Android: a reproducible F-Droid flavor with the web app bundled inside.fdroid-v1.6

The Android builds so far were shells around the live site: a verified
APK proved nothing about the code that ran. The new `fdroid` flavor
(io.coinos.fdroid) shares the WebView shell and carries the built web
app in its assets. The page still lives at the v3.coinos.io origin — same
storage, links and gift URLs — but every file under it is answered from
the APK (Assets.java); only the site's live API paths reach the network,
and the bundled page registers no service worker (HAL_NO_SW=1).

Two clean unsigned builds give the same APK. COINOS_UNSIGNED=1 builds
without the keystore; Bun is pinned via packageManager; the Gradle wrapper
properties pin 8.12. fdroid/io.coinos.fdroid.yml is the fdroiddata recipe
(checksum-pinned Bun in sudo, prebuild web build, scandelete, our signing
key allowed for the Binaries match) and docs/REPRODUCIBLE.md the how-to.
Verified on a phone: the bundled build cold-starts in airplane mode.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z

2 files changed, 91 insertions, 0 deletions

diff --git a/android/app/src/webview/java/io/coinos/app/Assets.java b/android/app/src/webview/java/io/coinos/app/Assets.java
new file mode 100644
index 0000000..ff3390b
--- /dev/null
+++ b/android/app/src/webview/java/io/coinos/app/Assets.java
@@ -0,0 +1,79 @@
+package io.coinos.app;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+import android.net.Uri;
+import android.webkit.WebResourceRequest;
+import android.webkit.WebResourceResponse;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * The bundled web app, served to the WebView from this APK's assets.
+ *
+ * <p>The page still lives at https://v3.coinos.io/ as far as the WebView is
+ * concerned — same origin, same storage, same links — but every file the
+ * page asks for under that origin is answered from this APK's assets, the build
+ * that shipped in this APK. Only the site's live endpoints (its Electrum
+ * and explorer proxies, LNURL, .well-known) go out to the network, exactly
+ * the paths the site's own nginx and service worker treat as live. A path
+ * with no file behind it and no extension is a deep link (/g/…, /invite/…,
+ * /npub…): it gets index.html, as the site's SPA fallback would.
+ */
+final class Assets {
+  private Assets() {}
+
+  static final String HOST = "v3.coinos.io";
+  private static final String[] LIVE = { "/electrum", "/esplora/", "/sp/", "/lnurlp/", "/.well-known/", "/api/" };
+  private static final Map<String, String> MIME = new HashMap<>();
+  static {
+    MIME.put("html", "text/html");
+    MIME.put("js", "text/javascript");
+    MIME.put("mjs", "text/javascript");
+    MIME.put("css", "text/css");
+    MIME.put("json", "application/json");
+    MIME.put("webmanifest", "application/manifest+json");
+    MIME.put("png", "image/png");
+    MIME.put("webp", "image/webp");
+    MIME.put("svg", "image/svg+xml");
+    MIME.put("ico", "image/x-icon");
+    MIME.put("woff2", "font/woff2");
+    MIME.put("wasm", "application/wasm");
+    MIME.put("txt", "text/plain");
+  }
+
+  /** The asset answering this request, or null to let the network have it. */
+  static WebResourceResponse serve(Context ctx, WebResourceRequest req) {
+    Uri u = req.getUrl();
+    if (u == null || !"https".equals(u.getScheme()) || !HOST.equals(u.getHost())) return null;
+    if (!"GET".equalsIgnoreCase(req.getMethod())) return null;
+    String path = u.getPath();
+    if (path == null || path.isEmpty()) path = "/";
+    for (String live : LIVE) if (path.startsWith(live)) return null;
+    String rel = path.equals("/") ? "index.html" : path.substring(1);
+    AssetManager am = ctx.getAssets();
+    InputStream in = open(am, rel);
+    if (in == null) {
+      String last = rel.substring(rel.lastIndexOf('/') + 1);
+      if (last.contains(".")) return null; // a real file we don't carry (coinos.apk): the network's
+      rel = "index.html";
+      in = open(am, rel);
+      if (in == null) return null;
+    }
+    String ext = rel.substring(rel.lastIndexOf('.') + 1).toLowerCase();
+    String mime = MIME.containsKey(ext) ? MIME.get(ext) : "application/octet-stream";
+    boolean text = mime.startsWith("text/") || mime.startsWith("application/json") || mime.startsWith("application/manifest") || mime.equals("image/svg+xml");
+    WebResourceResponse res = new WebResourceResponse(mime, text ? "utf-8" : null, in);
+    Map<String, String> headers = new HashMap<>();
+    headers.put("Cache-Control", "no-store");
+    res.setResponseHeaders(headers);
+    return res;
+  }
+
+  private static InputStream open(AssetManager am, String rel) {
+    try { return am.open(rel); } catch (IOException e) { return null; }
+  }
+}
diff --git a/android/app/src/webview/java/io/coinos/app/MainActivity.java b/android/app/src/webview/java/io/coinos/app/MainActivity.java
index a7980c4..e75e723 100644
--- a/android/app/src/webview/java/io/coinos/app/MainActivity.java
+++ b/android/app/src/webview/java/io/coinos/app/MainActivity.java
@@ -13,6 +13,7 @@ import android.webkit.PermissionRequest;
 import android.webkit.ValueCallback;
 import android.webkit.WebChromeClient;
 import android.webkit.WebResourceRequest;
+import android.webkit.WebResourceResponse;
 import android.webkit.WebSettings;
 import android.webkit.WebView;
 import android.webkit.WebViewClient;
@@ -64,6 +65,17 @@ public class MainActivity extends Activity {
     CookieManager.getInstance().setAcceptCookie(true);
 
     web.setWebViewClient(new WebViewClient() {
+      // The bundled build answers the site's own files from assets; the
+      // plain webview build lets everything through to the live site.
+      @Override
+      public WebResourceResponse shouldInterceptRequest(WebView v, WebResourceRequest r) {
+        if (BuildConfig.BUNDLED) {
+          WebResourceResponse res = Assets.serve(MainActivity.this, r);
+          if (res != null) return res;
+        }
+        return super.shouldInterceptRequest(v, r);
+      }
+
       @Override
       public boolean shouldOverrideUrlLoading(WebView v, WebResourceRequest r) {
         Uri u = r.getUrl();