Android: a reproducible F-Droid flavor with the web app bundled inside.fdroid-v1.6

The Android builds so far were shells around the live site: a verified
APK proved nothing about the code that ran. The new `fdroid` flavor
(io.coinos.fdroid) shares the WebView shell and carries the built web
app in its assets. The page still lives at the v3.coinos.io origin — same
storage, links and gift URLs — but every file under it is answered from
the APK (Assets.java); only the site's live API paths reach the network,
and the bundled page registers no service worker (HAL_NO_SW=1).

Two clean unsigned builds give the same APK. COINOS_UNSIGNED=1 builds
without the keystore; Bun is pinned via packageManager; the Gradle wrapper
properties pin 8.12. fdroid/io.coinos.fdroid.yml is the fdroiddata recipe
(checksum-pinned Bun in sudo, prebuild web build, scandelete, our signing
key allowed for the Binaries match) and docs/REPRODUCIBLE.md the how-to.
Verified on a phone: the bundled build cold-starts in airplane mode.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z

8 files changed, 261 insertions, 3 deletions

diff --git a/android/app/build.gradle b/android/app/build.gradle
index 532db83..1831ac5 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -3,6 +3,24 @@ apply plugin: 'com.android.application'
 def keystoreProps = new Properties()
 def keystoreFile = rootProject.file('keystore.properties')
 if (keystoreFile.exists()) keystoreProps.load(new FileInputStream(keystoreFile))
+// COINOS_UNSIGNED=1 builds without the keystore even when it is present —
+// the reproducible-build check compares two unsigned builds byte for byte,
+// and F-Droid builds unsigned and compares against our signed release.
+def signRelease = keystoreFile.exists() && System.getenv('COINOS_UNSIGNED') == null
+
+// The bundled shell carries the built web app as assets. It is copied from
+// ../dist, which the web build produces first: HAL_NO_SW=1 bun run build
+// (the service worker is left out — inside the WebView the app is served
+// from these assets, and a worker would fetch the live site over it).
+tasks.register('copyWeb', Copy) {
+  def dist = rootProject.file('../dist') // the repo root's dist, not the module's
+  doFirst {
+    if (!new File(dist, 'index.html').exists())
+      throw new GradleException('build the web app first: HAL_NO_SW=1 bun run build (in the repo root)')
+  }
+  from(dist) { exclude '*.apk', 'standalone.html', 'sw.js', 'zmq-watcher.js' }
+  into layout.buildDirectory.dir('www')
+}
 
