chore(release): v0.1.9 (+11) — single-run reproducible developer-signed (SOURCE_DATE_EPOCH comes from the app commit, not fdroiddata)

This reverts commit 4d99e1a840.

.forgejo/workflows/release.yml

@@ -1,11 +1,14 @@
 # Release automation for git.comunes.org (Forgejo Actions).
 #
-# Pushing a tag `v*` builds the signed AAB and ships it to Google Play (internal
+# Pushing a tag `v*` runs two independent jobs:
-# track) via fastlane. F-Droid is NOT built here: F-Droid clones the repo and
+#   play            - build the signed AAB and ship it to Google Play (internal).
-# builds+signs it itself from the recipe in docs/fdroid/org.comunes.tane.yml
+#   fdroid_reference- build the per-ABI reference APKs the SAME way F-Droid will
-# (that build environment already handles the tesseract4android/NDK/old-repo
+#                     (fdroid build inside the fdroidserver buildserver image),
-# dependencies). So the F-Droid and Play builds have different signatures; a
+#                     sign them with the tane-upload key, and attach them to the
-# reproducible developer-signed setup can be added later as a post-merge step.
+#                     Forgejo release. F-Droid re-runs `fdroid build` on the same
+#                     commit+recipe+image, gets byte-identical output, verifies our
+#                     signature (AllowedAPKSigningKeys) and publishes OUR APK — so
+#                     F-Droid and Play share the same signing key.
 #
 # All credentials come from repo secrets (Settings > Actions > Secrets):
 #   TANE_KEYSTORE_BASE64   base64 of the dedicated tane-upload.jks
@@ -15,6 +18,8 @@
 #   SUPPLY_JSON_KEY_DATA   Google Play service-account JSON
 #
 # NOTE: `runs-on` must match a label your Forgejo runner registered with.
+# The fdroid_reference job pulls a large image (~2 GB) and builds tesseract from
+# source, so it is slow (~20-40 min); the play job is independent and unaffected.
 
 name: release
 
@@ -22,9 +27,13 @@ on:
   push:
     tags:
       - 'v*'
+  # Manual trigger to test the fdroid_reference job on a branch without cutting a
+  # tag or deploying to Play (the play job below is guarded to tags only).
+  workflow_dispatch:
 
