From facd72db1612c373fa6c4ab3f574757880f791a2 Mon Sep 17 00:00:00 2001
From: vjrj <vjrj@comunes.org>
Date: Wed, 22 Jul 2026 22:57:51 +0200
Subject: [PATCH] ci(release): apksigner --alignment-preserved true
 (reproducibility, final layer)

Even with the /home/vagrant path fix and v2/v3-only signing, the verify
still failed on a v3 CHUNKED_SHA512 mismatch with an EMPTY file diff. Cause
found by byte-level compare: apksigner (build-tools 35+) re-aligns native
libs to 16KB pages by default (--alignment-preserved defaults to false),
rewriting each .so's ZIP local-header extra field from gradle's 0x0 padding
to the 0xd935 alignment marker. F-Droid's reproducibility check compares
against the raw gradle output (0x0), so our re-aligned reference (0xd935)
differed in the signed bytes though every file was identical. Proven: 273
entries differed only in the extra field, 0 in compressed data. Signing
F-Droid's own unsigned build with --alignment-preserved true yields content
byte-identical to it (0 extra-field diffs, 0 data diffs). So preserve the
build's alignment when signing the reference.
---
 .forgejo/workflows/release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 405bda4..f956269 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -249,6 +249,7 @@ jobs:
           "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
             --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
             --v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \
+            --alignment-preserved true \
             --out "$out" "$f"
           # Prove the signer cert matches AllowedAPKSigningKeys.
           "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
@@ -375,6 +376,7 @@ jobs:
           "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
             --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
             --v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \
+            --alignment-preserved true \
             --out "$out" "$f"
           "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
           rm -f /tmp/ks.jks
@@ -499,6 +501,7 @@ jobs:
           "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
             --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
             --v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \
+            --alignment-preserved true \
             --out "$out" "$f"
           "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
           rm -f /tmp/ks.jks