ci(fdroid): guard all three reproducible-build invariants #26

makiolaj · 2026-06-22T09:28:13Z

makiolaj commented

2026-06-22 09:28:13 +00:00

Harden the reproducible-release CI guard

scripts/check_reproducible_release.sh (the always-on Reproducible-release invariant CI step) only asserted one of the three invariants F-Droid's review surfaced. If either of the other two regresses, official publishing silently stalls on the last good version (fails safe, so you wouldn't notice). Now it enforces all three:

#	Invariant	Why F-Droid needs it
1	`vcsInfo { include = false }`	else AGP embeds `version-control-info.textproto` → not reproducible
2	no `foojay` toolchain resolver (any Gradle script)	offline source scanner rejects it (can fetch a JDK over the network)
3	`dependenciesInfo { includeInApk = false }`	else AGP embeds a `Dependency metadata` block (`0x504b4453`) → binary scanner rejects the extra signing block

The script accumulates failures (reports every broken invariant in one run) and exits non-zero if any fail.

Tested: positive (current main passes), one negative per invariant, and all-three-broken (reports all three). No ci.yaml change — it already invokes this script. Non-release change (no version bump), so merging won't cut a release.

🤖 Generated with Claude Code

## Harden the reproducible-release CI guard `scripts/check_reproducible_release.sh` (the always-on `Reproducible-release invariant` CI step) only asserted **one** of the three invariants F-Droid's review surfaced. If either of the other two regresses, official publishing silently stalls on the last good version (fails safe, so you wouldn't notice). Now it enforces all three: | # | Invariant | Why F-Droid needs it | |---|---|---| | 1 | `vcsInfo { include = false }` | else AGP embeds `version-control-info.textproto` → not reproducible | | 2 | no `foojay` toolchain resolver (any Gradle script) | offline source scanner rejects it (can fetch a JDK over the network) | | 3 | `dependenciesInfo { includeInApk = false }` | else AGP embeds a `Dependency metadata` block (`0x504b4453`) → binary scanner rejects the extra signing block | The script accumulates failures (reports **every** broken invariant in one run) and exits non-zero if any fail. **Tested:** positive (current `main` passes), one negative per invariant, and all-three-broken (reports all three). No `ci.yaml` change — it already invokes this script. Non-release change (no version bump), so merging won't cut a release. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

makiolaj added 1 commit 2026-06-22 09:28:13 +00:00

ci(fdroid): guard all three reproducible-build invariants

CI / ci (pull_request) Successful in 2m19s

Details

b6bee55fc6

The reproducible-release CI guard only asserted `vcsInfo { include = false }`.
F-Droid review surfaced two more invariants that, if they regress, silently
stall official publishing (fails safe — stuck on an old version):

- no foojay toolchain resolver in any Gradle script (the offline source
  scanner rejects org.gradle.toolchains.foojay-resolver — it can fetch a JDK
  over the network), and
- `dependenciesInfo { includeInApk = false }` (else AGP embeds a "Dependency
  metadata" block, id 0x504b4453, in the APK Signing Block, which the binary
  scanner rejects as an extra signing block).

The script now checks all three, accumulates failures (reports every broken
invariant in one run, not just the first), and exits non-zero if any fails.
Verified positive + one negative per invariant + all-three-broken.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

makiolaj merged commit 88d770bebe into main

2026-06-22 19:58:55 +00:00

makiolaj referenced this issue from a commit

2026-06-22 19:58:56 +00:00

Merge pull request 'ci(fdroid): guard all three reproducible-build invariants' (!26) from chore/harden-repro-guard into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: makiolaj/calendula#26