aboutsummaryrefslogtreecommitdiffstats
path: root/docs/REPRODUCIBLE.md
blob: bb02537c17a30b5593835ef983697b4607e1f902 (plain) (blame) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

# Reproducible Android build

The `fdroid` flavor of the Android app carries the built web app inside the
APK (`assets/`), so what runs is what this source tree builds — not whatever
the live site serves. Two clean builds of it give the same unsigned APK.

## Build

Pinned toolchain: Bun 1.3.9 (`packageManager` in package.json), JDK 21,
Android SDK build-tools 35, Gradle 8.12 (android/gradle/wrapper), AGP 8.7.3.

```sh
bun install --frozen-lockfile
HAL_NO_SW=1 bun run build          # dist/ without the service worker
cd android
COINOS_UNSIGNED=1 gradle assembleFdroidRelease   # unsigned
# app/build/outputs/apk/fdroid/release/app-fdroid-release-unsigned.apk
```

Without `COINOS_UNSIGNED` and with `android/keystore.properties` present, the
same command produces the signed release.

## Verify

Build twice from clean and compare:

```sh
sha256sum app/build/outputs/apk/fdroid/release/app-fdroid-release-unsigned.apk
```

To compare a signed release against your own unsigned build, strip the
signature first (`apksigcopier compare`, or `diffoscope` on the two APKs —
only `META-INF/` should differ).

## What's inside

- `assets/index.html`, `assets/app-<hash>.js`, `assets/chunk-*.js`, locales,
  icons, punks: the split web build, content-addressed.
- No service worker: inside the WebView the page is served from these
  assets by `Assets.java`, and a worker would fetch the live site over them.
- The page still lives at the `https://v3.coinos.io/` origin, so storage,
  links and gift URLs behave as on the web; only the site's live API paths
  (`/electrum`, `/esplora/`, `/sp/`, `/lnurlp/`, `/.well-known/`, `/api/`)
  reach the network.

## Release

App store text (summary, description, changelogs, icon) lives in
`fastlane/metadata/android/en-US/` — F-Droid reads it from the tagged commit,
so a changelog for the new versionCode goes in `changelogs/<versionCode>.txt`.

1. Bump `versionCode`/`versionName` in `android/app/build.gradle`.
2. Tag `fdroid-v<versionName>` (the F-Droid recipe watches these tags).
3. Attach the signed APK to the GitHub release as `coinos-fdroid-<versionName>.apk`
   — F-Droid rebuilds, compares, and publishes this file when they match.

The F-Droid recipe lives in `fdroid/io.coinos.fdroid.yml` (a copy goes into
fdroiddata as `metadata/io.coinos.fdroid.yml`).
generated by cgit v1.2.3 (git 2.51.0) at 2026-11-12 03:37:30 +0000
ass="w"> } from './dm.js'; import { openCall, CALL, RING_S } from './calls.js'; import * as nip44 from 'nostr-tools/nip44'; const DB = 'coinos-dm-inbox'; const STORE = 'inbox'; const VERSION = 1; function openDb() { return new Promise((resolve, reject) => { if (typeof indexedDB === 'undefined') return reject(new Error('IndexedDB unavailable')); const req = indexedDB.open(DB, VERSION); req.onupgradeneeded = () => { const db = req.result; if (!db.objectStoreNames.contains(STORE)) db.createObjectStore(STORE); }; req.onsuccess = () => resolve(req.result); req.onerror = () => reject(req.error); }); } async function tx(mode, fn) { const db = await openDb(); try { return await new Promise((resolve, reject) => { const t = db.transaction(STORE, mode); const s = t.objectStore(STORE); let out; Promise.resolve(fn(s)).then((v) => { out = v; }).catch(reject); t.oncomplete = () => resolve(out); t.onerror = () => reject(t.error); t.onabort = () => reject(t.error); }); } finally { db.close(); } } // One record per wallet: { sk, pubkey, follows: [hex], names: { hex: name } }. // `sk` is null when the identity lives behind a remote signer. export async function saveInbox(walletKey, rec) { return tx('readwrite', (s) => { s.put(rec, walletKey); }); } export async function clearInbox(walletKey) { return tx('readwrite', (s) => { s.delete(walletKey); }); } export async function allInboxes() { try { return await tx('readonly', (s) => new Promise((res, rej) => { const out = []; const cur = s.openCursor(); cur.onsuccess = () => { const c = cur.result; if (!c) return res(out); out.push(c.value); c.continue(); }; cur.onerror = () => rej(cur.error); })); } catch { return []; } } const unhex = (h) => Uint8Array.from(h.match(/.{2}/g).map((b) => parseInt(b, 16))); // Open a wrap against every identity we hold a key for. Returns // { author, followed, name, mine } for the first one that opens it, or null // if none can — which includes every remote-signer wallet, so a null means // "we don't know", never "it's a stranger". export async function classifyDm(wrap, inboxes) { for (const rec of inboxes) { if (!rec || !rec.sk) continue; let sk; try { sk = unhex(rec.sk); } catch { continue; } const opened = await unwrapDM(wrap, sk); if (!opened) continue; const author = opened.author; return { author, mine: author === rec.pubkey, followed: (rec.follows || []).includes(author), muted: (rec.muted || []).includes(author), // Someone you're already talking to is not a stranger, whether or not // you ever followed them. known: (rec.known || []).includes(author), // No contact list published at all: there's nothing to filter against, // and silence would be worse than noise. hasList: !!rec.hasList, name: (rec.names || {})[author] || null, content: opened.rumor && opened.rumor.kind === 14 ? opened.rumor.content : '', }; } return null; } // Should this DM interrupt someone? Our own sent-copy never should — every // NIP-17 message is wrapped to the sender too, and being notified about what // you just typed is pure noise. Anything we couldn't open stays notifiable: // better a generic buzz than a silent drop. export function shouldNotifyDm(verdict) { if (!verdict) return true; if (verdict.mine) return false; if (verdict.muted) return false; // muted in the app: no buzz either if (verdict.followed || verdict.known) return true; return !verdict.hasList; } // A call ringing in (NIP-AC), the wrap a push pointed at: opened with the key // it's for, and worth ringing only as a fresh offer from someone this // account follows or talks to, and hasn't muted. Returns { offer, name, // type } to ring with, or null for anything else (a candidate, a stranger, // a stale one, a wrap we hold no key for); `quiet` for a caller who // may not ring us (not followed, not written to). export async function classifyCall(wrap, inboxes, nowS = Math.floor(Date.now() / 1000)) { for (const rec of inboxes) { if (!rec || !rec.sk) continue; let sk; try { sk = unhex(rec.sk); } catch { continue; } const ev = await openCall(wrap, async (pk, ct) => nip44.decrypt(ct, nip44.getConversationKey(sk, pk))); if (!ev) continue; const from = ev.pubkey; if (ev.kind !== CALL.OFFER || from === rec.pubkey || nowS - ev.created_at > RING_S) return null; if ((rec.muted || []).includes(from)) return null; const type = (ev.tags.find((x) => x[0] === 'call-type') || [])[1] === 'video' ? 'video' : 'voice'; // someone not followed nor written to doesn't ring — `quiet`: the app // lists it as a call that didn't ring, next time it opens const quiet = !(rec.follows || []).includes(from) && !(rec.rings || rec.known || []).includes(from); return { offer: ev, name: (rec.names || {})[from] || null, type, quiet }; } return null; }
generated by cgit v1.2.3 (git 2.51.0) at 2026-11-12 03:37:30 +0000