 jobs:
   play:
+    if: ${{ startsWith(github.ref, 'refs/tags/') }}
     runs-on: docker
     container:
       image: ghcr.io/cirruslabs/flutter:3.41.9
@@ -86,3 +95,108 @@ jobs:
         if: always()
         working-directory: apps/app_seeds
         run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"
+
+  fdroid_reference:
+    runs-on: docker
+    container:
+      image: registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie
+    steps:
+      - name: Build reference APKs with fdroid, sign, and attach to the release
+        env:
+          TOKEN: ${{ github.token }}
+          TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
+          TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
+          TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
+          TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
+        run: |
+          set -eu
+
+          # 1) Reproduce F-Droid's build environment (ANDROID_HOME, PATH, NDK...).
+          sh /opt/buildserver/setup-env-vars /opt/android-sdk
+          . /etc/profile.d/bsenv.sh
+
+          # 2) fdroidserver from master, exactly like the fdroiddata CI.
+          fds=/opt/fdroidserver-src
+          mkdir -p "$fds"
+          curl -sL https://gitlab.com/fdroid/fdroidserver/-/archive/master/fdroidserver-master.tar.gz \
+            | tar -xz -C "$fds" --strip-components=1
+          export PATH="$fds:$PATH"
+          export PYTHONPATH="$fds:$fds/examples"
+          git config --global --add safe.directory '*'
+          # The job container reaches github.com but not the host's public git.comunes.org
+          # (NAT hairpin); redirect the app clone to the internal Forgejo host so
+          # `fdroid build` can fetch the source (and SOURCE_DATE_EPOCH from its commit).
+          git config --global url."http://x-access-token:${TOKEN}@forgejo:3000/".insteadOf "https://git.comunes.org/"
+
+          # 3) Fetch our in-repo recipe (the single source of truth) at this commit,
+          #    plus the pubspec versionCode base for the per-ABI codes.
+          work=/tmp/tane-src
+          mkdir -p "$work" && cd "$work"
+          git init -q .
+          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
+          base=$(sed -n -E 's/^version:.*\+([0-9]+)$/\1/p' apps/app_seeds/pubspec.yaml)
+          [ -n "$base" ]
+
+          # 4) Assemble a minimal fdroiddata (config.yml + srclibs + our recipe) from the
+          #    in-repo files. No external host needed — the job container reaches
+          #    git.comunes.org (via forgejo:3000) but not gitlab.com.
+          fdd=/tmp/fdroiddata
+          mkdir -p "$fdd/metadata" "$fdd/srclibs"
+          cp "$work/fdroid-ci/config.yml" "$fdd/config.yml"
+          cp "$work"/fdroid-ci/srclibs/*.yml "$fdd/srclibs/"
+          cp "$work/docs/fdroid/org.comunes.tane.yml" "$fdd/metadata/org.comunes.tane.yml"
+          cd "$fdd"
+          # Build THIS commit; drop binary: (we PRODUCE the reference here, not verify it).
+          sed -i "s#^\( *commit: \).*#\1${GITHUB_SHA}#" metadata/org.comunes.tane.yml
+          sed -i '/^ *binary: /d' metadata/org.comunes.tane.yml
+
+          # 5) Build the three per-ABI splits with F-Droid's own toolchain.
+          fdroid build --verbose --no-tarball \
+            "org.comunes.tane:$((base * 10 + 1))" \
+            "org.comunes.tane:$((base * 10 + 2))" \
+            "org.comunes.tane:$((base * 10 + 3))"
+
+          # 6) Sign each unsigned APK with tane-upload and attach to the Forgejo release.
+          apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
+          if [ -z "$apksigner" ]; then
+            yes | sdkmanager "build-tools;34.0.0" >/dev/null 2>&1 || true
+            apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
+          fi
+          echo "$TANE_KEYSTORE_BASE64" | base64 -d > /tmp/ks.jks
+          api="http://forgejo:3000/api/v1/repos/${GITHUB_REPOSITORY}"
+          tag="${GITHUB_REF_NAME}"
+          is_tag=false; [ "${GITHUB_REF_TYPE:-}" = tag ] && is_tag=true
+          rid=""
+          if $is_tag; then
+            curl -sf -X POST "$api/releases" \
+              -H "Authorization: token ${TOKEN}" -H 'Content-Type: application/json' \
+              -d "{\"tag_name\":\"${tag}\",\"name\":\"${tag}\"}" >/dev/null || true
+            rid=$(curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/tags/${tag}" \
+              | python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')
+          fi
+          for f in unsigned/org.comunes.tane_*.apk; do
+            vc=$(echo "$f" | sed -E 's/.*_([0-9]+)\.apk/\1/')
+            case $((vc % 10)) in
+              1) abi=armeabi-v7a ;;
+              2) abi=arm64-v8a ;;
+              3) abi=x86_64 ;;
+              *) echo "unexpected versionCode $vc"; exit 1 ;;
+            esac
+            out="/tmp/app-${abi}-release.apk"
+            "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
+              --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
+              --out "$out" "$f"
+            # Prove the signer cert matches AllowedAPKSigningKeys.
+            "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
+            if $is_tag; then
+              curl -sf -X POST "$api/releases/${rid}/assets?name=app-${abi}-release.apk" \
+                -H "Authorization: token ${TOKEN}" \
+                -F "attachment=@${out};type=application/vnd.android.package-archive"
+              echo "uploaded app-${abi}-release.apk (from ${f##*/})"
+            else
+              echo "built+signed app-${abi}-release.apk (dispatch: upload skipped)"
+            fi
+          done
+          rm -f /tmp/ks.jks

apps/app_seeds/pubspec.yaml

@@ -1,7 +1,7 @@
 name: tane
 description: "Tane — local-first, encrypted, decentralized traditional-seed inventory and market."
 publish_to: 'none'
-version: 0.1.8+10
+version: 0.1.9+11
 
 environment:
   sdk: ^3.11.5

docs/fdroid/org.comunes.tane.yml

@@ -15,12 +15,19 @@ AutoName: Tane
 RepoType: git
 Repo: https://git.comunes.org/comunes/tane.git
 
