From 2aa6920fb1568249d2466fa1b13760d1a51c0e8f Mon Sep 17 00:00:00 2001
From: Lena <lena@omega>
Date: Wed, 1 Jul 2026 00:00:00 +0000
Subject: ci: pin toolchains and verify release artifacts

Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.
---
 README | 36 +++++++++++++++++++++++++-----------
 1 file changed, 25 insertions(+), 11 deletions(-)

(limited to 'README')

diff --git a/README b/README
index a77e3df..2f321c9 100644
--- a/README
+++ b/README
@@ -30,21 +30,35 @@ Layout
 
 Build
 -----
-The repository is self-contained: clone it and the build fetches and pins
-everything else from source. The only host prerequisites are a POSIX shell,
-curl, python3, tar, and git. The toolchain (JDK, Go, Android SDK and NDK,
-Gradle) and the rsync source are downloaded and version-pinned by the build
-(see versions for every pin).
+The repository is self-contained: clone it and the build fetches everything
+else. The host prerequisites are a POSIX shell, coreutils, make, curl, python3,
+tar, and git. The toolchain archives and rsync source are version- and
+checksum-pinned by the build (see versions for every pin).
 
     make setup                    # provision the toolchain into $HOME/toolchains
     . "$HOME/toolchains/env.sh"    # put it on PATH (do this in each shell)
     make                          # rsync (NDK) -> rsh (Go) -> APK
-    make test                     # Go tests plus the host-side end-to-end push
-    make verify-repro             # build twice, diff the artifacts
-
-The APK lands under app/build/outputs/apk/. It is unsigned by default; signing
-config is local and gitignored. Continuous integration runs the same scripts:
-ci/setup-toolchain.sh then ci/build.sh and ci/test.sh.
+    make test                     # Go, real-rsync integration, and Kotlin tests
+    make verify-repro             # build twice, compare the unsigned APKs
+
+`make test` also requires host rsync. The APK lands under
+app/build/outputs/apk/. It is unsigned by default and cannot be installed until
+signed. Continuous integration runs the same scripts: ci/setup-toolchain.sh,
+ci/build.sh, and ci/test.sh.
+
+For a locally installable APK, create a keystore and a gitignored
+keystore.properties before building:
+
+    keytool -genkeypair -keystore rsend.jks -alias rsend -keyalg EC -validity 3650
+    cat > keystore.properties <<EOF
+    storeFile=rsend.jks
+    storePassword=change-me
+    keyAlias=rsend
+    keyPassword=change-me
+    EOF
+
+Keep both files private and backed up. The signed output is
+app/build/outputs/apk/release/app-release.apk.
 
 
 Run
-- 
cgit v1.2.3