From 2aa6920fb1568249d2466fa1b13760d1a51c0e8f Mon Sep 17 00:00:00 2001
From: Lena <lena@omega>
Date: Wed, 1 Jul 2026 00:00:00 +0000
Subject: ci: pin toolchains and verify release artifacts

Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.
---
 versions | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'versions')

diff --git a/versions b/versions
index ad2e9ca..a778bb9 100644
--- a/versions
+++ b/versions
@@ -10,6 +10,7 @@ RSYNC_URL=https://download.samba.org/pub/rsync/src/rsync-${RSYNC_VERSION}.tar.gz
 
 # Go SSH transport (rsh). Matches the go.mod go directive; x/crypto needs 1.25+.
 GO_VERSION=1.25.0
+GO_SHA256=2852af0cb20a13139b3448992e69b868e50ed0f8a1e5940ee1de9e19a123b613
 
 # Android toolchain. ANDROID_NDK is the sdkmanager package revision.
 # JDK_RELEASE is the exact Temurin GA build; JDK_VERSION its major.
@@ -22,8 +23,16 @@ ANDROID_TARGET_SDK=35
 AGP_VERSION=8.7.3
 GRADLE_VERSION=8.9
 KOTLIN_VERSION=2.0.21
+ANDROIDX_CORE_VERSION=1.13.1
+ANDROIDX_APPCOMPAT_VERSION=1.7.0
+ANDROIDX_WORK_VERSION=2.10.0
+JUNIT_VERSION=4.13.2
+JSON_VERSION=20240303
 JDK_VERSION=17
 JDK_RELEASE=17.0.19+10
+JDK_SHA256=d8afc263758141a66e0e3aafc321e783f7016696f4eaea067d340a269037d331
+ANDROID_CMDLINE_TOOLS_SHA256=2d2d50857e4eb553af5a6dc3ad507a17adf43d115264b1afc116f95c92e5e258
+GRADLE_SHA256=d725d707bfabd4dfdc958c624003b3c80accc03f7037b5122c4b1d0ef15cecab
 
 # Native ABIs to build. arm64-v8a ships on the phone; x86_64 is for host and
 # emulator tests. Add armeabi-v7a to support 32-bit phones.
-- 
cgit v1.2.3