From 1bd3e2613641a8d2bc63c262a58cad126632459f Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Thu, 17 Sep 2026 08:19:41 -0700 Subject: Android: a reproducible F-Droid flavor with the web app bundled inside. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Android builds so far were shells around the live site: a verified APK proved nothing about the code that ran. The new `fdroid` flavor (io.coinos.fdroid) shares the WebView shell and carries the built web app in its assets. The page still lives at the v3.coinos.io origin — same storage, links and gift URLs — but every file under it is answered from the APK (Assets.java); only the site's live API paths reach the network, and the bundled page registers no service worker (HAL_NO_SW=1). Two clean unsigned builds give the same APK. COINOS_UNSIGNED=1 builds without the keystore; Bun is pinned via packageManager; the Gradle wrapper properties pin 8.12. fdroid/io.coinos.fdroid.yml is the fdroiddata recipe (checksum-pinned Bun in sudo, prebuild web build, scandelete, our signing key allowed for the Binaries match) and docs/REPRODUCIBLE.md the how-to. Verified on a phone: the bundled build cold-starts in airplane mode. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z --- package.json | 1 + 1 file changed, 1 insertion(+) (limited to 'package.json') diff --git a/package.json b/package.json index 756a1e0..6783bf9 100644 --- a/package.json +++ b/package.json @@ -2,6 +2,7 @@ "name": "coinosv3", "private": true, "version": "0.1.0", + "packageManager": "bun@1.3.9", "license": "MIT", "type": "module", "description": "coinos v3 — offline-capable, single-file self-custody Bitcoin wallet for the browser", -- cgit v1.2.3