Android: a reproducible F-Droid flavor with the web app bundled inside.fdroid-v1.6

The Android builds so far were shells around the live site: a verified
APK proved nothing about the code that ran. The new `fdroid` flavor
(io.coinos.fdroid) shares the WebView shell and carries the built web
app in its assets. The page still lives at the v3.coinos.io origin — same
storage, links and gift URLs — but every file under it is answered from
the APK (Assets.java); only the site's live API paths reach the network,
and the bundled page registers no service worker (HAL_NO_SW=1).

Two clean unsigned builds give the same APK. COINOS_UNSIGNED=1 builds
without the keystore; Bun is pinned via packageManager; the Gradle wrapper
properties pin 8.12. fdroid/io.coinos.fdroid.yml is the fdroiddata recipe
(checksum-pinned Bun in sudo, prebuild web build, scandelete, our signing
key allowed for the Binaries match) and docs/REPRODUCIBLE.md the how-to.
Verified on a phone: the bundled build cold-starts in airplane mode.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z

3 files changed, 135 insertions, 2 deletions

diff --git a/android/app/build.gradle b/android/app/build.gradle
index 532db83..1831ac5 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -3,6 +3,24 @@ apply plugin: 'com.android.application'
 def keystoreProps = new Properties()
 def keystoreFile = rootProject.file('keystore.properties')
 if (keystoreFile.exists()) keystoreProps.load(new FileInputStream(keystoreFile))
+// COINOS_UNSIGNED=1 builds without the keystore even when it is present —
+// the reproducible-build check compares two unsigned builds byte for byte,
+// and F-Droid builds unsigned and compares against our signed release.
+def signRelease = keystoreFile.exists() && System.getenv('COINOS_UNSIGNED') == null
+
+// The bundled shell carries the built web app as assets. It is copied from
+// ../dist, which the web build produces first: HAL_NO_SW=1 bun run build
+// (the service worker is left out — inside the WebView the app is served
+// from these assets, and a worker would fetch the live site over it).
+tasks.register('copyWeb', Copy) {
+  def dist = rootProject.file('../dist') // the repo root's dist, not the module's
+  doFirst {
+    if (!new File(dist, 'index.html').exists())
+      throw new GradleException('build the web app first: HAL_NO_SW=1 bun run build (in the repo root)')
+  }
+  from(dist) { exclude '*.apk', 'standalone.html', 'sw.js', 'zmq-watcher.js' }
+  into layout.buildDirectory.dir('www')
+}
 