+# Reproducible, developer-signed: F-Droid rebuilds each split and, if it matches
+# our own signed APK on the git.comunes.org release byte-for-byte, publishes OUR
+# APK (same signature as the Play build). Value is the SHA-256 of the tane-upload
+# signing certificate (public).
+AllowedAPKSigningKeys: ddfae432091b8248a8a4a1b353487fa626301f4357ef835e94ec312f69418e38
+
 Builds:
-  - versionName: 0.1.8
+  - versionName: 0.1.9
-    versionCode: 101
+    versionCode: 111
-    commit: v0.1.8
+    commit: v0.1.9
     subdir: apps/app_seeds
     output: build/app/outputs/flutter-apk/app-armeabi-v7a-release.apk
+    binary: https://git.comunes.org/comunes/tane/releases/download/v%v/app-armeabi-v7a-release.apk
     srclibs:
       - flutter@stable
       - tesseract4android@4.9.0
@@ -48,11 +55,12 @@ Builds:
         $PUB_CACHE/hosted/pub.dev/flutter_tesseract_ocr-0.4.31/android/libs/tesseract4android-release.aar
       - $$flutter$$/bin/flutter build apk --release --split-per-abi --target-platform=android-arm
 
-  - versionName: 0.1.8
+  - versionName: 0.1.9
-    versionCode: 102
+    versionCode: 112
-    commit: v0.1.8
+    commit: v0.1.9
     subdir: apps/app_seeds
     output: build/app/outputs/flutter-apk/app-arm64-v8a-release.apk
+    binary: https://git.comunes.org/comunes/tane/releases/download/v%v/app-arm64-v8a-release.apk
     srclibs:
       - flutter@stable
       - tesseract4android@4.9.0
@@ -80,11 +88,12 @@ Builds:
         $PUB_CACHE/hosted/pub.dev/flutter_tesseract_ocr-0.4.31/android/libs/tesseract4android-release.aar
       - $$flutter$$/bin/flutter build apk --release --split-per-abi --target-platform=android-arm64
 
-  - versionName: 0.1.8
+  - versionName: 0.1.9
-    versionCode: 103
+    versionCode: 113
-    commit: v0.1.8
+    commit: v0.1.9
     subdir: apps/app_seeds
     output: build/app/outputs/flutter-apk/app-x86_64-release.apk
+    binary: https://git.comunes.org/comunes/tane/releases/download/v%v/app-x86_64-release.apk
     srclibs:
       - flutter@stable
       - tesseract4android@4.9.0
@@ -120,5 +129,5 @@ VercodeOperation:
   - '%c * 10 + 3'
 UpdateCheckData: 
   apps/app_seeds/pubspec.yaml|version:\s*[\d.]+\+(\d+)|apps/app_seeds/pubspec.yaml|version:\s*([\d.]+)\+
-CurrentVersion: 0.1.8
+CurrentVersion: 0.1.9
-CurrentVersionCode: 103
+CurrentVersionCode: 113

