From 1bd3e2613641a8d2bc63c262a58cad126632459f Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Thu, 17 Sep 2026 08:19:41 -0700 Subject: Android: a reproducible F-Droid flavor with the web app bundled inside. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Android builds so far were shells around the live site: a verified APK proved nothing about the code that ran. The new `fdroid` flavor (io.coinos.fdroid) shares the WebView shell and carries the built web app in its assets. The page still lives at the v3.coinos.io origin — same storage, links and gift URLs — but every file under it is answered from the APK (Assets.java); only the site's live API paths reach the network, and the bundled page registers no service worker (HAL_NO_SW=1). Two clean unsigned builds give the same APK. COINOS_UNSIGNED=1 builds without the keystore; Bun is pinned via packageManager; the Gradle wrapper properties pin 8.12. fdroid/io.coinos.fdroid.yml is the fdroiddata recipe (checksum-pinned Bun in sudo, prebuild web build, scandelete, our signing key allowed for the Binaries match) and docs/REPRODUCIBLE.md the how-to. Verified on a phone: the bundled build cold-starts in airplane mode. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z --- docs/REPRODUCIBLE.md | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 docs/REPRODUCIBLE.md (limited to 'docs') diff --git a/docs/REPRODUCIBLE.md b/docs/REPRODUCIBLE.md new file mode 100644 index 0000000..1ceb538 --- /dev/null +++ b/docs/REPRODUCIBLE.md @@ -0,0 +1,54 @@ +# Reproducible Android build + +The `fdroid` flavor of the Android app carries the built web app inside the +APK (`assets/`), so what runs is what this source tree builds — not whatever +the live site serves. Two clean builds of it give the same unsigned APK. + +## Build + +Pinned toolchain: Bun 1.3.9 (`packageManager` in package.json), JDK 21, +Android SDK build-tools 35, Gradle 8.12 (android/gradle/wrapper), AGP 8.7.3. + +```sh +bun install --frozen-lockfile +HAL_NO_SW=1 bun run build # dist/ without the service worker +cd android +COINOS_UNSIGNED=1 gradle assembleFdroidRelease # unsigned +# app/build/outputs/apk/fdroid/release/app-fdroid-release-unsigned.apk +``` + +Without `COINOS_UNSIGNED` and with `android/keystore.properties` present, the +same command produces the signed release. + +## Verify + +Build twice from clean and compare: + +```sh +sha256sum app/build/outputs/apk/fdroid/release/app-fdroid-release-unsigned.apk +``` + +To compare a signed release against your own unsigned build, strip the +signature first (`apksigcopier compare`, or `diffoscope` on the two APKs — +only `META-INF/` should differ). + +## What's inside + +- `assets/index.html`, `assets/app-.js`, `assets/chunk-*.js`, locales, + icons, punks: the split web build, content-addressed. +- No service worker: inside the WebView the page is served from these + assets by `Assets.java`, and a worker would fetch the live site over them. +- The page still lives at the `https://v3.coinos.io/` origin, so storage, + links and gift URLs behave as on the web; only the site's live API paths + (`/electrum`, `/esplora/`, `/sp/`, `/lnurlp/`, `/.well-known/`, `/api/`) + reach the network. + +## Release + +1. Bump `versionCode`/`versionName` in `android/app/build.gradle`. +2. Tag `fdroid-v` (the F-Droid recipe watches these tags). +3. Attach the signed APK to the GitHub release as `coinos-fdroid-.apk` + — F-Droid rebuilds, compares, and publishes this file when they match. + +The F-Droid recipe lives in `fdroid/io.coinos.fdroid.yml` (a copy goes into +fdroiddata as `metadata/io.coinos.fdroid.yml`). -- cgit v1.2.3