The F-Droid repository is built with the newest F-Droid tools at every release

- Each release now installs the newest version of F-Droid's own tools that has been out for at least two weeks,
  instead of one fixed version, so the repository keeps up with F-Droid without anyone updating it by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T9uhaCTSycTh1r8At679Pz

.gitea/scripts/fdroid.sh

@@ -19,14 +19,17 @@ patch=$(echo "$version" | cut -d. -f3)
 code=$((major * 10000 + minor * 100 + patch))
 
 tools/setup.sh --group fdroid
-tools=$(cd "$here/tools/fdroid/linux-x64" && pwd -P)
-pinned=$(sed -n 's/^fdroidserver==\([^ ]*\).*/\1/p' packaging/fdroid/requirements.txt)
-venv=$tools/fdroidserver-$pinned
-if ! "$venv/bin/fdroid" --version > /dev/null 2>&1; then
-  rm -rf "$venv"
-  UV_CACHE_DIR=$tools/cache UV_PYTHON_INSTALL_DIR=$tools/python "$tools/uv-x86_64-unknown-linux-gnu/uv" venv -q --python 3.12 "$venv"
-  UV_CACHE_DIR=$tools/cache "$tools/uv-x86_64-unknown-linux-gnu/uv" pip install -q --python "$venv/bin/python" --require-hashes -r packaging/fdroid/requirements.txt
-fi
+tools=$here/tools/fdroid/linux-x64
+uv=$tools/uv-x86_64-unknown-linux-gnu/uv
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+venv=$work/venv
+settled=$(date -u -d '14 days ago' +%Y-%m-%dT%H:%M:%SZ)
+env -u MEWEB_KEYSTORE_B64 -u MEWEB_KEYSTORE_PASS UV_CACHE_DIR="$tools/cache" UV_PYTHON_INSTALL_DIR="$tools/python" \
+  "$uv" venv -q --python 3 "$venv"
+env -u MEWEB_KEYSTORE_B64 -u MEWEB_KEYSTORE_PASS UV_CACHE_DIR="$tools/cache" \
+  "$uv" pip install -q --python "$venv/bin/python" --exclude-newer "$settled" fdroidserver
+echo "fdroidserver $("$venv/bin/fdroid" --version), the newest released before $settled"
 JAVA_HOME=$(ls -d "$here"/tools/jdk/linux-x64/*/ | head -n 1)
 ANDROID_HOME=$here/tools/android-sdk
 PATH=$JAVA_HOME/bin:$PATH
@@ -35,10 +38,8 @@ export JAVA_HOME ANDROID_HOME PATH
 exec 9>>"$root/.lock"
 flock -w 2700 9
 
-keys=$(mktemp -d)
-trap 'rm -rf "$keys"' EXIT
-(umask 077 && printf '%s' "$MEWEB_KEYSTORE_B64" | base64 -d > "$keys/meweb.keystore")
-MEWEB_KEYSTORE=$keys/meweb.keystore
+(umask 077 && printf '%s' "$MEWEB_KEYSTORE_B64" | base64 -d > "$work/meweb.keystore")
+MEWEB_KEYSTORE=$work/meweb.keystore
 export MEWEB_KEYSTORE MEWEB_KEYSTORE_PASS
 unset MEWEB_KEYSTORE_B64
 held=$(keytool -J-Duser.language=en -list -v -keystore "$MEWEB_KEYSTORE" -storepass:env MEWEB_KEYSTORE_PASS -alias meweb | sed -n 's/^.*SHA256: *//p' | tr -d ':')
@@ -79,8 +80,8 @@ done
 echo "published ${id}_$code.apk in $root/fdroid/repo"
 
 if [ "$root" = /var/www/packages.arasaka.software ]; then
-  curl -fsS "$url/entry.jar" -o "$keys/entry.jar"
-  signed=$(keytool -J-Duser.language=en -printcert -jarfile "$keys/entry.jar" | sed -n 's/^.*SHA256: *//p' | head -n 1 | tr -d ':')
+  curl -fsS "$url/entry.jar" -o "$work/entry.jar"
+  signed=$(keytool -J-Duser.language=en -printcert -jarfile "$work/entry.jar" | sed -n 's/^.*SHA256: *//p' | head -n 1 | tr -d ':')
   test "$signed" = "$fingerprint"
   curl -fsS "$url/index-v2.json" | grep -Eq "\"versionCode\": ?$code\b"
   curl -fsSI "$url/${id}_$code.apk" > /dev/null

CLAUDE.md

@@ -175,11 +175,15 @@ The Android release key: alias `meweb`, certificate SHA-256
   is installed. The signing key's only copies are that secret and the owner's Nextcloud backup.
 - **The APK reaches an F-Droid repository on packages.arasaka.software from the same job** (31 Oct 2026), after the
   release is published, so the repository can lag the release page but never lead it. `.gitea/scripts/fdroid.sh`
-  installs fdroidserver into `tools/fdroid` (cached like the JDK) with uv from `setup.json` and the hash-locked
-  `packaging/fdroid/requirements.txt`, because the box has no `ensurepip` and the apt package would bring 242 others.
-  The environment is made at the cache's real path (`pwd -P`) and rebuilt whenever `fdroid --version` fails: its
-  scripts carry the absolute path they were made at, `tools/fdroid` is a symlink from a workspace that can move, and
-  0.15.1's step failed with `fdroid: not found` on exactly that.
+  installs fdroidserver with uv from `setup.json` (its download cache in `tools/fdroid`, cached like the JDK), because
+  the box has no `ensurepip` and the apt package would bring 242 others. **Nothing pins fdroidserver** (owner, 31 Oct
+  2026: no patching it from time to time): each run installs the newest fdroidserver, and the newest of everything it
+  needs, published at least 14 days before the run, so a bad upload has usually been pulled before the job sees it,
+  and prints the version it got. It installs into a fresh environment in a temporary folder with the signing key taken
+  out of its environment; nothing is kept between runs, because an environment's scripts carry the absolute path they
+  were made at, and 0.15.1's step failed with `fdroid: not found` on a kept one. A new fdroidserver that breaks
+  `fdroid update` fails this step after the release is published: the repository then lags, and the log names the
+  version to look at.
   It signs the repository with the APK's own key (`MEWEB_KEYSTORE_B64` and `MEWEB_KEYSTORE_PASS`, alias `meweb`), so
   the F-Droid fingerprint is the certificate's `5F52CFF4…FDF846` and there is no second key to lose; it refuses any
   other. It builds a new snapshot in