 android {
   namespace 'io.coinos.app'
@@ -23,22 +41,44 @@ android {
   //  webview  — the wallet runs in the app, so a UnifiedPush message can
   //             start it off-screen and let it answer. A separate app id,
   //             because it is a separate wallet: its storage is its own.
+  //  fdroid   — the webview shell with the web app BUNDLED as assets: what
+  //             runs is what was built from this source tree, reproducibly,
+  //             which is what F-Droid publishes. No service worker, no
+  //             remote code; the live site is only reached for its APIs.
   flavorDimensions += 'shell'
+  buildFeatures { buildConfig true }
   productFlavors {
     twa {
       dimension 'shell'
       isDefault = true
+      buildConfigField 'boolean', 'BUNDLED', 'false'
     }
     webview {
       dimension 'shell'
       applicationId 'io.coinos.webview'
       versionNameSuffix '-webview'
       resValue 'string', 'app_name', 'Coinos (UnifiedPush)'
+      buildConfigField 'boolean', 'BUNDLED', 'false'
+    }
+    fdroid {
+      dimension 'shell'
+      applicationId 'io.coinos.fdroid'
+      resValue 'string', 'app_name', 'Coinos'
+      buildConfigField 'boolean', 'BUNDLED', 'true'
+    }
+  }
+  sourceSets {
+    // the same shell as webview, plus the bundled web app
+    fdroid {
+      java.srcDirs = ['src/webview/java']
+      res.srcDirs = ['src/webview/res']
+      manifest.srcFile 'src/webview/AndroidManifest.xml'
+      assets.srcDirs += layout.buildDirectory.dir('www').get().asFile
     }
   }
   signingConfigs {
     release {
-      if (keystoreFile.exists()) {
+      if (signRelease) {
         storeFile rootProject.file(keystoreProps['storeFile'])
         storePassword keystoreProps['storePassword']
         keyAlias keystoreProps['keyAlias']
@@ -49,7 +89,7 @@ android {
   buildTypes {
     release {
       minifyEnabled false
-      if (keystoreFile.exists()) signingConfig signingConfigs.release
+      if (signRelease) signingConfig signingConfigs.release
     }
   }
 }
@@ -57,3 +97,5 @@ dependencies {
   // only the TWA shell needs Chrome's helper; the WebView build carries none
   twaImplementation 'com.google.androidbrowserhelper:androidbrowserhelper:2.5.0'
 }
+
+preBuild.dependsOn copyWeb
diff --git a/android/app/src/webview/java/io/coinos/app/Assets.java b/android/app/src/webview/java/io/coinos/app/Assets.java
new file mode 100644
index 0000000..ff3390b
--- /dev/null
+++ b/android/app/src/webview/java/io/coinos/app/Assets.java
@@ -0,0 +1,79 @@
+package io.coinos.app;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+import android.net.Uri;
+import android.webkit.WebResourceRequest;
+import android.webkit.WebResourceResponse;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * The bundled web app, served to the WebView from this APK's assets.
+ *
+ * <p>The page still lives at https://v3.coinos.io/ as far as the WebView is
+ * concerned — same origin, same storage, same links — but every file the
+ * page asks for under that origin is answered from this APK's assets, the build
+ * that shipped in this APK. Only the site's live endpoints (its Electrum
+ * and explorer proxies, LNURL, .well-known) go out to the network, exactly
+ * the paths the site's own nginx and service worker treat as live. A path
+ * with no file behind it and no extension is a deep link (/g/…, /invite/…,
+ * /npub…): it gets index.html, as the site's SPA fallback would.
+ */
+final class Assets {
+  private Assets() {}
+
+  static final String HOST = "v3.coinos.io";
+  private static final String[] LIVE = { "/electrum", "/esplora/", "/sp/", "/lnurlp/", "/.well-known/", "/api/" };
+  private static final Map<String, String> MIME = new HashMap<>();
+  static {
+    MIME.put("html", "text/html");
+    MIME.put("js", "text/javascript");
+    MIME.put("mjs", "text/javascript");
+    MIME.put("css", "text/css");
+    MIME.put("json", "application/json");
+    MIME.put("webmanifest", "application/manifest+json");
+    MIME.put("png", "image/png");
+    MIME.put("webp", "image/webp");
+    MIME.put("svg", "image/svg+xml");
+    MIME.put("ico", "image/x-icon");
+    MIME.put("woff2", "font/woff2");
+    MIME.put("wasm", "application/wasm");
+    MIME.put("txt", "text/plain");
+  }
+
+  /** The asset answering this request, or null to let the network have it. */
+  static WebResourceResponse serve(Context ctx, WebResourceRequest req) {
+    Uri u = req.getUrl();
+    if (u == null || !"https".equals(u.getScheme()) || !HOST.equals(u.getHost())) return null;
+    if (!"GET".equalsIgnoreCase(req.getMethod())) return null;
+    String path = u.getPath();
+    if (path == null || path.isEmpty()) path = "/";
+    for (String live : LIVE) if (path.startsWith(live)) return null;
+    String rel = path.equals("/") ? "index.html" : path.substring(1);
+    AssetManager am = ctx.getAssets();
+    InputStream in = open(am, rel);
+    if (in == null) {
+      String last = rel.substring(rel.lastIndexOf('/') + 1);
+      if (last.contains(".")) return null; // a real file we don't carry (coinos.apk): the network's
+      rel = "index.html";
+      in = open(am, rel);
+      if (in == null) return null;
+    }
+    String ext = rel.substring(rel.lastIndexOf('.') + 1).toLowerCase();
+    String mime = MIME.containsKey(ext) ? MIME.get(ext) : "application/octet-stream";
+    boolean text = mime.startsWith("text/") || mime.startsWith("application/json") || mime.startsWith("application/manifest") || mime.equals("image/svg+xml");
+    WebResourceResponse res = new WebResourceResponse(mime, text ? "utf-8" : null, in);
+    Map<String, String> headers = new HashMap<>();
+    headers.put("Cache-Control", "no-store");
+    res.setResponseHeaders(headers);
+    return res;
+  }
+
+  private static InputStream open(AssetManager am, String rel) {
+    try { return am.open(rel); } catch (IOException e) { return null; }
+  }
+}
diff --git a/android/app/src/webview/java/io/coinos/app/MainActivity.java b/android/app/src/webview/java/io/coinos/app/MainActivity.java
index a7980c4..e75e723 100644
--- a/android/app/src/webview/java/io/coinos/app/MainActivity.java
+++ b/android/app/src/webview/java/io/coinos/app/MainActivity.java
@@ -13,6 +13,7 @@ import android.webkit.PermissionRequest;
 import android.webkit.ValueCallback;
 import android.webkit.WebChromeClient;
 import android.webkit.WebResourceRequest;
+import android.webkit.WebResourceResponse;
 import android.webkit.WebSettings;
 import android.webkit.WebView;
 import android.webkit.WebViewClient;
@@ -64,6 +65,17 @@ public class MainActivity extends Activity {
     CookieManager.getInstance().setAcceptCookie(true);
 
