Release v1.1.5: per-ABI APK splits (arm64-v8a, x86_64) (#382)

* Release v1.1.5: per-ABI APK splits (arm64-v8a, x86_64) for F-Droid

* Align docs/CI with per-ABI APK splits; harden reproducibility download guard

Author: kwsantiago

.github/workflows/release.yml

@@ -75,8 +75,20 @@ jobs:
             --secret id=key_pass,env=KEY_PASSWORD \
             --output type=local,dest=docker-out \
             -f Dockerfile.reproducible .
-          test -f docker-out/app-release.apk
-          mv docker-out/app-release.apk "keep-android-${REF_NAME}.apk"
+          # ABI splits produce one APK per architecture (app-<abi>-release.apk).
+          # Rename each to a release asset: keep-android-<tag>-<abi>.apk
+          shopt -s nullglob
+          count=0
+          for apk in docker-out/app-*-release.apk; do
+            abi="$(basename "$apk" | sed -E 's/^app-(.*)-release\.apk$/\1/')"
+            mv "$apk" "keep-android-${REF_NAME}-${abi}.apk"
+            count=$((count + 1))
+          done
+          if [ "$count" -lt 2 ]; then
+            echo "error: expected at least 2 per-ABI APKs, got $count" >&2
+            exit 1
+          fi
+          ls -la "keep-android-${REF_NAME}"-*.apk
 
       - name: Setup Android SDK
         uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
@@ -94,25 +106,34 @@ jobs:
           EXPECTED_CERT_SHA256: 3eb0e6f6f4e0962ebd717f84eea47428b73087b686c956633d6a9fcc4c854f50
         run: |
           APKSIGNER="$ANDROID_HOME/build-tools/${{ env.BUILD_TOOLS_VERSION }}/apksigner"
-          CERTS="$("$APKSIGNER" verify --print-certs "keep-android-${REF_NAME}.apk")"
-          echo "$CERTS"
-          ACTUAL="$(printf '%s\n' "$CERTS" \
-            | sed -nE 's/.*certificate SHA-256 digest:[[:space:]]*([0-9a-fA-F]+).*/\1/p' \
-            | head -1 | tr 'A-F' 'a-f')"
-          if [ -z "$ACTUAL" ]; then
-            echo "::error::could not parse signing certificate SHA-256 digest" >&2
-            exit 1
-          fi
-          if [ "$ACTUAL" != "$EXPECTED_CERT_SHA256" ]; then
-            echo "::error::signing cert SHA-256 $ACTUAL does not match expected release key $EXPECTED_CERT_SHA256" >&2
+          shopt -s nullglob
+          checked=0
+          for apk in "keep-android-${REF_NAME}"-*.apk; do
+            CERTS="$("$APKSIGNER" verify --print-certs "$apk")"
+            echo "$apk:"; echo "$CERTS"
+            ACTUAL="$(printf '%s\n' "$CERTS" \
+              | sed -nE 's/.*certificate SHA-256 digest:[[:space:]]*([0-9a-fA-F]+).*/\1/p' \
+              | head -1 | tr 'A-F' 'a-f')"
+            if [ -z "$ACTUAL" ]; then
+              echo "::error::$apk: could not parse signing certificate SHA-256 digest" >&2
+              exit 1
+            fi
+            if [ "$ACTUAL" != "$EXPECTED_CERT_SHA256" ]; then
+              echo "::error::$apk signing cert SHA-256 $ACTUAL does not match expected release key $EXPECTED_CERT_SHA256" >&2
+              exit 1
+            fi
+            checked=$((checked + 1))
+          done
+          if [ "$checked" -lt 2 ]; then
+            echo "::error::expected to verify at least 2 per-ABI APKs, verified $checked" >&2
             exit 1
           fi
-          echo "Signing certificate matches the expected release key."
+          echo "All $checked per-ABI APK signing certificates match the expected release key."
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: apk
-          path: keep-android-${{ github.ref_name }}.apk
+          path: keep-android-${{ github.ref_name }}-*.apk
 
   release:
     needs: [build]

