Fix F-Droid reproducible build

Author: nyxar77

.fdroid.yml

@@ -1,5 +1,6 @@
 Categories:
   - Sports & Health
+  - Workout
 License: GPL-3.0-only
 AuthorName: nyxar77
 SourceCode: https://github.com/nyxar77/Pulse
@@ -10,15 +11,16 @@ AutoName: Pulse
 
 RepoType: git
 Repo: https://github.com/nyxar77/Pulse.git
+Binaries: https://github.com/nyxar77/Pulse/releases/download/%v/Pulse-%v.apk
 
 Builds:
   - versionName: 0.1.2
     versionCode: 3
-    commit: 0.1.2
+    commit: d0f4c8b40f9a744b376898184b79ff33db8a482d
     subdir: android/app
     sudo:
-      - echo "deb https://deb.debian.org/debian trixie main" > /etc/apt/sources.list.d/trixie.list
-      - echo "deb https://deb.debian.org/debian forky main" > /etc/apt/sources.list.d/forky.list
+      - echo deb https://deb.debian.org/debian trixie main > /etc/apt/sources.list.d/trixie.list
+      - echo deb https://deb.debian.org/debian forky main > /etc/apt/sources.list.d/forky.list
       - apt-get update
       - apt-get install -y -t forky golang-go make nodejs npm
       - apt-get install -y -t trixie openjdk-21-jdk-headless
@@ -31,6 +33,7 @@ Builds:
     prebuild:
       - cd ../..
       - npm ci
+      - 'sed -i ''s/adapter: adapter(),/adapter: adapter(), version: { name: "0.1.2" },/'' svelte.config.js'
       - rm node_modules/@capacitor/cli/assets/android-template.tar.gz
       - rm node_modules/@capacitor/cli/assets/capacitor-cordova-ios-plugins.tar.gz
       - rm node_modules/@capacitor/cli/assets/ios-pods-template.tar.gz
@@ -50,6 +53,7 @@ Builds:
       - npx cap sync android
       - popd
 
+AllowedAPKSigningKeys: ee3d16e34033a39c583cda01b6db00dd4fa4a6a5ad07023d3b7bfc877841ed65
 AutoUpdateMode: Version
 UpdateCheckMode: Tags ^[0-9]+\.[0-9]+\.[0-9]+$
 CurrentVersion: 0.1.2

.github/workflows/android-release.yml

@@ -3,12 +3,18 @@ name: Android release
 on:
   release:
     types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag to rebuild
+        required: true
+        type: string
 
 permissions:
   contents: write
 
 concurrency:
-  group: android-release-${{ github.event.release.id }}
+  group: android-release-${{ github.event.release.id || inputs.tag }}
   cancel-in-progress: false
 
 jobs:
@@ -17,13 +23,20 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     env:
-      PULSE_RELEASE_TAG: ${{ github.event.release.tag_name }}
+      PULSE_RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
 
     steps:
       - name: Check out release
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ github.event.release.tag_name || inputs.tag }}
+
+      - name: Pin web build version
+        shell: bash
+        run: |
+          if ! grep -q 'version:' svelte.config.js; then
+            perl -0pi -e 's/adapter: adapter\(\),/adapter: adapter(),\n    version: { name: "$ENV{PULSE_RELEASE_TAG}" },/' svelte.config.js
+          fi
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -63,6 +76,9 @@ jobs:
         working-directory: android
         run: ./gradlew assembleRelease --no-daemon
 
+      - name: Install reproducible signing tools
+        run: sdkmanager "build-tools;34.0.0"
+
       - name: Sign and verify APK
         id: sign
         env:
@@ -75,25 +91,26 @@ jobs:
           keystore="$RUNNER_TEMP/pulse-release.p12"
           printf '%s' "$PULSE_ANDROID_KEYSTORE_BASE64" | base64 --decode > "$keystore"
 
-          safe_tag="${GITHUB_REF_NAME//\//-}"
+          safe_tag="${PULSE_RELEASE_TAG//\//-}"
           apk="$RUNNER_TEMP/Pulse-$safe_tag.apk"
           unsigned_apk="android/app/build/outputs/apk/release/app-release-unsigned.apk"
-          build_tools="$ANDROID_HOME/build-tools/36.0.0"
+          align_tools="$ANDROID_HOME/build-tools/36.0.0"
+          sign_tools="$ANDROID_HOME/build-tools/34.0.0"
 
-          "$build_tools/zipalign" -f -p 4 "$unsigned_apk" "$apk"
-          "$build_tools/apksigner" sign \
+          "$align_tools/zipalign" -f -p 4 "$unsigned_apk" "$apk"
+          "$sign_tools/apksigner" sign \
             --ks "$keystore" \
             --ks-type PKCS12 \
             --ks-key-alias pulse \
             --ks-pass env:PULSE_ANDROID_KEYSTORE_PASSWORD \
             --key-pass env:PULSE_ANDROID_KEYSTORE_PASSWORD \
             "$apk"
-          "$build_tools/apksigner" verify --verbose --print-certs "$apk"
+          "$sign_tools/apksigner" verify --verbose --print-certs "$apk"
 
           echo "apk=$apk" >> "$GITHUB_OUTPUT"
 
       - name: Attach APK to release
         env:
           GH_TOKEN: ${{ github.token }}
           APK_PATH: ${{ steps.sign.outputs.apk }}
-        run: gh release upload "$GITHUB_REF_NAME" "$APK_PATH" --clobber
+        run: gh release upload "$PULSE_RELEASE_TAG" "$APK_PATH" --clobber

scripts/check-release.ts

@@ -40,10 +40,11 @@ const fdroidCommit = fdroid.match(/^\s+commit:\s*(\S+)$/m)?.[1];
 if (
   fdroidBuildVersion !== versionName ||
   fdroidBuildCode !== versionCodeText ||
-  fdroidCommit !== versionName
+  !fdroidCommit ||
+  !/^[0-9a-f]{40}$/.test(fdroidCommit)
 ) {
   fail(
-    `.fdroid.yml build must use version ${versionName}, code ${versionCode}, and commit ${versionName}`,
+    `.fdroid.yml build must use version ${versionName}, code ${versionCode}, and a full commit hash`,
   );
 }
 

svelte.config.js

@@ -1,9 +1,17 @@
 import adapter from "@sveltejs/adapter-static";
+import { readFileSync } from "node:fs";
+
+const packageVersion = JSON.parse(
+  readFileSync(new URL("./package.json", import.meta.url), "utf8"),
+).version;
 
 /** @type {import('@sveltejs/kit').Config} */
 const config = {
   kit: {
     adapter: adapter(),
+    version: {
+      name: packageVersion,
+    },
   },
 };