Compile SQLite from a vendored amalgamation instead of downloading it

[aquasolterra]

F-Droid requires native libraries to be built from source, and a maintainer confirmed on fdroiddata!47901 that this applies to the libsqlite3.so that package:sqlite3's build hook downloads from GitHub. Because our published APKs are verified against F-Droid's build, the release build has to compile SQLite too, so the source lives here.

What changes

• third_party/sqlite3/: the unmodified SQLite 3.53.4 amalgamation (sqlite3.c, sqlite3.h), checked against the SHA3-256 sqlite.org publishes. 3.53.4 is also what package:sqlite3 3.7.0 ships prebuilt, so SQLite itself does not change.
• pubspec.yaml: hooks.user_defines.sqlite3 with source: source, default compile options left on.
• tool/update_sqlite.sh: takes the current release off sqlite.org, refuses an archive that does not match the published hash, replaces the two files, and rewrites the provenance block in the README. Needed because bumping package:sqlite3 no longer moves the SQLite version, and Dependabot cannot see the vendored copy.
• CI: new step in the Android job, Check SQLite was compiled, not downloaded.
• .gitattributes marks third_party/** as vendored, so GitHub's language statistics are not dominated by 9 MB of C.
• AGENTS.md, SECURITY.md, docs/fdroid.md, CHANGELOG.

Measured

• Two cold release builds (flutter clean each time) produce byte-identical APKs for all three ABIs.
• The compiled library has no GNU build ID and no embedded paths, the two things that made libdartjni.so non-reproducible, so no extra linker flag is needed.
• Compiled with NDK r28c, the version the app pins and the F-Droid recipe uses.
• Cost: 10–22 KB per ABI; about one minute more on a cold release build (198 s vs. 139 s on main). The hook runner caches the result, so incremental builds pay nothing.
• main builds create three download-* directories under .dart_tool/hooks_runner; this branch creates none, which is what the CI step checks.
• flutter test (1606 tests), flutter analyze, dart format: all pass. The host library used by the tests is compiled from the vendored copy too.
• tool/update_sqlite.sh tested end to end against a copy whose version was wound back to 3.53.3: it restored both files and the README block byte for byte.

Not yet verified

The Linux and Windows builds now compile SQLite as well. Linux is covered by the tests above; Windows can only be checked by this PR's CI.

After merging

A new release (the reviewer asked for a new tag so the reference APKs match), then the F-Droid recipe is updated and all three ABIs are re-verified with fdroid build before pushing to the MR.

Supersedes #45, whose branch predates 57 commits on main and argued that F-Droid would probably not mind.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!