From 1e07e36d5c6552f19fdccdf5e6b32f9638505e2a Mon Sep 17 00:00:00 2001
From: engineer <engineer@opencode.ai>
Date: Mon, 1 Jun 2026 15:00:59 -0700
Subject: [PATCH] fix(ci): pin androguard==4.1.4 for F-Droid publish (verified
 locally)

Reproduced locally against the v0.4.2 APK: androguard 4.0.x fails resource
parsing ('res1 must be zero!'), 4.1.0/4.1.1 fail signature parsing
('NoOverwriteDict' object has no attribute 'append'), and 4.1.4 parses both
cleanly. fdroidserver 2.4.4's own resolver pulls a buggy 4.1.x, so pin 4.1.4.
---
 .github/workflows/publish-fdroid.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish-fdroid.yml b/.github/workflows/publish-fdroid.yml
index 47be315..8a011e1 100644
--- a/.github/workflows/publish-fdroid.yml
+++ b/.github/workflows/publish-fdroid.yml
@@ -69,11 +69,12 @@ jobs:
         run: ./gradlew assembleRelease
 
       - name: Install fdroidserver
-        # Use latest fdroidserver (+ its tested androguard). Pinning fdroidserver
-        # 2.4.4 hit androguard parse bugs on modern aapt2 APKs: 4.1+ crashes with
-        # "'NoOverwriteDict' object has no attribute 'append'", 4.0.x with
-        # "res1 must be zero!". Latest fdroidserver ships a compatible androguard.
-        run: pip install --upgrade fdroidserver
+        # androguard version matters: 4.0.x crashes parsing our APK resources
+        # ("res1 must be zero!"); 4.1.0/4.1.1 crash on the signature block
+        # ("'NoOverwriteDict' object has no attribute 'append'"). androguard 4.1.4
+        # fixes both — verified locally against the v0.4.2 APK. fdroidserver's own
+        # resolver picks a buggy 4.1.x, so pin androguard explicitly.
+        run: pip install "fdroidserver==2.4.4" "androguard==4.1.4"
 
       - name: Setup F-Droid repo
         id: fdroid-setup