Jean-Luc Makiola
36e2199dff
All checks were successful
CI / ci (pull_request) Successful in 8m50s
v2.7.3 is the first release built with `vcsInfo { include = false }` and is
verified reproducible: a clean from-source build matched the published
calendula_v2.7.3.apk byte-for-byte across all 1382 zip entries (only the
signature block differs, which F-Droid copies).
- Point the fdroiddata recipe's Builds entry + CurrentVersion at v2.7.3
(was the 2.7.2 placeholder, which lacks the fix and would fail verification).
- UpdateCheckMode: Tags ^v[0-9.]+$ — after this one-time submission F-Droid
auto-tracks new release tags and adds build entries itself; no manual recipe
edits per release.
- Add scripts/check_reproducible_release.sh + an always-on CI step asserting the
release build keeps VCS-info disabled, so reproducibility can't silently
regress and quietly stop official-repo publishing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
24 lines
1.2 KiB
Bash
Executable File
24 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Reproducibility guard for the official F-Droid repo.
|
|
#
|
|
# F-Droid only republishes OUR signed binary if a from-source build reproduces
|
|
# it byte-for-byte. AGP's VCS-info injection writes
|
|
# META-INF/version-control-info.textproto with build-environment git metadata
|
|
# (commit hash / path) — env-dependent, and the one thing that broke
|
|
# reproducibility before we disabled it. It MUST stay off on the release build,
|
|
# or new versions silently stop publishing to the official repo (fails safe, but
|
|
# you'd be stuck on an old version without noticing). Fail loudly if it regresses.
|
|
set -euo pipefail
|
|
F="app/build.gradle.kts"
|
|
|
|
# Match `vcsInfo { ... include = false ... }` within the block, tolerant of
|
|
# whitespace/newlines (-z: whole file as one record; [^}] stays inside the block).
|
|
if grep -Pzoq 'vcsInfo\s*\{[^}]*include\s*=\s*false' "$F"; then
|
|
echo "OK: release build disables AGP VCS-info — stays reproducible for F-Droid."
|
|
else
|
|
echo "ERROR: '$F' release build is missing 'vcsInfo { include = false }'." >&2
|
|
echo "AGP would embed env-dependent git metadata (version-control-info.textproto)," >&2
|
|
echo "breaking F-Droid reproducible builds. Restore it. See docs/fdroid-official/." >&2
|
|
exit 1
|
|
fi
|