From 12b1722a4d7a34e99f7833e8f609a616163dd4d1 Mon Sep 17 00:00:00 2001 From: Felipe Benedet Date: Tue, 28 Jul 2026 16:17:52 -0500 Subject: [PATCH 1/2] fdroid: add Binaries + rotate AllowedAPKSigningKeys for reproducible build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address linsui's F-Droid review: add the `Binaries` URL pattern pointing at our own signed release APK so F-Droid can byte-compare its from-source build against it (the reproducible-build reference), paired with the existing `AllowedAPKSigningKeys`. Rotate `AllowedAPKSigningKeys` to the new signing cert (353db8b0…a1dd) after regenerating the release keystore with a strong passphrase and backing it up. Document the Binaries<->release.yml coupling in CLAUDE.md. Note: the fdroiddata copy of the recipe still needs the same change, and v2.0.3 must be re-released so its published APK is signed with the new key. Co-Authored-By: Claude Opus 4.8 (1M context) --- CLAUDE.md | 1 + fdroid/dev.debene.gopher.yml | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 9419d2b..525312f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -45,6 +45,7 @@ The F-Droid build recipe lives at `fdroid/dev.debene.gopher.yml` (copied into `f - **`Builds[].commit` must be a full 40-char commit SHA**, not a `v*` tag or branch (reviewer requirement). - **`AutoName` must stay in the recipe** — `fdroid checkupdates` regenerates it from the manifest and that CI job fails on any resulting diff. (Only `Summary`/`Description` move to Fastlane; `AutoName` does not.) - **`AllowedAPKSigningKeys`** is the signing cert's SHA-256 (`apksigner verify --print-certs `, colons stripped, lowercased) — it opts into Reproducible Builds so F-Droid verifies its build against our key instead of re-signing. One-way door; keep it. +- **`Binaries`** is the URL pattern of our own signed release APK (`https://github.com/felipedbene/deburrow/releases/download/v%v/DeBurrow-v%v.apk`, `%v` = versionName). It's the reproducible-build *reference*: F-Droid downloads this developer-signed APK and byte-compares it against its own from-source build; combined with `AllowedAPKSigningKeys` this is what makes the build "verified reproducible". The `release.yml` workflow publishes exactly this asset name/path on each `v*` tag — keep the two in sync. - Keep `versionName`/`versionCode` in sync with `defaultConfig` in `app/build.gradle.kts` and tag releases as `v` (e.g. `v2.0.3`). `UpdateCheckMode: Tags` + `AutoUpdateMode: Version` auto-detects new `v*` tags. - Validate locally before pushing: `fdroid rewritemeta ` (must produce no diff — canonical form), `fdroid lint `, and `check-jsonschema --schemafile /schemas/metadata.json `. Pin `ruamel.yaml<0.17.22` in the fdroidserver venv or `rewritemeta` reformats long values (e.g. wraps `AllowedAPKSigningKeys`) differently than CI. diff --git a/fdroid/dev.debene.gopher.yml b/fdroid/dev.debene.gopher.yml index ac209f4..57adab0 100644 --- a/fdroid/dev.debene.gopher.yml +++ b/fdroid/dev.debene.gopher.yml @@ -10,6 +10,7 @@ AutoName: DeBurrow RepoType: git Repo: https://github.com/felipedbene/deburrow.git +Binaries: https://github.com/felipedbene/deburrow/releases/download/v%v/DeBurrow-v%v.apk Builds: - versionName: 2.0.3 @@ -19,7 +20,7 @@ Builds: gradle: - yes -AllowedAPKSigningKeys: 10bfdeb0c04cc2cefff9e6c011205901d236bd1b8dd334fa908a21e89343262f +AllowedAPKSigningKeys: 353db8b0a3c94c001eb71114b8640befa35e38760ee6c3ca4f301c7aedc5a1dd AutoUpdateMode: Version UpdateCheckMode: Tags From a76519d17617e2d8d07d67870d63c405d6222190 Mon Sep 17 00:00:00 2001 From: Felipe Benedet Date: Tue, 28 Jul 2026 16:30:18 -0500 Subject: [PATCH 2/2] fdroid: sync local recipe Categories to Browser (matches submitted MR) The fdroiddata copy (MR !41663) uses `Browser`; align the in-repo reference copy so the two stay in sync per CLAUDE.md. Co-Authored-By: Claude Opus 4.8 (1M context) --- fdroid/dev.debene.gopher.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fdroid/dev.debene.gopher.yml b/fdroid/dev.debene.gopher.yml index 57adab0..0c6dc84 100644 --- a/fdroid/dev.debene.gopher.yml +++ b/fdroid/dev.debene.gopher.yml @@ -1,5 +1,5 @@ Categories: - - Internet + - Browser License: MIT AuthorName: Felipe Debene WebSite: https://debene.dev