Ten years ago I had published a “To Do” app I wrote (https://f-droid.org/packages/com.xmission.trevin.android.todo). Recently I’ve had time to work on this project again and have an updated version I want to publish, but the F-Droid site has completely changed since then and after reading through the developer FAQ and looking at the “Requests for Packaging” tracker I still can’t figure out how to go about it. The “Submission” template in GitLab seems to only apply to new submissions.
I don’t remember the details of how the original submission was done, but I did have to publish the code on SourceForge. Since SF doesn’t seem to be as popular these days I’ve published the updated code to GitHub, but I’ve also created a webhook to have SF mirror releases I push to GH.
Since the original code base is so old, I had to set up an Android Studio 2.3.3 development environment to re-build it. I have additional updates in the pipeline to work with the latest Android Studio (“Ladybug”) but that can’t build an app supporting minSdk < 14 (Honeycomb or earlier), so I wanted to get one last build that still supports Froyo out before releasing the next update.
I’ll need a bit more to go on than that. I found some more detail in the instructions for adding a new app so I forked the metadata repository (the instructions didn’t say whether it should be private or public, but since “internal” access is disabled I left it as public), created a branch (using the app ID), and following the Build Metadata Reference doc updated com.xmission.trevin.android.todo.yml.
On the next step, the CI/CD build failed. It looks like the build script is using sdkmanager "platform-tools" "build-tools;31.0.0"; I don’t think that version is compatible with the code; I had compiled it locally with build tools version 25.0.3. The error at the end of the script was:
2025-03-06 01:21:22,768 DEBUG: > /opt/android-sdk/tools/android update lib-project -t android-23 -p .
Error: Target id 'android-23' is not valid. Use 'android list targets' to get the target ids.
2025-03-06 01:21:23,070 ERROR: Could not build app com.xmission.trevin.android.todo: Failed to update project at .
I didn’t see anything in the documentation about what the valid target ID’s are; I just updated the API value from the previous string “android-19”.
Wow, ten years. Please do add the GPL license file in your repo. And our requirements changed a lot. Binary jars in the repo is not allowed anymore. Please use mavenCentral instead. And your toolchain is also pretty old. Not as old as ant but gradle 3.5 is also very old. It requires jdk 8 but now jdk 17 is the default version.
The build still fails unfortunately, because this project needs Gradle 3.5 but that version of Gradle doesn’t work with Java 17; it needs Java 8.
Running /home/vagrant/.cache/fdroidserver/gradle/3.5/bin/gradle clean
FAILURE: Build failed with an exception.
* What went wrong:
Could not determine java version from '17.0.14'.
@linsui , the GPL license is currently located in doc/gpl-3.0.txt. The jars in libs are not dependencies of the app itself, but are for the android Gradle plugin (com.android.tools.build:gradle:2.3.3) since that plugin is not available in either Maven Central nor the Google repository and this version of the app won’t work with the newer build tools. In particular, the current version of Android Studio requires minSdkVersion ≥ 14 (Ice Cream) but my app was originally made to be compatible with a minimum SDK 8 (Froyo). I am working on changes to target the more recent API’s but it’s taking a significant amount of effort as there have been twenty(!) API updates since I last worked on the project, and I want to get at least one more Froyo-compatible version published before one that has to drop support for Honeycomb and earlier devices.
“Fastlane” looks like a lot of work; I’ll have to defer this for now.
Allowing the app to be installed on Android 14 was one of the reasons for the 1.2.1 update. The previous build of the app had a target SDK of 15, but Android 14 no longer allows installing apps with a target SDK lower than 23. So this update targets SDK 23 and implements the required changes to requesting permissions. I’ve tested it on Android 14, and it should also run on later versions; it just doesn’t take advantage of the newer API changes yet.
Thanks for the help with switching the JDK; the build is getting a little further this time. The new failure seems to be with parsing the local library directory.