 android {
   namespace 'io.coinos.app'
@@ -23,22 +41,44 @@ android {
   //  webview  — the wallet runs in the app, so a UnifiedPush message can
   //             start it off-screen and let it answer. A separate app id,
   //             because it is a separate wallet: its storage is its own.
+  //  fdroid   — the webview shell with the web app BUNDLED as assets: what
+  //             runs is what was built from this source tree, reproducibly,
+  //             which is what F-Droid publishes. No service worker, no
+  //             remote code; the live site is only reached for its APIs.
   flavorDimensions += 'shell'
+  buildFeatures { buildConfig true }
   productFlavors {
     twa {
       dimension 'shell'
       isDefault = true
+      buildConfigField 'boolean', 'BUNDLED', 'false'
     }
     webview {
       dimension 'shell'
       applicationId 'io.coinos.webview'
       versionNameSuffix '-webview'
       resValue 'string', 'app_name', 'Coinos (UnifiedPush)'
+      buildConfigField 'boolean', 'BUNDLED', 'false'
+    }
+    fdroid {
+      dimension 'shell'
+      applicationId 'io.coinos.fdroid'
+      resValue 'string', 'app_name', 'Coinos'
+      buildConfigField 'boolean', 'BUNDLED', 'true'
+    }
+  }
+  sourceSets {
+    // the same shell as webview, plus the bundled web app
+    fdroid {
+      java.srcDirs = ['src/webview/java']
+      res.srcDirs = ['src/webview/res']
+      manifest.srcFile 'src/webview/AndroidManifest.xml'
+      assets.srcDirs += layout.buildDirectory.dir('www').get().asFile
     }
   }
   signingConfigs {
     release {
-      if (keystoreFile.exists()) {
+      if (signRelease) {
         storeFile rootProject.file(keystoreProps['storeFile'])
         storePassword keystoreProps['storePassword']
         keyAlias keystoreProps['keyAlias']
@@ -49,7 +89,7 @@ android {
   buildTypes {
     release {
       minifyEnabled false
-      if (keystoreFile.exists()) signingConfig signingConfigs.release
+      if (signRelease) signingConfig signingConfigs.release
     }
   }
 }
@@ -57,3 +97,5 @@ dependencies {
   // only the TWA shell needs Chrome's helper; the WebView build carries none
   twaImplementation 'com.google.androidbrowserhelper:androidbrowserhelper:2.5.0'
 }
+
+preBuild.dependsOn copyWeb
diff --git a/android/app/src/webview/java/io/coinos/app/Assets.java b/android/app/src/webview/java/io/coinos/app/Assets.java
new file mode 100644
index 0000000..ff3390b
--- /dev/null
+++ b/android/app/src/webview/java/io/coinos/app/Assets.java
@@ -0,0 +1,79 @@
+package io.coinos.app;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+import android.net.Uri;
+import android.webkit.WebResourceRequest;
+import android.webkit.WebResourceResponse;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * The bundled web app, served to the WebView from this APK's assets.
+ *
+ * <p>The page still lives at https://v3.coinos.io/ as far as the WebView is
+ * concerned — same origin, same storage, same links — but every file the
+ * page asks for under that origin is answered from this APK's assets, the build
+ * that shipped in this APK. Only the site's live endpoints (its Electrum
+ * and explorer proxies, LNURL, .well-known) go out to the network, exactly
+ * the paths the site's own nginx and service worker treat as live. A path
+ * with no file behind it and no extension is a deep link (/g/…, /invite/…,
+ * /npub…): it gets index.html, as the site's SPA fallback would.
+ */
+final class Assets {
+  private Assets() {}
+
+  static final String HOST = "v3.coinos.io";
+  private static final String[] LIVE = { "/electrum", "/esplora/", "/sp/", "/lnurlp/", "/.well-known/", "/api/" };
+  private static final Map<String, String> MIME = new HashMap<>();
+  static {
+    MIME.put("html", "text/html");
+    MIME.put("js", "text/javascript");
+    MIME.put("mjs", "text/javascript");
+    MIME.put("css", "text/css");
+    MIME.put("json", "application/json");
+    MIME.put("webmanifest", "application/manifest+json");
+    MIME.put("png", "image/png");
+    MIME.put("webp", "image/webp");
+    MIME.put("svg", "image/svg+xml");
+    MIME.put("ico", "image/x-icon");
+    MIME.put("woff2", "font/woff2");
+    MIME.put("wasm", "application/wasm");
+    MIME.put("txt", "text/plain");
+  }
+
+  /** The asset answering this request, or null to let the network have it. */
+  static WebResourceResponse serve(Context ctx, WebResourceRequest req) {
+    Uri u = req.getUrl();
+    if (u == null || !"https".equals(u.getScheme()) || !HOST.equals(u.getHost())) return null;
+    if (!"GET".equalsIgnoreCase(req.getMethod())) return null;
+    String path = u.getPath();
+    if (path == null || path.isEmpty()) path = "/";
+    for (String live : LIVE) if (path.startsWith(live)) return null;
+    String rel = path.equals("/") ? "index.html" : path.substring(1);
+    AssetManager am = ctx.getAssets();
+    InputStream in = open(am, rel);
+    if (in == null) {
+      String last = rel.substring(rel.lastIndexOf('/') + 1);
+      if (last.contains(".")) return null; // a real file we don't carry (coinos.apk): the network's
+      rel = "index.html";
+      in = open(am, rel);
+      if (in == null) return null;
+    }
+    String ext = rel.substring(rel.lastIndexOf('.') + 1).toLowerCase();
+    String mime = MIME.containsKey(ext) ? MIME.get(ext) : "application/octet-stream";
+    boolean text = mime.startsWith("text/") || mime.startsWith("application/json") || mime.startsWith("application/manifest") || mime.equals("image/svg+xml");
+    WebResourceResponse res = new WebResourceResponse(mime, text ? "utf-8" : null, in);
+    Map<String, String> headers = new HashMap<>();
+    headers.put("Cache-Control", "no-store");
+    res.setResponseHeaders(headers);
+    return res;
+  }
+
+  private static InputStream open(AssetManager am, String rel) {
+    try { return am.open(rel); } catch (IOException e) { return null; }
+  }
+}
diff --git a/android/app/src/webview/java/io/coinos/app/MainActivity.java b/android/app/src/webview/java/io/coinos/app/MainActivity.java
index a7980c4..e75e723 100644
--- a/android/app/src/webview/java/io/coinos/app/MainActivity.java
+++ b/android/app/src/webview/java/io/coinos/app/MainActivity.java
@@ -13,6 +13,7 @@ import android.webkit.PermissionRequest;
 import android.webkit.ValueCallback;
 import android.webkit.WebChromeClient;
 import android.webkit.WebResourceRequest;
+import android.webkit.WebResourceResponse;
 import android.webkit.WebSettings;
 import android.webkit.WebView;
 import android.webkit.WebViewClient;
@@ -64,6 +65,17 @@ public class MainActivity extends Activity {
     CookieManager.getInstance().setAcceptCookie(true);
 
     web.setWebViewClient(new WebViewClient() {
+      // The bundled build answers the site's own files from assets; the
+      // plain webview build lets everything through to the live site.
+      @Override
+      public WebResourceResponse shouldInterceptRequest(WebView v, WebResourceRequest r) {
+        if (BuildConfig.BUNDLED) {
+          WebResourceResponse res = Assets.serve(MainActivity.this, r);
+          if (res != null) return res;
+        }
+        return super.shouldInterceptRequest(v, r);
+      }
+
       @Override
       public boolean shouldOverrideUrlLoading(WebView v, WebResourceRequest r) {
         Uri u = r.getUrl();