Android: a reproducible F-Droid flavor with the web app bundled inside.fdroid-v1.6

The Android builds so far were shells around the live site: a verified
APK proved nothing about the code that ran. The new `fdroid` flavor
(io.coinos.fdroid) shares the WebView shell and carries the built web
app in its assets. The page still lives at the v3.coinos.io origin — same
storage, links and gift URLs — but every file under it is answered from
the APK (Assets.java); only the site's live API paths reach the network,
and the bundled page registers no service worker (HAL_NO_SW=1).

Two clean unsigned builds give the same APK. COINOS_UNSIGNED=1 builds
without the keystore; Bun is pinned via packageManager; the Gradle wrapper
properties pin 8.12. fdroid/io.coinos.fdroid.yml is the fdroiddata recipe
(checksum-pinned Bun in sudo, prebuild web build, scandelete, our signing
key allowed for the Binaries match) and docs/REPRODUCIBLE.md the how-to.
Verified on a phone: the bundled build cold-starts in airplane mode.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z

1 files changed, 54 insertions, 0 deletions

diff --git a/docs/REPRODUCIBLE.md b/docs/REPRODUCIBLE.md
new file mode 100644
index 0000000..1ceb538
--- /dev/null
+++ b/docs/REPRODUCIBLE.md
@@ -0,0 +1,54 @@
+# Reproducible Android build
+
+The `fdroid` flavor of the Android app carries the built web app inside the
+APK (`assets/`), so what runs is what this source tree builds — not whatever
+the live site serves. Two clean builds of it give the same unsigned APK.
+
+## Build
+
+Pinned toolchain: Bun 1.3.9 (`packageManager` in package.json), JDK 21,
+Android SDK build-tools 35, Gradle 8.12 (android/gradle/wrapper), AGP 8.7.3.
+
+```sh
+bun install --frozen-lockfile
+HAL_NO_SW=1 bun run build          # dist/ without the service worker
+cd android
+COINOS_UNSIGNED=1 gradle assembleFdroidRelease   # unsigned
+# app/build/outputs/apk/fdroid/release/app-fdroid-release-unsigned.apk
+```
+
+Without `COINOS_UNSIGNED` and with `android/keystore.properties` present, the
+same command produces the signed release.
+
+## Verify
+
+Build twice from clean and compare:
+
+```sh
+sha256sum app/build/outputs/apk/fdroid/release/app-fdroid-release-unsigned.apk
+```
+
+To compare a signed release against your own unsigned build, strip the
+signature first (`apksigcopier compare`, or `diffoscope` on the two APKs —
+only `META-INF/` should differ).
+
+## What's inside
+
+- `assets/index.html`, `assets/app-<hash>.js`, `assets/chunk-*.js`, locales,
+  icons, punks: the split web build, content-addressed.
+- No service worker: inside the WebView the page is served from these
+  assets by `Assets.java`, and a worker would fetch the live site over them.
+- The page still lives at the `https://v3.coinos.io/` origin, so storage,
+  links and gift URLs behave as on the web; only the site's live API paths
+  (`/electrum`, `/esplora/`, `/sp/`, `/lnurlp/`, `/.well-known/`, `/api/`)
+  reach the network.
+
+## Release
+
+1. Bump `versionCode`/`versionName` in `android/app/build.gradle`.
+2. Tag `fdroid-v<versionName>` (the F-Droid recipe watches these tags).
+3. Attach the signed APK to the GitHub release as `coinos-fdroid-<versionName>.apk`
+   — F-Droid rebuilds, compares, and publishes this file when they match.
+
+The F-Droid recipe lives in `fdroid/io.coinos.fdroid.yml` (a copy goes into
+fdroiddata as `metadata/io.coinos.fdroid.yml`).