2025-03-06 14:46:18,041 ERROR: Found unknown maven repo '${projectDir}/libs' at build.gradle
2025-03-06 14:46:18,043 INFO: Removing gradle-wrapper.jar at gradle/wrapper/gradle-wrapper.jar
2025-03-06 14:46:18,043 ERROR: Found Java JAR file at libs/org/antlr/antlr/3.5.2/antlr-3.5.2.jar
…
2025-03-06 14:46:18,082 ERROR: Found Java JAR file at libs/net/sf/kxml/kxml2/2.3.0/kxml2-2.3.0-sources.jar
2025-03-06 14:46:18,091 ERROR: Could not build app com.xmission.trevin.android.todo: Can't build due to 144 errors while scanning
I don’t know what’s different between the gradlew-fdroid clean script and what Android Studio 2.3.3 runs, but on my local machine it seems to recognize the local library directory. I’ll admit that I don’t know enough about Gradle to understand how that sholud be configured; this is the configuration for the top-level build.gradle file:
buildscript {
repositories {
maven {
url 'https://maven.google.com/'
}
mavenCentral()
flatDir {
dirs 'libs'
}
maven {
url uri("${projectDir}/libs")
// Local copy of old libraries was downloaded from:
// https://repository.axelor.com/nexus/service/rest/repository/browse/maven-public/
}
}
dependencies {
classpath 'com.android.tools.build:gradle:2.3.3'
}
}
As I recall, the flatDir part only works for jars that are directly located in the libs/ directory; the uri("$projectDir/libs") part is needed to keep the plugin libraries in a hierarchical directory structure.
Upgrading the Android Gradle plugin would also require upgrading Android Studio. I spent weeks trying to get a new development environment set up that would work with my old code, and IIRC went back to version 2.3.3 since that was the first major release that supported the target SDK I neded. I can try Studio 3.0, but that’s going to take at least another day or so to set up and check whether it works.
And I can’t keep up with 1–3 API changes every year when I have a full-time day job. It’s only because I’ve been out of regular work for a while that I’ve been able to get back to this.
Well, that only took a few hours to get Android Studio 3.0 installed and the app code updated accordingly. Unfortunately it still isn’t working in the CI/CD pipeline; it looks like gradle is downloading the plugin and maybe the code dependencies? But it doesn’t compile the code.
Download https://repo1.maven.org/maven2/javax/annotation/javax.annotation-api/1.2/javax.annotation-api-1.2.jar
Download https://repo1.maven.org/maven2/junit/junit/4.12/junit-4.12.jar
Download https://repo1.maven.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
Download https://maven.google.com/com/android/support/test/exposed-instrumentation-api-publish/0.5/exposed-instrumentation-api-publish-0.5.aar
:app:assembleRelease
BUILD SUCCESSFUL in 22s
24 actionable tasks: 24 executed
2025-03-06 19:58:19,089 DEBUG: Popen(['git', 'cat-file', '--batch-check'], cwd=/home/vagrant/build/com.xmission.trevin.android.todo, universal_newlines=False, shell=None, istream=<valid stream>)
2025-03-06 19:58:19,091 INFO: Successfully built version 1.2.2 of com.xmission.trevin.android.todo from 3bb18c6ceda549fe53a1dfa85f4c90ffc22502eb
2025-03-06 19:58:19,091 ERROR: Could not build app com.xmission.trevin.android.todo: Failed to find any output apks
2025-03-06 19:58:19,092 DEBUG: Error encountered, stopping by user request.