     web.setWebViewClient(new WebViewClient() {
+      // The bundled build answers the site's own files from assets; the
+      // plain webview build lets everything through to the live site.
+      @Override
+      public WebResourceResponse shouldInterceptRequest(WebView v, WebResourceRequest r) {
+        if (BuildConfig.BUNDLED) {
+          WebResourceResponse res = Assets.serve(MainActivity.this, r);
+          if (res != null) return res;
+        }
+        return super.shouldInterceptRequest(v, r);
+      }
+
       @Override
       public boolean shouldOverrideUrlLoading(WebView v, WebResourceRequest r) {
         Uri u = r.getUrl();
diff --git a/android/gradle/wrapper/gradle-wrapper.properties b/android/gradle/wrapper/gradle-wrapper.properties
new file mode 100644
index 0000000..cea7a79
--- /dev/null
+++ b/android/gradle/wrapper/gradle-wrapper.properties
@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.12-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
diff --git a/build.js b/build.js
index 0f2373e..fc58f8f 100644
--- a/build.js
+++ b/build.js
@@ -360,6 +360,11 @@ function bootShell(logo, staging) {
 }
 const BOOT_SHELL_SCRIPT = `<script>try{var m=location.pathname.match(/^\\/([A-Za-z0-9._-]{1,64})\\/?$/);if(m){document.getElementById('boot-shell').style.display='';document.getElementById('boot-shell-name').textContent=decodeURIComponent(m[1]);}}catch(e){}</script>`;
 
+// HAL_NO_SW=1: the page registers no service worker. The Android bundled
+// build serves this page from its own assets, where a worker would only
+// fetch the live site over the top of them.
+const NO_SW = !!process.env.HAL_NO_SW;
+
 async function pageHtml({ css, staging, pwa, scriptHtml }) {
   return `<!doctype html>
 <html lang="en">
@@ -376,7 +381,7 @@ ${pwa ? PWA_HEAD : ''}<style>${css}</style>
 <div id="app">${bootShell(await brandSvg(), staging)}</div>
 ${BOOT_SHELL_SCRIPT}
 ${scriptHtml}
-${pwa ? SW_REGISTER + '\n' : ''}</body>
+${pwa && !NO_SW ? SW_REGISTER + '\n' : ''}</body>
 </html>`;
 }
 
