chore(fdroid): finalize recipe at v2.7.3 + reproducible-release CI guard #23

makiolaj · 2026-06-21T12:28:19Z

makiolaj commented

2026-06-21 12:28:19 +00:00

Follow-up to #21. Now that v2.7.3 is released (first build with vcsInfo { include = false }) and verified reproducible, this finalizes the official-F-Droid prep.

Verification (v2.7.3, 2026-06-21)

Built tag v2.7.3 from source and compared to the published calendula_v2.7.3.apk:

1382 zip entries, identical file lists, every entry byte-identical.
version-control-info.textproto gone from both.
Only the v2 signature block differs — exactly what F-Droid copies on.

Changes

Recipe → v2.7.3 (Builds, CurrentVersion, CurrentVersionCode); was the 2.7.2 placeholder, which lacks the fix and would fail verification.
UpdateCheckMode: Tags ^v[0-9.]+$ — after the one-time fdroiddata submission, F-Droid auto-tracks new release tags and adds build entries itself, so no manual recipe edits per release.
Reproducible-release CI guard — scripts/check_reproducible_release.sh + an always-on CI step asserting the release build keeps VCS-info disabled, so reproducibility can't silently regress and quietly stop official-repo publishing (tested positive + negative).

Auto-update, end to end

Once the fdroiddata MR lands, each future release flows automatically: our pipeline publishes calendula_vX.Y.Z.apk to the Binaries URL → F-Droid sees the new tag → builds from source → verifies it reproduces → republishes our signed binary. This PR's guard protects the one invariant that chain depends on.

Safe to merge — no version bump, so it doesn't cut a release.

🤖 Generated with Claude Code

Follow-up to #21. Now that **v2.7.3** is released (first build with `vcsInfo { include = false }`) and **verified reproducible**, this finalizes the official-F-Droid prep. ## Verification (v2.7.3, 2026-06-21) Built tag `v2.7.3` from source and compared to the published `calendula_v2.7.3.apk`: - **1382 zip entries, identical file lists, every entry byte-identical.** - `version-control-info.textproto` gone from both. - Only the v2 signature block differs — exactly what F-Droid copies on. ## Changes - **Recipe → v2.7.3** (`Builds`, `CurrentVersion`, `CurrentVersionCode`); was the 2.7.2 placeholder, which lacks the fix and would fail verification. - **`UpdateCheckMode: Tags ^v[0-9.]+$`** — after the one-time fdroiddata submission, F-Droid auto-tracks new release tags and adds build entries itself, so **no manual recipe edits per release**. - **Reproducible-release CI guard** — `scripts/check_reproducible_release.sh` + an always-on CI step asserting the release build keeps VCS-info disabled, so reproducibility can't silently regress and quietly stop official-repo publishing (tested positive + negative). ## Auto-update, end to end Once the fdroiddata MR lands, each future release flows automatically: our pipeline publishes `calendula_vX.Y.Z.apk` to the `Binaries` URL → F-Droid sees the new tag → builds from source → verifies it reproduces → republishes our signed binary. This PR's guard protects the one invariant that chain depends on. Safe to merge — no version bump, so it doesn't cut a release. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

makiolaj added 1 commit 2026-06-21 12:28:20 +00:00

chore(fdroid): finalize recipe at v2.7.3 + reproducible-release CI guard

CI / ci (pull_request) Successful in 8m50s

Details

36e2199dff

v2.7.3 is the first release built with `vcsInfo { include = false }` and is
verified reproducible: a clean from-source build matched the published
calendula_v2.7.3.apk byte-for-byte across all 1382 zip entries (only the
signature block differs, which F-Droid copies).

- Point the fdroiddata recipe's Builds entry + CurrentVersion at v2.7.3
  (was the 2.7.2 placeholder, which lacks the fix and would fail verification).
- UpdateCheckMode: Tags ^v[0-9.]+$ — after this one-time submission F-Droid
  auto-tracks new release tags and adds build entries itself; no manual recipe
  edits per release.
- Add scripts/check_reproducible_release.sh + an always-on CI step asserting the
  release build keeps VCS-info disabled, so reproducibility can't silently
  regress and quietly stop official-repo publishing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

makiolaj merged commit f27811d215 into main

2026-06-21 12:59:57 +00:00

makiolaj referenced this issue from a commit

2026-06-21 12:59:58 +00:00

Merge pull request 'chore(fdroid): finalize recipe at v2.7.3 + reproducible-release CI guard' (#23) from chore/fdroid-recipe-2730 into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: makiolaj/calendula#23