The new error seems to be some sort of mismatch between the apk generated in CI/CD and the one I uploaded to GitHub earlier today after checking the new build:
2025-03-06 21:29:14,915 DEBUG: tmp/binaries/com.xmission.trevin.android.todo_6.binary.apk: Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): false
Verified using v3 scheme (APK Signature Scheme v3): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
DOES NOT VERIFY
ERROR: SHA-1 digest of classes.dex does not match the digest specified in META-INF/MANIFEST.MF. Expected: <ZhDK4o7Tnd7dXkXRQm9JuJKgLug=>, actual: <TB6pGQIvNu0PV654Q/WASLkqlEU=>
ERROR: SHA-1 digest of res/drawable-hdpi-v4/abc_menu_hardkey_panel_mtrl_mult.9.png does not match the digest specified in META-INF/MANIFEST.MF. Expected: <eQAS8x6pJwm+nTZkgMjikuiBi24=>, actual: <hYMrgbTr/PmCKthwQQt0K9OlI8w=>
ERROR: SHA-1 digest of res/drawable-hdpi-v4/abc_popup_background_mtrl_mult.9.png does not match the digest specified in META-INF/MANIFEST.MF. Expected: <MDZFPFDOmtNQVw0NEY5OjQQahdg=>, actual: <0nGXIGkX9PVLNDsLZlnX6dsgd0Y=>
…
ERROR: SHA-1 digest of res/drawable/repeat_36.png does not match the digest specified in META-INF/MANIFEST.MF. Expected: <nMHrsnJW5yszYoXqXuZjcQd8Z1I=>, actual: <alrSBMZL/MaeFvppQOU9SdcdDsQ=>
2025-03-06 21:29:15,295 ERROR:
/tmp/tmpwoiobcb_/sigcp_com.xmission.trevin.android.todo_6.apk:
2025-03-06 21:29:15,295 INFO: ...NOT verified - /tmp/tmpwoiobcb_/sigcp_com.xmission.trevin.android.todo_6.apk
2025-03-06 21:29:15,409 DEBUG: > diff -r /tmp/tmpwoiobcb_/tmp_binaries_com.xmission.trevin.android.todo_6.binary /tmp/tmpwoiobcb_/_tmp_tmpwoiobcb__sigcp_com.xmission.trevin.android.todo_6
2025-03-06 21:29:15,611 WARNING: Keeping failed build "tmp/com.xmission.trevin.android.todo_6.apk"
2025-03-06 21:29:15,611 DEBUG: removing tmp/binaries/com.xmission.trevin.android.todo_6.binary.apk
2025-03-06 21:29:15,637 ERROR: Could not build app com.xmission.trevin.android.todo: compared built binary to supplied reference binary but failed
It looks like most of the errors have to do with icons, which doesn’t make much sense since those haven’t been touched in years. Would this have anything to do with the fact that I generated signed APK’s? Should I just remove the Binaries reference from the metadata?
I added the following build options based on what I read in the “Reproducible Builds” document:
android {
…
defaultConfig {
…
// This is needed to prevent generating PNG resources from
// vector drawables which results in a non-reproducible
// build. These may be coming from the appcompat library.
vectorDrawables.generatedDensities = []
}
buildTypes {
release {
// Minifying entails removing unused code and resources,
// obfuscating class names, and rewriting code.
minifyEnabled false
}
}
aaptOptions {
// This is needed to work around a reproducibility issue
// where PNG optimization does not provide deterministic output.
cruncherEnabled = false
}
…
}
and re-built my binary with both v1 and v2 signatures. (Android Studio 3.0 doesn’t have an option for v3.) Unfortunately this wasn’t sufficient.
2025-03-06 23:24:52,714 ERROR: Could not build app com.xmission.trevin.android.todo: compared built binary to supplied reference binary but failed
==== detail begin ====
signature copying failed: Unsupported create_version
Comparing reference APK to unsigned APK...
Unexpected diff output:
Only in /tmp/tmpcm9szs6h/tmp_binaries_com.xmission.trevin.android.todo_6.binary/content/META-INF: CERT.DSA
Only in /tmp/tmpcm9szs6h/tmp_binaries_com.xmission.trevin.android.todo_6.binary/content/META-INF: CERT.SF
diff -r /tmp/tmpcm9szs6h/tmp_binaries_com.xmission.trevin.android.todo_6.binary/content/META-INF/MANIFEST.MF /tmp/tmpcm9szs6h/tmp_com.xmission.trevin.android.todo_6/content/META-INF/MANIFEST.MF
5,1268d4
< Name: AndroidManifest.xml^M
< SHA1-Digest: MfC12HNnvhR+F86j4kPB7M1V2Tk=^M
< ^M
< Name: classes.dex^M
< SHA1-Digest: ZhDK4o7Tnd7dXkXRQm9JuJKgLug=^M
…
1005 more lines ...
