build: pin and verify release inputs

Support Alpine/musl and Debian/glibc hosts, lock downloaded and
Gradle artifacts, and verify native and APK security properties.

1 files changed, 22 insertions, 11 deletions

diff --git a/versions b/versions
index f6b2f7b..3c2d837 100644
--- a/versions
+++ b/versions
@@ -3,6 +3,11 @@
 # Sourced by the build scripts (POSIX sh: . ./versions) and mirrored by the
 # F-Droid recipe. Keep builds reproducible: bump deliberately, never float.
 
+# App release identity. Bump both together; the release's changelog file is
+# fastlane/metadata/android/en-US/changelogs/${APP_VERSION_CODE}.txt.
+APP_VERSION=0.1.3
+APP_VERSION_CODE=4
+
 # Native rsync, built from source via the Android NDK. The tarball sha256 lives
 # in rsync/rsync-${RSYNC_VERSION}.tar.gz.sha256, which the build verifies.
 RSYNC_VERSION=3.5.0
@@ -11,31 +16,37 @@ RSYNC_URL=https://download.samba.org/pub/rsync/src/rsync-${RSYNC_VERSION}.tar.gz
 # Go SSH transport (rsh). Matches the go.mod go directive.
 GO_VERSION=1.26.6
 GO_SHA256=708effb774be8237570d0add163225abbdfaf4fca28b2611df167beba4feef89
+GOVULNCHECK_VERSION=1.6.0
 X_CRYPTO_VERSION=0.54.0
 X_SYS_VERSION=0.47.0
 
 # Android toolchain. ANDROID_NDK is the sdkmanager package revision.
-# JDK_RELEASE is the exact Temurin GA build; JDK_VERSION its major.
+# JDK_RELEASE is the exact Temurin GA build.
 ANDROID_NDK=27.2.12479018
-ANDROID_CMDLINE_TOOLS=11076708
+# Keep this portable Java SDK manager release. The tested newer native Android
+# CLI does not run on supported musl hosts.
+ANDROID_CMDLINE_TOOLS=13114758
 ANDROID_BUILD_TOOLS=35.0.0
 ANDROID_PLATFORM=35
+ANDROID_PLATFORM_REVISION=2
+ANDROID_PLATFORM_JAR_SHA256=4566663c3876e022b4fa4ced8c8697c4ab1688267f090114fd92d027b32e619b
 ANDROID_MIN_SDK=30
 ANDROID_TARGET_SDK=35
 AGP_VERSION=8.7.3
 GRADLE_VERSION=8.9
-KOTLIN_VERSION=2.0.21
-ANDROIDX_CORE_VERSION=1.13.1
-ANDROIDX_APPCOMPAT_VERSION=1.7.0
-ANDROIDX_WORK_VERSION=2.10.0
+KOTLIN_VERSION=2.3.20
+ANDROIDX_CORE_VERSION=1.16.0
+ANDROIDX_APPCOMPAT_VERSION=1.7.1
+ANDROIDX_WORK_VERSION=2.11.2
 JUNIT_VERSION=4.13.2
 JSON_VERSION=20240303
-JDK_VERSION=17
 JDK_RELEASE=17.0.19+10
-JDK_SHA256=d8afc263758141a66e0e3aafc321e783f7016696f4eaea067d340a269037d331
-ANDROID_CMDLINE_TOOLS_SHA256=2d2d50857e4eb553af5a6dc3ad507a17adf43d115264b1afc116f95c92e5e258
+JDK_GLIBC_SHA256=d8afc263758141a66e0e3aafc321e783f7016696f4eaea067d340a269037d331
+JDK_MUSL_SHA256=960b4090b75a887bb21a915a294bee3a97cd11876967c95e5bd29d9ec4812e17
+ANDROID_CMDLINE_TOOLS_SHA256=7ec965280a073311c339e571cd5de778b9975026cfcbe79f2b1cdcb1e15317ee
 GRADLE_SHA256=d725d707bfabd4dfdc958c624003b3c80accc03f7037b5122c4b1d0ef15cecab
 
-# Native ABIs to build. arm64-v8a ships on the phone; x86_64 is for host and
-# emulator tests. Add armeabi-v7a to support 32-bit phones.
+# Native ABIs to build, and to ship in the APK. arm64-v8a is every current
+# phone; x86_64 covers x86 Android devices and the emulator. Add armeabi-v7a to
+# support 32-bit phones. Keep this in step with abiFilters in app/build.gradle.
 ABIS="arm64-v8a x86_64"