docs: document F-Droid, reproducible builds, and release checksums

Author: pymq

README.md

@@ -1,6 +1,7 @@
 <p align="center">
     <a href="https://github.com/anywherelan/awl/blob/master/LICENSE"><img alt="GitHub license" src="https://img.shields.io/github/license/anywherelan/awl?color=brightgreen"></a>
     <a href="https://github.com/anywherelan/awl/releases"><img alt="GitHub release" src="https://img.shields.io/github/v/release/anywherelan/awl" /></a>
+    <a href="https://f-droid.org/packages/com.anywherelan.awl/"><img alt="F-Droid" src="https://img.shields.io/f-droid/v/com.anywherelan.awl" /></a>
     <a href="https://github.com/anywherelan/awl/actions/workflows/test.yml"><img alt="Test build status" src="https://github.com/anywherelan/awl/actions/workflows/test.yml/badge.svg" /></a>
 </p>
 
@@ -13,6 +14,7 @@
   - [Screenshots](#camera-screenshots)
   - [How it works](#how-it-works)
   - [Security](#security)
+  - [Reproducible builds](#reproducible-builds)
 - [Installation](#installation)
   - [The web UI](#the-web-ui)
   - [Android](#android)
@@ -113,6 +115,13 @@ awl's transport security comes from [libp2p](https://docs.libp2p.io/).
 - **Key compromise:** there is no revocation mechanism. If an identity key leaks, generate a new one and re-add peers.
 - **Metadata:** nodes participating in the DHT can observe which peer IDs are online and being looked up. Packet contents are end-to-end encrypted and not visible to them.
 
+## Reproducible builds
+
+awl's release binaries are built reproducibly on every platform. Builds run in public GitHub Actions from tagged source (see the [build workflow](.github/workflows/build-manual.yml) and [`build.sh`](build.sh)), using `-trimpath` and `-buildid=` with pinned dependencies, so the same source produces byte-identical output.
+
+- **Android:** the app is independently reproducible-verified: F-Droid rebuilds the application from source and verifies that the resulting APK matches the APK published in the GitHub Releases. See its [reproducibility status](https://verification.f-droid.org/packages/com.anywherelan.awl/).
+- **Desktop:** every GitHub release includes SHA-256 checksums for its archives. You can independently reproduce a release yourself by building the same tag according to [`BUILDING.md`](BUILDING.md) and verifying that the checksums match.
+
 # Installation
 
 awl ships in two desktop flavors:
@@ -130,7 +139,10 @@ Once awl is running, open **http://admin.awl** in a browser. `admin.awl` is a ma
 
 ## Android
 
-Install the APK from the [releases page](https://github.com/anywherelan/awl/releases) and open the app.
+<a href="https://f-droid.org/packages/com.anywherelan.awl/"><img src="https://fdroid.gitlab.io/artwork/badge/get-it-on.png" alt="Get it on F-Droid" height="80"></a>
+<a href="https://github.com/anywherelan/awl/releases"><img src="docs/images/badge_github.png" alt="Get it on GitHub" height="80"></a>
+
+Get it from [F-Droid](https://f-droid.org/packages/com.anywherelan.awl/), or download the APK directly from the [GitHub releases page](https://github.com/anywherelan/awl/releases). Both are the same app; F-Droid notifies you of new versions.
 
 ## Windows (`awl-tray`)
 
@@ -464,7 +476,7 @@ On desktop (`awl-tray`) you can upgrade application by clicking system tray icon
 
 ### Android
 
-Awl is not yet published in any store, so the only option is to download new version .apk from the [releases page](https://github.com/anywherelan/awl/releases) and install it manually.
+Update via [F-Droid](https://f-droid.org/packages/com.anywherelan.awl/), or download the latest .apk from the [releases page](https://github.com/anywherelan/awl/releases) and install it manually.
 
 ### Server
 

docs/images/badge_github.png

@@ -3,10 +3,14 @@
 package main
 
 import (
+	"crypto/sha256"
 	_ "embed"
+	"encoding/hex"
 	"flag"
 	"html/template"
+	"io"
 	"os"
+	"path/filepath"
 	"sort"
 	"strings"
 )
@@ -17,6 +21,7 @@ var releaseDescriptionTemplate string
 func main() {
 	var buildPath string
 	flag.StringVar(&buildPath, "build_path", "build", "directory with build files")
+	flag.Parse()
 
 	files, err := os.ReadDir(buildPath)
 	if err != nil {
@@ -30,6 +35,7 @@ func main() {
 	var awlTrayWindows []string
 	var awlTrayWindows7 []string
 	var awlTrayMacos []string
+	var checksums []checksum
 
 	for _, file := range files {
 		if file.IsDir() {
@@ -54,7 +60,16 @@ func main() {
 			awlTrayWindows = append(awlTrayWindows, filename)
 		case strings.HasPrefix(filename, "awl-tray-macos"):
 			awlTrayMacos = append(awlTrayMacos, filename)
+		default:
+			// not a release asset, skip it from downloads and checksums
+			continue
+		}
+
+		hash, err := sha256File(filepath.Join(buildPath, filename))
+		if err != nil {
+			panic(err)
 		}
+		checksums = append(checksums, checksum{Name: filename, Hash: hash})
 	}
 
 	sort.Strings(awlLinux)
@@ -64,6 +79,9 @@ func main() {
 	sort.Strings(awlTrayWindows)
 	sort.Strings(awlTrayWindows7)
 	sort.Strings(awlTrayMacos)
+	sort.Slice(checksums, func(i, j int) bool {
+		return checksums[i].Name < checksums[j].Name
+	})
 
 	releaseTag := strings.TrimPrefix(awlAndroid, "awl-android-")
 	releaseTag = strings.TrimSuffix(releaseTag, ".apk")
@@ -73,7 +91,7 @@ func main() {
 		panic(err)
 	}
 
-	data := map[string]interface{}{
+	data := map[string]any{
 		"ReleaseTag":      releaseTag,
 		"AwlAndroid":      awlAndroid,
 		"AwlLinux":        awlLinux,
@@ -83,10 +101,31 @@ func main() {
 		"AwlTrayWindows":  awlTrayWindows,
 		"AwlTrayWindows7": awlTrayWindows7,
 		"AwlTrayMacos":    awlTrayMacos,
+		"Checksums":       checksums,
 	}
 
 	err = temp.Execute(os.Stdout, data)
 	if err != nil {
 		panic(err)
 	}
 }
+
+type checksum struct {
+	Name string
+	Hash string
+}
+
+func sha256File(path string) (string, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+
+	h := sha256.New()
+	if _, err := io.Copy(h, file); err != nil {
+		return "", err
+	}
+
+	return hex.EncodeToString(h.Sum(nil)), nil
+}

tools/generate_release_info.go

@@ -44,3 +44,11 @@ For instructions on how to install anywherelan [see readme](https://github.com/a
 
 {{range .AwlWindows7}}
 [{{.}}](https://github.com/anywherelan/awl/releases/download/{{$.ReleaseTag}}/{{.}})  {{end}}
+
+## Checksums (SHA-256)
+
+Verify a downloaded file with `sha256sum -c` (or `shasum -a 256 -c`). Anywherelan's builds are reproducible — see [Reproducible builds](https://github.com/anywherelan/awl#reproducible-builds).
+
+```
+{{range .Checksums}}{{.Hash}}  {{.Name}}
+{{end}}```