==== detail end ====
2025-03-06 23:24:52,714 DEBUG: Error encountered, stopping by user request.
I downloaded the build artifact and found that the MANIFEST.MF generated on CI/CD doesn’t have any of these SHA1-Digests.
At this point I think I should just give up on using my own signed binaries.
After removing the Binaries reference from the metadata the build stage completed successfully. There were two failures in the test stage though:
fdroid lint says “These files have lint issues: metadata/com.xmission.trevin.android.todo.yml” and then shows a diff which only shows a few lines changing position, a change in quotes, and a change in whitespace. Why is this a lint error?
diff --git a/metadata/com.xmission.trevin.android.todo.yml b/metadata/com.xmission.trevin.android.todo.yml
index 28fe18d06..e52fc8eeb 100644
--- a/metadata/com.xmission.trevin.android.todo.yml
+++ b/metadata/com.xmission.trevin.android.todo.yml
@@ -1,7 +1,7 @@
Categories:
- Writing
-AuthorName: Trevin Beattie
License: GPL-3.0-only
+AuthorName: Trevin Beattie
WebSite: https://github.com/Typraeurion/Android-ToDo
SourceCode: https://github.com/Typraeurion/Android-ToDo
IssueTracker: https://github.com/Typraeurion/Android-ToDo/issues
@@ -11,7 +11,7 @@ Summary: Create checklists
Description: |-
A simple and intuitive To Do list based on the app
bundled with Palm Pilot, plus many other features:
-
+
• Entirely offline, requiring few permissions to run.
• Create any number of categories for different lists.
• Set alarms for items that are due or nearly due.
@@ -23,21 +23,20 @@ Description: |-
RepoType: git
Repo: https://github.com/Typraeurion/Android-ToDo.git
-#Binaries: https://github.com/Typraeurion/Android-ToDo/releases/download/v1.2.2/ToDo-1.2.2.apk
Builds:
- - versionName: '1.2.2'
+ - versionName: 1.2.2
versionCode: 6
commit: 967cbe92bee1c1785eb9f1f1bd2f29b59aadaaf4
- gradle:
- - yes
- target: android-23
subdir: app
sudo:
- echo "deb http://deb.debian.org/debian sid main" > /etc/apt/sources.list.d/sid.list
- apt-get update
- apt-get install -y -t sid openjdk-8-jdk-headless
- update-java-alternatives --set java-1.8.0-openjdk-amd64
+ gradle:
+ - yes
+ target: android-23
MaintainerNotes: |-
The 1.2.2 version has a minSdkVersion of 8 which requires the old 3.0
@@ -47,5 +46,5 @@ MaintainerNotes: |-
ArchivePolicy: 2
AutoUpdateMode: None
UpdateCheckMode: None
-CurrentVersion: '1.2.2'
+CurrentVersion: 1.2.2
lint appears to be complaining about image files containing EXIF, but it doesn’t list which images have EXIF in them.
$ find metadata/ -name '*.jp*g' -o -name '*.png' | xargs exiftool -all=
0 image files updated
79 image files unchanged
$ echo "these images have EXIF that must be stripped:"
these images have EXIF that must be stripped:
$ git --no-pager diff --stat
$ git --no-pager diff --name-only --exit-code || set_error
$ ./tools/check-localized-metadata.py || set_error
$ ./tools/check-keyalias-collision.py || set_error
$ ./tools/check-metadata-summary-whitespace.py || set_error
$ ./tools/check-for-unattached-signatures.py || set_error
$ ./tools/make-summary-translatable.py || set_error
ERROR
$ exit $EXITVALUE
In any event I used GIMP to scale and save all of the icons, which probably had “Save Exif data” enabled by default. I’ll have to go through all of the images to re-save them without it.
Unfortunately it still isn’t working in the CI/CD pipeline; it looks like gradle is downloading the plugin and maybe the code dependencies? But it doesn’t compile the code.