diff --git a/docs/REPRODUCIBLE.md b/docs/REPRODUCIBLE.md
new file mode 100644
index 0000000..1ceb538
--- /dev/null
+++ b/docs/REPRODUCIBLE.md
@@ -0,0 +1,54 @@
+# Reproducible Android build
+
+The `fdroid` flavor of the Android app carries the built web app inside the
+APK (`assets/`), so what runs is what this source tree builds — not whatever
+the live site serves. Two clean builds of it give the same unsigned APK.
+
+## Build
+
+Pinned toolchain: Bun 1.3.9 (`packageManager` in package.json), JDK 21,
+Android SDK build-tools 35, Gradle 8.12 (android/gradle/wrapper), AGP 8.7.3.
+
+```sh
+bun install --frozen-lockfile
+HAL_NO_SW=1 bun run build          # dist/ without the service worker
+cd android
+COINOS_UNSIGNED=1 gradle assembleFdroidRelease   # unsigned
+# app/build/outputs/apk/fdroid/release/app-fdroid-release-unsigned.apk
+```
+
+Without `COINOS_UNSIGNED` and with `android/keystore.properties` present, the
+same command produces the signed release.
+
+## Verify
+
+Build twice from clean and compare:
+
+```sh
+sha256sum app/build/outputs/apk/fdroid/release/app-fdroid-release-unsigned.apk
+```
+
+To compare a signed release against your own unsigned build, strip the
+signature first (`apksigcopier compare`, or `diffoscope` on the two APKs —
+only `META-INF/` should differ).
+
+## What's inside
+
+- `assets/index.html`, `assets/app-<hash>.js`, `assets/chunk-*.js`, locales,
+  icons, punks: the split web build, content-addressed.
+- No service worker: inside the WebView the page is served from these
+  assets by `Assets.java`, and a worker would fetch the live site over them.
+- The page still lives at the `https://v3.coinos.io/` origin, so storage,
+  links and gift URLs behave as on the web; only the site's live API paths
+  (`/electrum`, `/esplora/`, `/sp/`, `/lnurlp/`, `/.well-known/`, `/api/`)
+  reach the network.
+
+## Release
+
+1. Bump `versionCode`/`versionName` in `android/app/build.gradle`.
+2. Tag `fdroid-v<versionName>` (the F-Droid recipe watches these tags).
+3. Attach the signed APK to the GitHub release as `coinos-fdroid-<versionName>.apk`
+   — F-Droid rebuilds, compares, and publishes this file when they match.
+
+The F-Droid recipe lives in `fdroid/io.coinos.fdroid.yml` (a copy goes into
+fdroiddata as `metadata/io.coinos.fdroid.yml`).
diff --git a/fdroid/io.coinos.fdroid.yml b/fdroid/io.coinos.fdroid.yml
new file mode 100644
index 0000000..4e4bd6d
--- /dev/null
+++ b/fdroid/io.coinos.fdroid.yml
@@ -0,0 +1,58 @@
+# F-Droid build recipe for the bundled Android build (metadata/io.coinos.fdroid.yml
+# in fdroiddata). The web app is built first with a checksum-pinned Bun, then
+# the Gradle flavor packs dist/ into the APK as assets. Both halves are
+# reproducible: two clean builds give the same unsigned APK, so F-Droid can
+# publish the coinos-signed release once its own build matches (Binaries +
+# AllowedAPKSigningKeys).
+Categories:
+  - Money
+License: MIT
+AuthorName: Adam Soltys
+WebSite: https://v3.coinos.io
+SourceCode: https://github.com/coinos/coinosv3
+IssueTracker: https://github.com/coinos/coinosv3/issues
+
+AutoName: Coinos
+Summary: Self-custodial bitcoin wallet with instant Ark payments and nostr chat
+Description: |-
+  Bitcoin you actually hold: your wallet is twelve words, nobody else ever
+  has them, and they work in any wallet, anywhere.
+
+  * Spending over Ark: instant, low-fee off-chain payments with a unilateral exit
+  * Savings on-chain: a full BIP84 bitcoin wallet
+  * Lightning sends and receives, plus a [email protected] payment address
+  * Nostr built in: encrypted DMs, community chat, posts, zaps
+  * Handles lightning:, bitcoin:, nostr: and lnurl: links and NFC taps
+
+  This build carries the whole app inside the APK; the coinos servers are
+  only reached for their APIs (the Ark server, Electrum, the name registrar).
+
+RepoType: git
+Repo: https://github.com/coinos/coinosv3.git
+Binaries: https://github.com/coinos/coinosv3/releases/download/fdroid-v%v/coinos-fdroid-%v.apk
+
+Builds:
+  - versionName: '1.6'
+    versionCode: 7
+    commit: fdroid-v1.6
+    subdir: android/app
+    sudo:
+      - curl -fsSL -o /tmp/bun.zip https://github.com/oven-sh/bun/releases/download/bun-v1.3.9/bun-linux-x64-baseline.zip
+      - echo "104d4d037f4b35e10215c0507e1779691f39c57bd91ddeefe11cad781e3fc4b9  /tmp/bun.zip" | sha256sum -c
+      - unzip -q /tmp/bun.zip -d /tmp/bun
+      - install -m 0755 /tmp/bun/bun-linux-x64-baseline/bun /usr/local/bin/bun
+    gradle:
+      - fdroid
+    prebuild:
+      - cd ../.. && bun install --frozen-lockfile && HAL_NO_SW=1 bun run build
+    scandelete:
+      - node_modules
+      - static/coinos.apk
+      - static/graphene.apk
+
+AllowedAPKSigningKeys: 766483ab8372c02f8406d29595e7389a2869190b429e0ffd092ebb0bfa2bc2f4
+
+AutoUpdateMode: Version
+UpdateCheckMode: Tags ^fdroid-v[0-9.]+$
+CurrentVersion: '1.6'
+CurrentVersionCode: 7
diff --git a/package.json b/package.json
index 756a1e0..6783bf9 100644
--- a/package.json
+++ b/package.json
@@ -2,6 +2,7 @@
   "name": "coinosv3",
   "private": true,
   "version": "0.1.0",
+  "packageManager": "[email protected]",
   "license": "MIT",
   "type": "module",
   "description": "coinos v3 — offline-capable, single-file self-custody Bitcoin wallet for the browser",