build: pin and verify release inputs

Support Alpine/musl and Debian/glibc hosts, lock downloaded and
Gradle artifacts, and verify native and APK security properties.

1 files changed, 33 insertions, 3 deletions

diff --git a/app/build.gradle b/app/build.gradle
index 4198751..df41dc5 100644
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -45,6 +45,12 @@ android {
     buildTypes {
         release {
             minifyEnabled false
+            // Do not stamp the git revision into the APK. It makes two builds
+            // of the same source differ by checkout state, which is exactly
+            // what reproducible-build verification is supposed to detect.
+            vcsInfo {
+                include false
+            }
             if (keystoreProps.exists()) {
                 signingConfig signingConfigs.release
             }
@@ -68,6 +74,8 @@ android {
     packaging {
         jniLibs {
             useLegacyPackaging true
+            // Native build scripts already strip these PIE executables.
+            keepDebugSymbols += ['**/libxrsync.so', '**/libxrsh.so']
         }
     }
 
@@ -76,12 +84,34 @@ android {
         includeInApk false
         includeInBundle false
     }
+
+    lint {
+        warningsAsErrors true
+        // rsend is deliberately English-only. Keeping short operational text
+        // beside the behavior is clearer than a large indirection table.
+        disable 'HardcodedText', 'SetTextI18n'
+        // These two checks enforce Google Play policy; rsend targets F-Droid
+        // and sideloading, and both permissions are core to unattended sync.
+        disable 'BatteryLife', 'ScopedStorage'
+        // Core 1.17+ requires a different platform and AGP toolchain. The pin
+        // below is the newest version compatible with this release's stack.
+        disable 'GradleDependency'
+        // OldTargetApi fires the moment Google publishes a newer SDK, against
+        // a targetSdk this repo pins deliberately in ./versions and enforces
+        // in ci/test.sh. With warningsAsErrors that turns the calendar into a
+        // build break: the same commit passes today and fails next quarter,
+        // which is the opposite of what every other pin here exists for.
+        // Bumping the target is a deliberate, tested change, not lint's call.
+        disable 'OldTargetApi'
+    }
 }
 
 dependencies {
-    implementation 'androidx.core:core-ktx:1.13.1'
-    implementation 'androidx.appcompat:appcompat:1.7.0'
-    implementation 'androidx.work:work-runtime-ktx:2.10.0'
+    // 1.16.0 is the newest Core release supported by the pinned API 35 and
+    // AGP 8.7 toolchain. Core 1.17+ requires a newer platform and AGP.
+    implementation 'androidx.core:core-ktx:1.16.0'
+    implementation 'androidx.appcompat:appcompat:1.7.1'
+    implementation 'androidx.work:work-runtime:2.11.2'
 
     // The real org.json shadows the android.jar stub so JSON tests run on the JVM.
     testImplementation 'junit:junit:4.13.2'