the official F-Droid repository: stopped embedding
+  AGP's dependency-metadata block in the APK, which F-Droid's reproducible-build
+  scanner rejects as an extra signing block. No functional or visible changes —
+  the same app as 2.7.4, just without that Play-oriented metadata blob.
+

settings.gradle.kts

@@ -11,9 +11,6 @@ pluginManagement {
         gradlePluginPortal()
     }
 }
-plugins {
-    id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
-}
 
 dependencyResolutionManagement {
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)