android/rsend/metadata, branch 0.2.1 [no description] doc: correct drift and move the build notes to the root 2026-08-23T00:00:00+00:00 Lena lena@omega 2026-08-23T00:00:00+00:00 780d3167a427d6964806694ef5282be0c6f4cd33 The Rsync comment about draining a hostile remote's pipe sat on the Tally type, where it means nothing; it describes boundedLines. Scheduler explained itself with what happened during development instead of the constraint that WorkManager persists unique names across upgrades, and MainActivity and SyncLog did the same. Keys pointed at a pin() that does not exist. The App header restated the class name and omitted half of what onCreate does. OUT_FORMAT had no caller outside its file. The README layout list omitted fastlane. The e2e test hardcodes a copy of the app's rsync vector with nothing saying so. useradd already writes a locked password field, so "skip passwd -l" does not leave a non-locked one and key auth is still refused; verified against sshd with UsePAM no. The CI file also runs verify-repro on a tag, and the NDK and build-tools are pinned by revision and verified against Google's manifest rather than a checksum this repository owns, which the reproducibility notes claimed for every input. metadata/ held one document and nothing else, and reads as a store metadata directory beside fastlane/metadata. Root, extensionless, beside THIRD_PARTY. 
The Rsync comment about draining a hostile remote's pipe sat on the
Tally type, where it means nothing; it describes boundedLines. Scheduler
explained itself with what happened during development instead of the
constraint that WorkManager persists unique names across upgrades, and
MainActivity and SyncLog did the same. Keys pointed at a pin() that does
not exist. The App header restated the class name and omitted half of
what onCreate does. OUT_FORMAT had no caller outside its file.

The README layout list omitted fastlane. The e2e test hardcodes a copy
of the app's rsync vector with nothing saying so. useradd already writes
a locked password field, so "skip passwd -l" does not leave a non-locked
one and key auth is still refused; verified against sshd with UsePAM no.
The CI file also runs verify-repro on a tag, and the NDK and build-tools
are pinned by revision and verified against Google's manifest rather
than a checksum this repository owns, which the reproducibility notes
claimed for every input.

metadata/ held one document and nothing else, and reads as a store
metadata directory beside fastlane/metadata. Root, extensionless,
beside THIRD_PARTY.
app: release 0.2.0 2026-08-16T00:00:00+00:00 Lena lena@omega 2026-08-16T00:00:00+00:00 6578dc47a7d1f7946528e9540d9cfa2e9a5d88d2 Document the multi-remote release, publish matching store metadata, and advance the version once from the released 0.1.3 base. 
Document the multi-remote release, publish matching store metadata,
and advance the version once from the released 0.1.3 base.
ci: pin toolchains and verify release artifacts 2026-07-13T22:00:29+00:00 Lena lena@omega 2026-07-01T00:00:00+00:00 2aa6920fb1568249d2466fa1b13760d1a51c0e8f Checksum-pin every downloaded toolchain archive. Before publishing, verify the APK was built from HEAD, the tag matches versionName, apksigner passes, and the tree is clean; publish a sha256 sidecar and treat published assets as immutable. Compare full unsigned APKs in verify-repro and run the Android unit tests in CI. 
Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.
ci: fail when gradle pins drift from versions 2026-07-01T00:00:00+00:00 Lena lena@omega 2026-07-01T00:00:00+00:00 80a4a209d63e55ff09c7f31b59358bfe56b055b4 The gradle files and go.mod repeat pins from versions because gradle cannot source a shell file. Compare them in ci/test.sh so a bump that misses a copy fails loud instead of silently building with the old version. 
The gradle files and go.mod repeat pins from versions because gradle
cannot source a shell file. Compare them in ci/test.sh so a bump that
misses a copy fails loud instead of silently building with the old
version.
rsend: push phone folders to a home SSH host over rsync 2026-01-01T00:00:00+00:00 Lena lena@omega 2026-01-01T00:00:00+00:00 7e04941bccb2683f8a6e3ee38a99c50129234dd1 A small Android app for one-way folder backup, a KISS alternative to Syncthing. It bundles rsync (built from pinned source via the NDK) and a pure-Go SSH transport, both shipped in the APK as lib*.so and run from the native library directory. rsend pins the host key, stores the ed25519 identity Keystore-encrypted, pushes each folder additively or as a mirror, and runs on demand or on a WiFi-only schedule. The build is self-contained and reproducible: make setup provisions the toolchain, make builds rsync, rsh, and the APK. 
A small Android app for one-way folder backup, a KISS alternative to
Syncthing. It bundles rsync (built from pinned source via the NDK) and
a pure-Go SSH transport, both shipped in the APK as lib*.so and run from
the native library directory.

rsend pins the host key, stores the ed25519 identity Keystore-encrypted,
pushes each folder additively or as a mirror, and runs on demand or on a
WiFi-only schedule. The build is self-contained and reproducible: make
setup provisions the toolchain, make builds rsync, rsh, and the APK.