.github/workflows/reproducibility.yml

@@ -87,7 +87,9 @@ jobs:
             --build-arg KEEP_SHA="$(tr -d '[:space:]' < keep.version)" \
             --output type=local,dest=out \
             -f Dockerfile.reproducible .
-          test -f out/app-release.apk
+          # ABI splits produce one APK per architecture.
+          ls out/app-*-release.apk
+          test "$(ls out/app-*-release.apk | wc -l)" -ge 2
 
       - name: Setup Android SDK
         if: github.event_name != 'pull_request'
@@ -117,14 +119,22 @@ jobs:
           REPOSITORY: ${{ github.repository }}
         run: |
           echo "Verifying reproduction of $VERSION"
-          URL="https://github.com/${REPOSITORY}/releases/download/${VERSION}/keep-android-${VERSION}.apk"
-          # On a tag push this runs concurrently with release.yml, so the asset
-          # may not be published yet. Wait for it (up to ~20 min).
-          for i in $(seq 1 40); do
-            if curl -fsSL -o published.apk "$URL"; then break; fi
-            echo "Published APK not available yet (attempt $i/40); waiting 30s..."
-            sleep 30
+          # One published APK per architecture; compare each to its container build.
+          for built in out/app-*-release.apk; do
+            abi="$(basename "$built" | sed -E 's/^app-(.*)-release\.apk$/\1/')"
+            URL="https://github.com/${REPOSITORY}/releases/download/${VERSION}/keep-android-${VERSION}-${abi}.apk"
+            # On a tag push this runs concurrently with release.yml, so the asset
+            # may not be published yet. Wait for it (up to ~20 min).
+            ok=""
+            for i in $(seq 1 40); do
+              if curl -fsSL -o "published-${abi}.apk" "$URL"; then ok=1; break; fi
+              echo "Published $abi APK not available yet (attempt $i/40); waiting 30s..."
+              sleep 30
+            done
+            if [ -z "$ok" ] || ! test -s "published-${abi}.apk"; then
+              echo "::error::published $abi APK never became available at $URL" >&2
+              exit 1
+            fi
+            apksigcopier compare "published-${abi}.apk" "$built"
+            echo "Container build reproduces the published $VERSION $abi APK (payload identical)."
           done
-          test -s published.apk
-          apksigcopier compare published.apk out/app-release.apk
-          echo "Container build reproduces the published $VERSION APK (payload identical)."

Dockerfile.reproducible

@@ -13,9 +13,9 @@
 #       --output type=local,dest=out \
 #       -f Dockerfile.reproducible .
 #
-# Output: ./out/app-release.apk  (unsigned; sign with your own key or compare
-# against the published APK with diffoscope — the payload is reproducible,
-# only the signing block necessarily differs).
+# Output: ./out/app-<abi>-release.apk, one per ABI (arm64-v8a, x86_64). Sign
+# with your own key or compare against the published APK with diffoscope; the
+# payload is reproducible, only the signing block necessarily differs.
 
 # Pinned base: Debian 13 (trixie), slim variant. This matches F-Droid's
 # buildserver OS so the published APK reproduces what F-Droid builds from the
@@ -293,16 +293,20 @@ RUN --mount=type=secret,id=keystore,uid=1000 \
     export KEYSTORE_FILE KEYSTORE_PASSWORD KEY_ALIAS KEY_PASSWORD; \
     ./gradlew :app:verifyNoProprietaryDeps assembleRelease --no-daemon; \
     mkdir -p /out; \
-    cp app/build/outputs/apk/release/app-release.apk /out/app-release.apk; \
-    echo "SHA256 of signed APK (depends on signing key; differs per build when"; \
-    echo "using the throwaway keystore, since the RSA key is regenerated):"; \
-    sha256sum /out/app-release.apk; \
-    echo ""; \
+    # ABI splits (isUniversalApk=false) produce one APK per architecture. Copy
+    # every per-ABI release APK; the export stage and release.yml publish them all.
+    found=""; \
+    for apk in app/build/outputs/apk/release/*-release.apk; do \
+        [ -f "$apk" ] || continue; \
+        cp "$apk" /out/; found="yes"; \
+        echo "SHA256 $(sha256sum "$apk")"; \
+    done; \
+    [ -n "$found" ] || { echo "no release APKs produced" >&2; exit 1; }; \
     echo "For reproducibility verification, compare APKs with diffoscope"; \
     echo "(see REPRODUCIBLE_BUILDS.md § 5.2). A matching signed-APK sha256 is"; \
     echo "only expected when the same KEYSTORE_FILE/PASSWORD/ALIAS is reused."
 
