From 0cef3657bc1a3437b23eab5320f90cad046c18ef Mon Sep 17 00:00:00 2001
From: austinried <4966622+austinried@users.noreply.github.com>
Date: Fri, 9 Oct 2026 13:34:38 +0000
Subject: [PATCH] build: make the release APK reproducible

AGP's dependency-metadata signing block (0x504b4453) is encrypted per
build, so two otherwise byte-identical release APKs differed in that
block. Disable it in the APK with dependenciesInfo.includeInApk = false;
the bundle keeps its copy for Play.
---
 app/build.gradle.kts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 137b8ad6..732b75b2 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -36,6 +36,12 @@ android {
         generateLocaleConfig = true
     }
 
+    dependenciesInfo {
+        // The APK signing-block copy is encrypted per build, breaking APK reproducibility, and
+        // F-Droid rejects it; the bundle keeps its copy for Play.
+        includeInApk = false
+    }
+
     compileOptions {
         sourceCompatibility = JavaVersion.VERSION_17
         targetCompatibility = JavaVersion.VERSION_17