From c66f4fb8589e1d4aba668e58679cad2b6ede730f Mon Sep 17 00:00:00 2001
From: engineer <engineer@opencode.ai>
Date: Tue, 2 Jun 2026 00:58:41 -0700
Subject: [PATCH] =?UTF-8?q?release(fdroid):=20v0.4.3=20=E2=80=94=20fix=20s?=
 =?UTF-8?q?elf-hosted=20F-Droid=20publish=20(v2-only=20signing)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The self-hosted F-Droid repo (https://dzianisv.github.io/opencode-mobile/fdroid/repo)
has been stuck at v0.4.1 because publish-fdroid crashed in androguard parsing the
CI APK's v2+v3 signature block pair ('NoOverwriteDict' object has no attribute
'append'). Force v1+v2-only signing: gradle flags for local builds, plus a
deterministic apksigner re-sign step in the workflow (expo prebuild regenerates
build.gradle, so the workflow step is the real guarantee). Bump to v0.4.3 /
versionCode 5 so a fresh tag re-runs the publish with the verified bug fixes
(#10 scope fixes, send-error fix) included.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/publish-fdroid.yml | 23 +++++++++++++++++++++++
 android/app/build.gradle             | 14 ++++++++++++--
 app.json                             |  4 ++--
 package.json                         |  2 +-
 4 files changed, 38 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish-fdroid.yml b/.github/workflows/publish-fdroid.yml
index 8a011e1..9d88f34 100644
--- a/.github/workflows/publish-fdroid.yml
+++ b/.github/workflows/publish-fdroid.yml
@@ -68,6 +68,29 @@ jobs:
         working-directory: android
         run: ./gradlew assembleRelease
 
+      - name: Re-sign APK v1+v2 only (drop v3/v4 for fdroidserver compatibility)
+        if: ${{ env.RELEASE_STORE_FILE != '' }}
+        run: |
+          # androguard (used by fdroidserver) crashes parsing a v2+v3 signature
+          # block pair: "'NoOverwriteDict' object has no attribute 'append'".
+          # expo prebuild regenerates build.gradle, so we can't rely on the
+          # gradle signing flags surviving — force v1+v2-only here deterministically.
+          APK=android/app/build/outputs/apk/release/app-release.apk
+          APKSIGNER=$(ls "$ANDROID_HOME"/build-tools/*/apksigner | sort -V | tail -1)
+          echo "Using $APKSIGNER"
+          "$APKSIGNER" sign \
+            --ks android/app/release.keystore \
+            --ks-pass "pass:${RELEASE_STORE_PASSWORD}" \
+            --ks-key-alias "${RELEASE_KEY_ALIAS}" \
+            --key-pass "pass:${RELEASE_KEY_PASSWORD}" \
+            --v1-signing-enabled true \
+            --v2-signing-enabled true \
+            --v3-signing-enabled false \
+            --v4-signing-enabled false \
+            "$APK"
+          echo "=== signature schemes after re-sign ==="
+          "$APKSIGNER" verify -v "$APK" | grep -i "Verified using" || true
+
       - name: Install fdroidserver
         # androguard version matters: 4.0.x crashes parsing our APK resources
         # ("res1 must be zero!"); 4.1.0/4.1.1 crash on the signature block
diff --git a/android/app/build.gradle b/android/app/build.gradle
index d9e970f..ef94fbd 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -94,8 +94,8 @@ android {
         applicationId 'cc.agentlabs.opencode'
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 4
-        versionName "0.4.2"
+        versionCode 5
+        versionName "0.4.3"
 
         buildConfigField "String", "REACT_NATIVE_RELEASE_LEVEL", "\"${findProperty('reactNativeReleaseLevel') ?: 'stable'}\""
     }
@@ -112,6 +112,16 @@ android {
                 storePassword System.getenv("RELEASE_STORE_PASSWORD")
                 keyAlias System.getenv("RELEASE_KEY_ALIAS")
                 keyPassword System.getenv("RELEASE_KEY_PASSWORD")
+                // Sign with v1+v2 only. A v2+v3 block pair crashes the androguard
+                // version fdroidserver uses ("'NoOverwriteDict' object has no
+                // attribute 'append'"), which broke the self-hosted F-Droid repo
+                // publish from v0.4.2 on. v1+v2 installs on all supported API levels
+                // and matches the known-good published APK. Re-enable v3 only once
+                // fdroidserver/androguard ships the fix.
+                enableV1Signing true
+                enableV2Signing true
+                enableV3Signing false
+                enableV4Signing false
             }
         }
     }
diff --git a/app.json b/app.json
index 8e9a56f..58a12e2 100644
--- a/app.json
+++ b/app.json
@@ -2,7 +2,7 @@
   "expo": {
     "name": "OpenCode",
     "slug": "opencode-mobile",
-    "version": "0.4.2",
+    "version": "0.4.3",
     "orientation": "portrait",
     "scheme": "opencode",
     "userInterfaceStyle": "automatic",
@@ -34,7 +34,7 @@
     },
     "android": {
       "package": "cc.agentlabs.opencode",
-      "versionCode": 4,
+      "versionCode": 5,
       "usesCleartextTraffic": true,
       "adaptiveIcon": {
         "foregroundImage": "./assets/adaptive-icon.png",
diff --git a/package.json b/package.json
index fdd0697..c758eb3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opencode-ai/mobile",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "private": true,
   "main": "expo-router/entry",
   "scripts": {