Merge pull request 'build(fdroid): drop unused foojay toolchain resolver; release v2.7.4' (#24) from release/v2.7.4 into main

Reviewed-on: #24

.gitea/workflows/ci.yaml

@@ -30,6 +30,12 @@ jobs:
           # Full history so the base..HEAD diff below has a merge-base.
           fetch-depth: 0
 
+      # Cheap, always-on guard: the release build must stay reproducible for the
+      # official F-Droid repo (no AGP VCS-info embedding). Runs regardless of
+      # change scope so a regression can't slip through on a "docs-only" PR.
+      - name: Reproducible-release invariant
+        run: bash scripts/check_reproducible_release.sh
+
       # Decide whether anything that affects the app build changed. Docs,
       # F-Droid metadata and the licence don't, so those PRs skip the SDK +
       # Gradle work below but still report a green `ci`.

CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.7.4] — 2026-06-21
+
+### Changed
+- Build cleanup that lets Calendula ship in the official F-Droid repository:
+  removed an unused Gradle toolchain-resolver plugin, which F-Droid's offline,
+  reproducible build process disallows. No functional or visible changes — this
+  is the same app as 2.7.3.
+
 ## [2.7.3] — 2026-06-21
 
 ### Fixed

app/build.gradle.kts

@@ -28,8 +28,8 @@ android {
         // which builds this version and then creates the matching vX.Y.Z tag +
         // release itself (versionCode is pinned to MAJOR*10000 + MINOR*100 +
         // PATCH from versionName, e.g. 2.7.2 -> 20702). See docs/RELEASING.md.
-        versionCode = 20703
-        versionName = "2.7.3"
+        versionCode = 20704
+        versionName = "2.7.4"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }

docs/fdroid-official/de.jeanlucmakiola.calendula.yml

@@ -15,7 +15,7 @@
 # ---------------------------------------------------------------------------
 
 Categories:
-  - Time
+  - Calendar & Agenda
 License: MIT
 AuthorName: Jean-Luc Makiola
 SourceCode: https://gitea.jeanlucmakiola.de/makiolaj/calendula
@@ -27,16 +27,18 @@ AutoName: Calendula
 RepoType: git
 Repo: https://gitea.jeanlucmakiola.de/makiolaj/calendula.git
 
-# IMPORTANT: the first build entry MUST target the first release that contains
-# `vcsInfo { include = false }` (added on branch chore/release-verification-process).
-# v2.7.1 and earlier embed META-INF/version-control-info.textproto, whose
-# env-dependent git metadata breaks reproducibility — they will NOT verify.
-# Update the versionName/versionCode/commit/Binaries below once that release is
-# tagged (e.g. v2.7.2 -> versionCode 20702). Values below are placeholders.
+# First build entry = v2.7.4, the first release that BOTH disables AGP VCS-info
+# (`vcsInfo { include = false }`, since v2.7.3) AND drops the unused Gradle
+# foojay toolchain-resolver plugin, which F-Droid's offline build scanner rejects
+# (it can fetch a JDK over the network). The plugin was inert here (no toolchain
+# block invoked it), so v2.7.4 is functionally identical to v2.7.3 and reproduces
+# byte-for-byte from source. v2.7.3 and earlier either embed
+# META-INF/version-control-info.textproto or trip the foojay scanner — do not
+# target them. Subsequent versions are added automatically (AutoUpdateMode).
 Builds:
-  - versionName: 2.7.2
-    versionCode: 20702
-    commit: v2.7.2
+  - versionName: 2.7.4
+    versionCode: 20704
+    commit: v2.7.4
     subdir: app
     gradle:
       - yes
@@ -49,10 +51,13 @@ Builds:
 AllowedAPKSigningKeys: 5cdaee8eb31cb0df9157c646ae3ec8b3dc43b5bb72624e088c9ddea0c4eb5ec1
 
 # Our own developer-signed APK for reproducible-build verification. %v -> the
-# versionName, so v2.7.2 resolves to calendula_v2.7.2.apk on the self-hosted repo.
+# versionName, so v2.7.4 resolves to calendula_v2.7.4.apk on the self-hosted repo.
 Binaries: https://apps.dev.jeanlucmakiola.de/dev/fdroid/repo/calendula_v%v.apk
 
-AutoUpdateMode: Version v%v
-UpdateCheckMode: Tags
-CurrentVersion: 2.7.2
-CurrentVersionCode: 20702
+# After this one-time submission F-Droid auto-tracks new vX.Y.Z tags and creates
+# build entries itself — no manual recipe edits per release. The tag regex keeps
+# it to release tags only.
+AutoUpdateMode: Version
+UpdateCheckMode: Tags ^v[0-9.]+$
+CurrentVersion: 2.7.4
+CurrentVersionCode: 20704

fastlane/metadata/android/en-US/changelogs/20704.txt

@@ -0,0 +1,6 @@
+### Changed
+- Build cleanup that lets Calendula ship in the official F-Droid repository:
+  removed an unused Gradle toolchain-resolver plugin, which F-Droid's offline,
+  reproducible build process disallows. No functional or visible changes — this
+  is the same app as 2.7.3.
+

scripts/check_reproducible_release.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Reproducibility guard for the official F-Droid repo.
+#
+# F-Droid only republishes OUR signed binary if a from-source build reproduces
+# it byte-for-byte. AGP's VCS-info injection writes
+# META-INF/version-control-info.textproto with build-environment git metadata
+# (commit hash / path) — env-dependent, and the one thing that broke
+# reproducibility before we disabled it. It MUST stay off on the release build,
+# or new versions silently stop publishing to the official repo (fails safe, but
+# you'd be stuck on an old version without noticing). Fail loudly if it regresses.
+set -euo pipefail
+F="app/build.gradle.kts"
+
+# Match `vcsInfo { ... include = false ... }` within the block, tolerant of
+# whitespace/newlines (-z: whole file as one record; [^}] stays inside the block).
+if grep -Pzoq 'vcsInfo\s*\{[^}]*include\s*=\s*false' "$F"; then
+  echo "OK: release build disables AGP VCS-info — stays reproducible for F-Droid."
+else
+  echo "ERROR: '$F' release build is missing 'vcsInfo { include = false }'." >&2
+  echo "AGP would embed env-dependent git metadata (version-control-info.textproto)," >&2
+  echo "breaking F-Droid reproducible builds. Restore it. See docs/fdroid-official/." >&2
+  exit 1
+fi

settings.gradle.kts

@@ -11,9 +11,6 @@ pluginManagement {
         gradlePluginPortal()
     }
 }
-plugins {
-    id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
-}
 
 dependencyResolutionManagement {
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)