xieyao/opencode-mobile
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
2b9b571d6e4a9fabb580df5711b8f158dbb3acc5
opencode-mobile/distribution/izzyondroid-submission/SUBMISSION-CHECKLIST.md
Den 2b9b571d6e feat(privacy+dist): telemetry consent gate + app store distribution prep (#4) 
* fix(security): fail closed on biometric init error

H-03: setting isAuthenticated: true on initialization failure was a
security bypass — any crash during biometric setup granted full access.
Fail closed instead; user sees auth prompt on next open.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(security): use Crypto.randomUUID for connection IDs

H-04: Math.random() is not cryptographically random. Connection IDs are
used as SecureStore key suffixes; switch to expo-crypto randomUUID for
a secure source.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(deps): pin expo-crypto to ~15.0.9

15.0.10 does not exist on npm; ~15.0.9 is the latest stable in the 15.x series compatible with Expo SDK 54.

* feat: add OpenCode Connect coming-soon waitlist card

Adds a discoverable 'OpenCode Connect — Coming Soon' card to the
add-connection quick-connect screen. Users can enter their email and
tap 'Join Waitlist' to send a pre-filled mailto. No backend required.

* fix(cua): detect actual screen dimensions and fix JSON parsing

- Get real screen size via `wm size` instead of hardcoding 1080x2400;
  emulator is 1080x1920 so y-coordinates were systematically off
- Extract first JSON object via regex when model returns multiple objects
- Use AZURE_OPENAI_MODEL env var for deployment name (defaults gpt-5.4)
- Add AZURE_DEV_AI_* path for Azure AI Foundry endpoints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(security): SHA-pin upload-google-play and sanitize notification bodies

M-02: Pin r0adkll/upload-google-play to commit SHA e738b9d (v1.1.5)
to prevent supply-chain hijack via tag mutation.

M-03: Sanitize all push notification bodies — strip control chars,
truncate to 200 chars. Prevents server-supplied strings (error messages,
file paths from permission patterns, session titles) from leaking
unbounded text into the OS notification drawer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(privacy): add telemetry consent gate for Sentry crash reporting

Sentry was always-on, violating F-Droid anti-feature policy and user
trust norms. Now gated behind explicit opt-in:

- First-launch consent modal (TelemetryConsentModal) shows once on
  fresh install; user can Allow or Decline.
- Consent state persisted in expo-secure-store (survives restarts).
- Settings > Privacy section: crash reporting toggle + privacy policy link.
- initSentry() called only after consent granted — not on app start.

Closes #3 (partial)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(config): add real icons and complete iOS/Android app.json config

- Add 1024×1024 app icon, 432×432 adaptive icon foreground, 200×200 splash
- iOS: push notification entitlement (aps-environment: production), speech/
  microphone/camera/photo usage descriptions for future features, disable
  ITSAppUsesNonExemptEncryption
- Android: adaptive icon with dark background (#0F172A), versionCode: 1
- expo-notifications plugin wired in app.json

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(dist): add iOS CI workflow, README rewrite, CONTRIBUTING, and LICENSE

- publish-app-store.yml: EAS Build + TestFlight submission; runs on tag/release/
  workflow_dispatch; bumps ios.buildNumber from github.run_number
- README: full rewrite — features, install badges, connection guide, contributing
- CONTRIBUTING.md: contribution guide for OSS contributors
- LICENSE: MIT

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs(dist): add store listings, strategy, privacy policy, F-Droid/IzzyOnDroid templates

- distribution/strategy.md: monetization strategy (free client + opencode Cloud)
- distribution/play-listing.md: Google Play store copy (name, description, tags)
- distribution/app-store-listing.md: App Store listing copy
- distribution/privacy-policy.{md,html}: GDPR-compliant privacy policy
- distribution/PLAY_CONSOLE_SETUP.md: Play Console setup runbook
- distribution/ios-enrollment-runbook.md: Apple Developer Program enrollment steps
- distribution/SIGNING-KEY-FINGERPRINTS.md: keystore fingerprint for reproducible builds
- distribution/fdroid-submission/: F-Droid metadata template
- distribution/izzyondroid-submission/: IzzyOnDroid submission template
- distribution/whatsnew/: Play Store release notes (en-US)
- distribution/whatsnew-ios/: TestFlight release notes
- distribution/play-graphics/: Play Store screenshot placeholders
- distribution/app-store-graphics/: App Store screenshot placeholders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(telemetry): handle SecureStore failure + Android back button

- add .catch() on loadTelemetryConsent() so SecureStore rejection
  shows the consent modal instead of blocking startup forever
- add onRequestClose={onDecline} to Modal so Android back button
  records the decline rather than silently dismissing
- fix catch block in telemetry.ts to not clobber _resolved when
  SecureStore read fails mid-session

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): run gradlew clean to prevent stale modules.json duplicate