-# Export stage: extract just the APK using BuildKit's local output.
+# Export stage: extract the per-ABI APKs using BuildKit's local output.
 #   docker build --output type=local,dest=out -f Dockerfile.reproducible .
 FROM scratch AS export
-COPY --from=builder /out/app-release.apk /app-release.apk
+COPY --from=builder /out/ /

REPRODUCIBLE_BUILDS.md

@@ -142,7 +142,7 @@ export SOURCE_DATE_EPOCH="$(./scripts/derive-sde.sh)"
 # container paths:
 #   * Host build: if no `KEYSTORE_FILE` is exported and no `storeFile` is
 #     resolved by `app/build.gradle.kts`, Gradle falls back to the debug
-#     signing key and still writes `app-release.apk`.
+#     signing key and still writes the per-ABI `app-<abi>-release.apk` files.
 #   * Container build (Section 4): `Dockerfile.reproducible` intentionally
 #     generates a throwaway keystore per build when `KEYSTORE_FILE` is unset,
 #     so the APK is always release-signed. This enforces a deterministic
@@ -153,7 +153,8 @@ export SOURCE_DATE_EPOCH="$(./scripts/derive-sde.sh)"
 ./gradlew assembleRelease --no-daemon
 ```
 
-Output: `app/build/outputs/apk/release/app-release.apk`.
+Output: per-ABI APKs in `app/build/outputs/apk/release/`, namely
+`app-arm64-v8a-release.apk` and `app-x86_64-release.apk`.
 
 If you want to reproduce the exact byte layout of the published APK, you must
 sign with the same release key; otherwise the APK payload is identical but the
@@ -187,7 +188,7 @@ DOCKER_BUILDKIT=1 docker build \
     -f Dockerfile.reproducible \
     .
 
-ls out/   # app-release.apk
+ls out/   # app-arm64-v8a-release.apk  app-x86_64-release.apk
 ```
 
 The container:
@@ -198,7 +199,7 @@ The container:
 3. Copies the keep-android sources in and clones `keep` at the pinned SHA.
 4. Runs `build-rust.sh` and `./gradlew assembleRelease` with
    `SOURCE_DATE_EPOCH` set.
-5. Exports the signed release APK to `./out/` (signed with a per-build
+5. Exports the signed per-ABI release APKs to `./out/` (signed with a per-build
    throwaway keystore unless a keystore is supplied; see § 4.1).
 
 ### 4.1 Optional build-args
@@ -257,7 +258,7 @@ sha256sum -c SHA256SUMS
 sudo apt-get install -y diffoscope
 diffoscope --html diffoscope.html --text diffoscope.txt \
     keep-android-v0.5.2.apk \
-    app/build/outputs/apk/release/app-release.apk
+    app/build/outputs/apk/release/app-arm64-v8a-release.apk
 ```
 
 A reproducible build produces a `diffoscope` report in which:
@@ -288,18 +289,19 @@ is removed explicitly so the sibling cargo target dir is purged even when
 rm -rf app/src/main/jniLibs app/src/main/kotlin/io/privkey/keep/uniffi "$KEEP_REPO/keep-mobile/target"
 ./build-rust.sh
 ./gradlew assembleRelease --no-daemon
-cp app/build/outputs/apk/release/app-release.apk /tmp/build1.apk
+cp app/build/outputs/apk/release/app-arm64-v8a-release.apk /tmp/build1.apk
 
 ./gradlew clean --no-daemon
 rm -rf app/src/main/jniLibs app/src/main/kotlin/io/privkey/keep/uniffi "$KEEP_REPO/keep-mobile/target"
 ./build-rust.sh
 ./gradlew assembleRelease --no-daemon
-cp app/build/outputs/apk/release/app-release.apk /tmp/build2.apk
+cp app/build/outputs/apk/release/app-arm64-v8a-release.apk /tmp/build2.apk
 
 sha256sum /tmp/build1.apk /tmp/build2.apk
 ```
 
-The two SHA-256 hashes MUST be identical.
+The two SHA-256 hashes MUST be identical. Repeat the comparison for
+`app-x86_64-release.apk`; each per-ABI APK must reproduce independently.
 