docs/fdroid/reproducible-post-merge.md

@@ -1,75 +0,0 @@
-# F-Droid reproducible, developer-signed builds — post-merge follow-up
-
-The initial F-Droid submission is **F-Droid-signed** (F-Droid builds from source and
-signs with its own key). Making F-Droid publish *our* tane-upload–signed APK
-(same signature as Google Play, so users move between stores) is a **post-merge**
-step, because F-Droid derives `SOURCE_DATE_EPOCH` from the **commit timestamp of
-our metadata file inside fdroiddata** — a value that only exists once the MR is
-merged. So a byte-matching reference cannot be produced beforehand.
-
-## Why our own CI couldn't do this pre-merge
-
-- Deps are NOT the problem: F-Droid uses the **standard public repos**
-  (`mavenCentral()` + Google's maven) — no private mirror. `jsr305` and the old
-  jcenter artifacts are on Maven Central. The build environment that "just works"
-  is the public image `registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie`
-  (bundles the Android SDK + NDK); we verified a full build succeeds in it.
-- The real blocker is `SOURCE_DATE_EPOCH` (fdroidserver `get_source_date_epoch`
-  falls back to the fdroiddata metadata commit, since the app isn't checked out
-  yet when it's read). Unknown until F-Droid commits our metadata.
-
-## Post-merge procedure
-
-Run this **after** `org.comunes.tane` is merged into fdroiddata, from a clone of
-the **merged** fdroiddata (so the metadata commit — and thus SOURCE_DATE_EPOCH —
-matches what F-Droid used). Requires Docker and the tane-upload keystore.
-
-```bash
-#!/bin/bash
-set -eu
-IMG=registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie
-FDROIDDATA=/path/to/merged/fdroiddata     # git clone of gitlab.com/fdroid/fdroiddata (or fork synced past merge)
-KS=/home/vjrj/proyectos/sync/comunes/shared-l2/apkSigning/tane-upload.jks
-VC_BASE=10                                  # pubspec versionCode base (0.1.x+N -> N)
-
-docker run --rm -v "$FDROIDDATA":/build -v "$KS":/tmp/ks.jks:ro \
-  -e KSPASS -e KEYPASS -w /build "$IMG" bash -c '
-    set -e
-    sh /opt/buildserver/setup-env-vars /opt/android-sdk
-    . /etc/profile.d/bsenv.sh
-    fds=/tmp/fds; mkdir -p "$fds"
-    curl -sL https://gitlab.com/fdroid/fdroidserver/-/archive/master/fdroidserver-master.tar.gz \
-      | tar -xz -C "$fds" --strip-components=1
-    export PATH="$fds:$PATH" PYTHONPATH="$fds:$fds/examples"
-    git config --global --add safe.directory "*"
-    # Build the three per-ABI splits exactly as F-Droid does (SOURCE_DATE_EPOCH
-    # comes from THIS merged fdroiddata metadata commit -> matches F-Droid).
-    fdroid build --verbose --no-tarball \
-      org.comunes.tane:$((VC_BASE*10+1)) \
-      org.comunes.tane:$((VC_BASE*10+2)) \
-      org.comunes.tane:$((VC_BASE*10+3))
-    apksigner=$(find "$ANDROID_HOME" -name apksigner -type f | sort -V | tail -1)
-    for f in unsigned/org.comunes.tane_*.apk; do
-      vc=${f##*_}; vc=${vc%.apk}
-      case $((vc%10)) in 1) abi=armeabi-v7a;; 2) abi=arm64-v8a;; 3) abi=x86_64;; esac
-      "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias tane-upload \
-        --ks-pass "env:KSPASS" --key-pass "env:KEYPASS" \
-        --out "/build/app-${abi}-release.apk" "$f"
-      "$apksigner" verify --print-certs "/build/app-${abi}-release.apk" | grep -i SHA-256
-    done
-  '
-```
-
-Set `KSPASS`/`KEYPASS` in the environment before running (never echo them).
-
-Expected: `Signer #1 certificate SHA-256 digest:` =
-`ddfae432091b8248a8a4a1b353487fa626301f4357ef835e94ec312f69418e38`
-(the tane-upload cert = the future `AllowedAPKSigningKeys` value).
-
-Then:
-1. Upload the three `app-<abi>-release.apk` to a git.comunes.org release for the tag.
-2. Add to the recipe: `AllowedAPKSigningKeys: ddfae432…` and per-build
-   `binary: https://git.comunes.org/comunes/tane/releases/download/v%v/app-<abi>-release.apk`.
-3. Open a follow-up MR. F-Droid re-runs `fdroid build`, gets byte-identical output,
-   verifies our signature, and switches to publishing our signed APK.
-4. If `fdroid verify` still differs, keep it F-Droid-signed — no harm.

