Point recipe at v1.0.3 (clean signing block, verified reproducible)

Author: kisst

docs/fdroid-metadata/README.md

@@ -18,24 +18,24 @@ signature onto it and publishes that. This way Obtainium users (who installed
 the GitHub APK) and F-Droid users share one signing key, so updates flow between
 them without an uninstall/reinstall.
 
-- `commit: v1.0.2` pins the build to the release tag. The app version lives as
-  inline literals in `app/build.gradle.kts` (`versionCode = 10002`,
-  `versionName = "1.0.2"`), written by `release.sh` at release time. They are
+- `commit: v1.0.3` pins the build to the release tag. The app version lives as
+  inline literals in `app/build.gradle.kts` (`versionCode = 10003`,
+  `versionName = "1.0.3"`), written by `release.sh` at release time. They are
   literals, not computed, so F-Droid's static `checkupdates` can read them;
   versionCode follows `MAJOR*10000 + MINOR*100 + PATCH`, monotonic as F-Droid
   requires.
 - `Binaries: .../releases/download/v%v/link-clear-v%v.apk` points F-Droid at the
   developer-published APK to reproduce. `%v` expands to the versionName, which
-  equals the tag (`v1.0.2`), so it resolves to
-  `link-clear-v1.0.2.apk` — the exact asset the release workflow uploads.
+  equals the tag (`v1.0.3`), so it resolves to
+  `link-clear-v1.0.3.apk` — the exact asset the release workflow uploads.
 - `AllowedAPKSigningKeys: 7e489f6b…057e` is the SHA-256 of this project's release
   signing certificate. **Verified against the actual published
-  `link-clear-v1.0.2.apk`** with
+  `link-clear-v1.0.3.apk`** with
   `apksigner verify --print-certs` (the APK is signed with the v2 scheme only).
   F-Droid will only publish the developer signature if the rebuilt APK matches
   and carries this key.
 - `AutoUpdateMode: Version` — because the tag and `versionName` agree
-  (`v1.0.2` <-> `1.0.2`), F-Droid auto-detects the tag pattern with no template
+  (`v1.0.3` <-> `1.0.3`), F-Droid auto-detects the tag pattern with no template
   needed. (A literal `Version v%v` is rejected by F-Droid's `check-jsonschema`
   step, whose `AutoUpdateMode` pattern only allows an optional `+`-prefixed
   suffix — bare `Version` is the correct value here.)
@@ -46,11 +46,11 @@ them without an uninstall/reinstall.
 ### Reproducibility — verified locally, not assumed
 
 Path 2 only succeeds if F-Droid's from-source rebuild is byte-identical to the
-published APK before signing. This has been **verified for `v1.0.2`**: a fresh
-`git clone` + `git checkout v1.0.2` built unsigned with the repo toolchain
+published APK before signing. This has been **verified for `v1.0.3`**: a fresh
+`git clone` + `git checkout v1.0.3` built unsigned with the repo toolchain
 (OpenJDK 17.0.20, Gradle 8.14.4, AGP 8.6.1, build-tools 35.0.0) is byte-for-byte
-identical to the published `link-clear-v1.0.2.apk` across the entire ZIP
-entries region (SHA-256 `c6236e79…a78a`) and central directory. The only
+identical to the published `link-clear-v1.0.3.apk` across the entire ZIP
+entries region (SHA-256 `360b4c36…045c`) and central directory. The only
 difference is the 8192-byte v2 APK Signing Block — exactly the region F-Droid
 strips and reattaches the developer signature to.
 
@@ -61,7 +61,7 @@ Reproduce the check yourself:
 
 ```sh
 source .superpowers/sdd/buildenv.sh   # JDK 17 + Android SDK on PATH
-docs/fdroid-metadata/verify-reproducible.sh v1.0.2
+docs/fdroid-metadata/verify-reproducible.sh v1.0.3
 ```
 
 **Caveat:** the build should run from a real git checkout at the tag, not a
@@ -88,7 +88,7 @@ clone (its `config/categories.yml` is needed for category validation):
   canonical form (`Binaries` after `Repo`, `AllowedAPKSigningKeys` after the
   `Builds` block), so it will not be rewritten.
 - `AllowedAPKSigningKeys` was verified against the published
-  `link-clear-v1.0.2.apk` with `apksigner verify --print-certs`.
+  `link-clear-v1.0.3.apk` with `apksigner verify --print-certs`.
 
 Re-run these before the MR in case F-Droid's policy or category set has changed
 since. Install the tool with `pipx install fdroidserver` (or
@@ -142,7 +142,7 @@ fdroid build -v -l app.linkclear
      endpoints; the app works fully offline with the bundled ClearURLs data.
    - **Build note (Path 2 — reproducible/cross-signed):** F-Droid builds from
      source and verifies the result is byte-identical to the developer-published
-     `link-clear-v1.0.2.apk`, then publishes the developer signature
+     `link-clear-v1.0.3.apk`, then publishes the developer signature
      (`AllowedAPKSigningKeys`). Note that R8 minification may require a round or
      two of reproducibility fixes in CI.
 

docs/fdroid-metadata/app.linkclear.yml

@@ -15,26 +15,26 @@ Repo: https://github.com/kisst/link-clear.git
 Binaries: https://github.com/kisst/link-clear/releases/download/v%v/link-clear-v%v.apk
 
 Builds:
-  - versionName: 1.0.2
-    versionCode: 10002
-    commit: v1.0.2
+  - versionName: 1.0.3
+    versionCode: 10003
+    commit: v1.0.3
     subdir: app
     gradle:
       - yes
 
 AllowedAPKSigningKeys: 7e489f6b0342db48ebcdb30312965e840589f1a335438046aefc2dfc548d057e
 
 MaintainerNotes: |-
-  Reproducible-builds (Path 2). v1.0.2 is verified byte-for-byte reproducible
-  against the published link-clear-v1.0.2.apk: identical ZIP entries region
-  (SHA-256 c6236e79...a78a) and central directory, differing only by the v2 APK
+  Reproducible-builds (Path 2). v1.0.3 is verified byte-for-byte reproducible
+  against the published link-clear-v1.0.3.apk: identical ZIP entries region
+  (SHA-256 360b4c36...045c) and central directory, differing only by the v2 APK
   Signing Block. Reproduced with OpenJDK 17, Gradle 8.14.4 (wrapper-pinned), AGP
   8.6.1 (pinned in gradle/libs.versions.toml -> build-tools 35.0.0). No NDK,
   no jvmToolchain (so no toolchain provisioning is needed). versionCode and
   versionName are inline literals in app/build.gradle.kts for static detection.
-  Verify: docs/fdroid-metadata/verify-reproducible.sh v1.0.2
+  Verify: docs/fdroid-metadata/verify-reproducible.sh v1.0.3
 
 AutoUpdateMode: Version
 UpdateCheckMode: Tags
-CurrentVersion: 1.0.2
-CurrentVersionCode: 10002
+CurrentVersion: 1.0.3
+CurrentVersionCode: 10003