 ## 6. Troubleshooting
 

app/build.gradle.kts

@@ -13,16 +13,16 @@ android {
         applicationId = "io.privkey.keep"
         minSdk = 33
         targetSdk = 36
-        versionCode = 22
-        versionName = "1.1.4"
+        versionCode = 23
+        versionName = "1.1.5"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         vectorDrawables {
             useSupportLibrary = true
         }
-        ndk {
-            abiFilters += listOf("arm64-v8a", "x86_64")
-        }
+        // ABI selection is handled by the `splits { abi }` block below (which is
+        // incompatible with ndk.abiFilters). splits.abi.include restricts the
+        // packaged architectures to arm64-v8a and x86_64.
     }
 
     // Reproducible builds: strip non-reproducible Play dependency metadata blob
@@ -88,12 +88,43 @@ android {
         }
     }
 
+    // Per-ABI APK splits for F-Droid: ship one APK per architecture instead of a
+    // single universal APK. Each split gets a distinct versionCode assigned in
+    // the androidComponents block below.
+    splits {
+        abi {
+            isEnable = true
+            reset()
+            include("arm64-v8a", "x86_64")
+            isUniversalApk = false
+        }
+    }
+
     testOptions {
         unitTests.isReturnDefaultValues = true
     }
 
 }
 
+// Assign each per-ABI release split its own versionCode: 10 * base + abiCode.
+// ABI codes follow F-Droid's required ordering (armeabi-v7a < arm64-v8a < x86 <
+// x86_64), yielding 232 (arm64-v8a) and 234 (x86_64). The F-Droid recipe must
+// declare matching per-ABI versionCodes for these splits.
+val abiVersionCodes = mapOf("arm64-v8a" to 2, "x86_64" to 4)
+androidComponents {
+    onVariants(selector().withBuildType("release")) { variant ->
+        variant.outputs.forEach { output ->
+            val abi = output.filters
+                .firstOrNull { it.filterType == com.android.build.api.variant.FilterConfiguration.FilterType.ABI }
+                ?.identifier
+            val abiCode = abiVersionCodes[abi]
+            if (abiCode != null) {
+                output.versionCode.set(10 * (android.defaultConfig.versionCode ?: 0) + abiCode)
+            }
+        }
+    }
+}
+
 kotlin {
     compilerOptions {
         jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17)

fastlane/metadata/android/de-DE/changelogs/232.txt

@@ -0,0 +1 @@
+Aufteilung in architekturspezifische APKs (arm64-v8a, x86_64) für kleinere Downloads. Keine funktionalen Änderungen gegenüber 1.1.4.

fastlane/metadata/android/de-DE/changelogs/234.txt

@@ -0,0 +1 @@
+Aufteilung in architekturspezifische APKs (arm64-v8a, x86_64) für kleinere Downloads. Keine funktionalen Änderungen gegenüber 1.1.4.

fastlane/metadata/android/en-US/changelogs/232.txt

@@ -0,0 +1 @@
+Split into per-architecture APKs (arm64-v8a, x86_64) for smaller downloads. No functional changes since 1.1.4.

fastlane/metadata/android/en-US/changelogs/234.txt

@@ -0,0 +1 @@
+Split into per-architecture APKs (arm64-v8a, x86_64) for smaller downloads. No functional changes since 1.1.4.

fastlane/metadata/android/es-ES/changelogs/232.txt

@@ -0,0 +1 @@
+Divididos en APKs por arquitectura (arm64-v8a, x86_64) para descargas más pequeñas. Sin cambios funcionales desde la 1.1.4.