fdroid-ci/config.yml

@@ -0,0 +1,89 @@
+---
+
+repo_url: "https://f-droid.org/repo"
+repo_maxage: 14
+repo_web_base_url: "https://f-droid.org/packages"
+
+# needed until this is fixed: https://gitlab.com/fdroid/fdroidserver/-/issues/1143
+repo_name: "F-Droid"
+
+archive_older: 3
+
+repo_keyalias: ciarang
+repo_key_sha256: 43238d512c1e5eb2d6569f4a3afbf5523418b82e0a3ed1552770abb9a9c9ccab
+repo_pubkey: 3082035e30820246a00302010202044c49cd00300d06092a864886f70d01010505003071310b300906035504061302554b3110300e06035504081307556e6b6e6f776e3111300f0603550407130857657468657262793110300e060355040a1307556e6b6e6f776e3110300e060355040b1307556e6b6e6f776e311930170603550403131043696172616e2047756c746e69656b73301e170d3130303732333137313032345a170d3337313230383137313032345a3071310b300906035504061302554b3110300e06035504081307556e6b6e6f776e3111300f0603550407130857657468657262793110300e060355040a1307556e6b6e6f776e3110300e060355040b1307556e6b6e6f776e311930170603550403131043696172616e2047756c746e69656b7330820122300d06092a864886f70d01010105000382010f003082010a028201010096d075e47c014e7822c89fd67f795d23203e2a8843f53ba4e6b1bf5f2fd0e225938267cfcae7fbf4fe596346afbaf4070fdb91f66fbcdf2348a3d92430502824f80517b156fab00809bdc8e631bfa9afd42d9045ab5fd6d28d9e140afc1300917b19b7c6c4df4a494cf1f7cb4a63c80d734265d735af9e4f09455f427aa65a53563f87b336ca2c19d244fcbba617ba0b19e56ed34afe0b253ab91e2fdb1271f1b9e3c3232027ed8862a112f0706e234cf236914b939bcf959821ecb2a6c18057e070de3428046d94b175e1d89bd795e535499a091f5bc65a79d539a8d43891ec504058acb28c08393b5718b57600a211e803f4a634e5c57f25b9b8c4422c6fd90203010001300d06092a864886f70d0101050500038201010008e4ef699e9807677ff56753da73efb2390d5ae2c17e4db691d5df7a7b60fc071ae509c5414be7d5da74df2811e83d3668c4a0b1abc84b9fa7d96b4cdf30bba68517ad2a93e233b042972ac0553a4801c9ebe07bf57ebe9a3b3d6d663965260e50f3b8f46db0531761e60340a2bddc3426098397fda54044a17e5244549f9869b460ca5e6e216b6f6a2db0580b480ca2afe6ec6b46eedacfa4aa45038809ece0c5978653d6c85f678e7f5a2156d1bedd8117751e64a4b0dcd140f3040b021821a8d93aed8d01ba36db6c82372211fed714d9a32607038cdfd565bd529ffc637212aaa2c224ef22b603eccefb5bf1e085c191d4b24fe742b17ab3f55d4e6f05ef
+
+gpgkey: 37D2C98789D8311948394E3E41E7044E1DBA2E89
+gpghome: {env: gpghome}
+
+keystore: {env: keystore}
+keydname: "CN=FDroid, OU=FDroid, O=fdroid.org, L=ORG, S=ORG, C=UK"
+keystorepass: {env: keystorepass}
+keypass: {env: keypass}
+
+serverwebroot: {env: serverwebroot}
+nonstandardwebroot: true
+
+deploy_process_logs: true
+keep_when_not_allowed: true
+make_current_version_link: false
+refresh_scanner: true
+
+binary_transparency_remote: git@gitlab.com:fdroid/f-droid.org-transparency-log.git
+
+keyaliases:
+  com.ghostsq.commander.samba: '@com.ghostsq.commander'
+  com.nextcloud.talk2: '@com.nextcloud.client'
+  com.termux.api: '@com.termux'
+  com.termux.boot: '@com.termux'
+  com.termux.gui: '@com.termux'
+  com.termux.styling: '@com.termux'
+  com.termux.tasker: '@com.termux'
+  com.termux.widget: '@com.termux'
+  com.termux.window: '@com.termux'
+  org.fdroid.fdroid.privileged: 'ciarang'
+  org.fdroid.fdroid: 'ciarang'
+
+# APKs signed by publicly available private signing keys are not
+# allowed to be included in this repo, even if they are reproducible.
+#
