coinosv3.git/fdroid, branch fdroid-v1.9

F-Droid recipe: pin the full commit hash, prebuild as a list.

2026-09-18T20:46:34Z

Reviewer asked for no tags in commit: and no chained commands. Co-Authored-By: Claude Opus 5 (1M context)

Android: no Google dependency-metadata block in the APK; 1.8 (code 9).

2026-09-17T21:41:37Z

F-Droid's APK check refuses the Play-only dependency-metadata signing block AGP adds by default. Off for every flavor. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z

F-Droid recipe: wrapping as their rewritemeta wants it.

2026-09-17T21:39:13Z

Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z

F-Droid recipe as fdroid rewritemeta formats it.

2026-09-17T21:35:15Z

Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z

F-Droid: fastlane metadata in-repo, text lockfile, version 1.7 (code 8).

2026-09-17T21:33:40Z

From the fdroiddata review and its pipeline: store text (summary, description, icon, changelogs) belongs in fastlane/ here rather than in the recipe; the category is "Wallet"; the scanner strips committed APKs by itself, so the two scandelete entries go; and bun.lockb is a binary the scanner flags — replaced by Bun's text lockfile (bun.lock, same pinned versions). A new tag is needed for the new tree, so 1.7. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z

Android: a reproducible F-Droid flavor with the web app bundled inside.

2026-09-17T15:19:41Z

The Android builds so far were shells around the live site: a verified APK proved nothing about the code that ran. The new `fdroid` flavor (io.coinos.fdroid) shares the WebView shell and carries the built web app in its assets. The page still lives at the v3.coinos.io origin — same storage, links and gift URLs — but every file under it is answered from the APK (Assets.java); only the site's live API paths reach the network, and the bundled page registers no service worker (HAL_NO_SW=1). Two clean unsigned builds give the same APK. COINOS_UNSIGNED=1 builds without the keystore; Bun is pinned via packageManager; the Gradle wrapper properties pin 8.12. fdroid/io.coinos.fdroid.yml is the fdroiddata recipe (checksum-pinned Bun in sudo, prebuild web build, scandelete, our signing key allowed for the Binaries match) and docs/REPRODUCIBLE.md the how-to. Verified on a phone: the bundled build cold-starts in airplane mode. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z