Sentry Gradle plugin writes modules.json to src/main/assets; cached
build intermediates contain an old copy → mergeReleaseAssets fails
with 'Duplicate resources'. Running clean before assembleRelease
clears the intermediate state.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): remove android build output cache causing duplicate modules.json

Caching android/app/build/intermediates and android/app/.cxx causes
two issues:
1. Stale modules.json in intermediates → Duplicate resources error
2. .cxx CMake artifacts reference absolute paths → ninja clean fails

Keeping only Gradle distribution cache (~/.gradle) which is safe.
Expo prebuild regenerates android sources fresh each run anyway.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-25 17:42:03 -07:00

113 lines
3.6 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# IzzyOnDroid Submission Checklist
Step-by-step guide to file the inclusion request for `ai.opencode.mobile`
in the IzzyOnDroid F-Droid repository.
IzzyOnDroid is the fastest OSS distribution channel — typical inclusion is
1–3 days after filing. It serves pre-built APKs directly from GitHub releases.
**Pre-condition: a signed APK must be attached to a GitHub release tag before filing.**
---
## Prerequisites
- [ ] Signed release APK (not AAB) exists and is attached to a GitHub tag
(e.g. `https://github.com/dzianisv/opencode-mobile/releases/tag/v0.2.4`)
- [ ] APK is signed with `keystores/production-release.jks`
- [ ] SHA-256 fingerprint confirmed: see `distribution/SIGNING-KEY-FINGERPRINTS.md`
- [ ] Sentry opt-in gate is in production (avoids `Tracking` anti-feature escalation)
- [ ] Privacy policy is live at `https://opencode.vibebrowser.app/privacy`
- [ ] `app.json` `version` and `android.versionCode` are set correctly in the tagged commit
---
## Step 1 — Attach APK to GitHub release
The CI workflow currently builds an AAB (for Play Store). For IzzyOnDroid and
F-Droid you need a **universal APK**.
Option A — Convert AAB to universal APK with bundletool:
```bash
bundletool build-apks \
--bundle=android/app/build/outputs/bundle/release/app-release.aab \
--output=apks.apks \
--mode=universal \
--ks=keystores/production-release.jks \
--ks-pass=pass:<STOREPASS> \
--ks-key-alias=<KEY_ALIAS> \
--key-pass=pass:<KEY_PASS>
unzip apks.apks universal.apk -d apk-out/
# Resulting APK: apk-out/universal.apk → rename to app-release.apk
```
Option B — Add `assembleRelease` to CI alongside `bundleRelease`, then
attach the resulting `app-release.apk` to the GitHub release artifact.
Whichever option, attach the `.apk` file to the GitHub release created by the
release tag.
---
## Step 2 — Verify the APK
```bash
# Confirm package id and version
aapt dump badging apk-out/universal.apk | grep -E "package:|versionCode|versionName"
# Expected:
# package: name='ai.opencode.mobile' versionCode='<N>' versionName='<X.Y.Z>'
# Confirm signing fingerprint matches distribution/SIGNING-KEY-FINGERPRINTS.md
apksigner verify --print-certs apk-out/universal.apk | grep SHA-256
```
---
## Step 3 — Create a Codeberg account (if needed)
IzzyOnDroid issues are hosted on Codeberg (not GitHub).
URL: https://codeberg.org
Register or log in at https://codeberg.org/user/sign_up
---
## Step 4 — File the inclusion issue
1. Go to https://codeberg.org/IzzyOnDroid/repodata/issues
2. Click "New Issue"
3. Title: `Include ai.opencode.mobile (OpenCode Mobile)`
4. Body: paste the content from `distribution/izzyondroid-submission/INCLUSION-REQUEST.md`
(with all `<PLACEHOLDER>` values replaced)
5. Submit
---
## Step 5 — Monitor and respond
- IzzyOnDroid maintainers typically respond within 1–3 days.
- Common requests:
- Confirm APK URL pattern resolves correctly
- Confirm signing key fingerprint via `apksigner` output
- Clarification on anti-features
- Once accepted, the app appears in the next IzzyOnDroid index build (usually within 24h).
---
## Step 6 — After acceptance
- Add the IzzyOnDroid badge to `README.md`
- Update `distribution/strategy.md` status row for IzzyOnDroid to "live"
- Update `docs/fdroid.md` with inclusion date
- When mainline F-Droid MR is later accepted, comment on this issue:
"Mainline F-Droid has accepted ai.opencode.mobile — please auto-delist per policy."
---
## Reference
- IzzyOnDroid inclusion policy: https://apt.izzysoft.de/fdroid/index/info
- Codeberg issues: https://codeberg.org/IzzyOnDroid/repodata/issues
- IzzyOnDroid repo (for badge URLs): https://apt.izzysoft.de/fdroid/index/apk/ai.opencode.mobile
Reference in New Issue View Git Blame Copy Permalink