+# Hash calculated with `openssl x509 -in <pem file> -outform der | sha256sum`
+apk_signing_key_block_list:
+  # https://android.googlesource.com/platform/build/+/refs/heads/main/target/product/security
+  - a6ccc500ff0e7421200eb66a7fe174ef1b00e52ca91727070cbedf061ff76c35  # AOSP bluetooth.x509.pem
+  - ce7b2b47ae2b7552c8f92cc29124279883041fb623a5f194a82c9bf15d492aa0  # AOSP cts_uicc_2021.x509.pem
+  - 465983f7791f2abeb43ea2cbdc7f21a8260b72bc08a55c839fc1a43bc741a81e  # AOSP media.x509.pem
+  - e1dbadce60dc080d15b58a014b0dcf9400e24de23fa00b287a5a982bfebda2ee  # AOSP networkstack.x509.pem
+  - fae9122a8721d6e2a196d2224dffcf773c9127e2bb956cbddb40b009192ffdfd  # AOSP nfc.x509.pem
+  - c8a2e9bccf597c2fb6dc66bee293fc13f2fc47ec77bc6b2b0d52c11f51192ab8  # AOSP platform.x509.pem
+  - abf21f9e2af1d881cc673fddcefa6ed9c269a437bd64b279cf45844cfd589126  # AOSP sdk_sandbox.x509.pem
+  - 28bbfe4a7b97e74681dc55c2fbb6ccb8d6c74963733f6af6ae74d8c3a6e879fd  # AOSP shared.x509.pem
+  - a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc  # AOSP testkey.x509.pem
+  # Leaked Platform Certificates https://bugs.chromium.org/p/apvi/issues/detail?id=100
+  - 2464ddfefa071f268ea7667123df05ead2293272ff2a64d9cee021c38b46c6af
+  - 2bfa22964760a25d99ab9a14910e44fe2063b51d5b4ac2e4282573ce94996aa3
+  - 34df0e7a9f1cf1892e45c056b4973cd81ccf148a4050d11aea4ac5a65f900a42
+  - 369c38b18401ea16785f11720e37d7a2bc5a4d209e76955c0858ea469ad62fdf
+  - 4274243d7a954ac6482866f0cc67ca1843ca94d68a0ee53f837d6740a8134421
+  - 5304915c4bb7baca28776231993996fde1baffcbbe6500fb0fc7f2d3a2888cb7
+  - 9200c550f2374706eff37e3a8674bc03aeba8b25c052de638972ab94365af0a2
+  - 9fc510e167d8d312e758273285414e77edac9fed944741f5682be92501f095d4
+  - a7a0e10a61a5af93624376df60e9def9436358f50aa6174e5423633b856e2be1
+  - b01dcea669eefdd991fc6a24678a8b6e6a6d0ad8986950328c69d0eea1dec0d5
+  # publicly available in https://github.com/esabook/auzen-android
+  - 30d7eef6321f81f43c008665abc46f680006be6e89961481ed4e1d6981b8e5a0
+  # publicly available in https://github.com/Goooler/LawnchairRelease
+  - 8f5b1353db08cd9287f8ecc6bad2eb9be2668d476af90415bd7bfdff257840e4
+  # publicly available in https://github.com/jkas-dbt/AndroidPE
+  - f1881e27ceb9b4341a0fc00db27bf5f46a38e4c0c1884353f76b0fe4b0e4dccf
+  # publicly available in https://github.com/iebb/NekokoLPA
+  - 6966004ad0161165335f9204f8f5a52df49fe068c9545c0c589c23221af8d3a4
+  - 4139278AACCE8338C03DC9A6B0172C1880E0A4949FF3E05292C2E781765026FA
+  # publicly available in https://github.com/MaYiFei1995/PackageViewer
+  - 24117de73612bcfeaf2a6a24bd044f2e33e52d41965f504d74177f4fe255eb26
+  # publicly available in https://github.com/teambtcmap/btcmap-android
+  - 37cdf8e8fdff2252681c1f7d68f3850f916f05607442c6762f86f6a23a7c1ad0
+  # publicly available in https://github.com/Ashinch/ReadYou/blob/0.11.1/signature/keystore.properties
+  - 715696914a35366d98fa45312af96811f7e6de4085b5e4709f4c1e74f8bde4d0
+  # Privacy QR Scanner leaked key
+  - 2529f2fd61ac279806b7bc423daef5b36fdac496c87ff9fa36c8bdeead12acaa

fdroid-ci/srclibs/flutter.yml

@@ -0,0 +1,2 @@
+RepoType: git
+Repo: https://github.com/flutter/flutter.git

fdroid-ci/srclibs/tesseract4android.yml

@@ -0,0 +1,2 @@
+RepoType: git
+Repo: https://github.com/adaptech-cz/Tesseract4Android