fix(app): pin AboutLibraries license JSON so F-Droid reproduces

.github/workflows/android-ci.yaml

@@ -160,6 +160,22 @@ jobs:
             echo "::error::Rename guard found un-allowlisted OPDS_SYNC / opds-sync / opds_sync references."
             exit 1
           fi
+      - name: AboutLibraries JSON drift check
+        run: |
+          set -e
+          # app/src/main/res/raw/aboutlibraries.json is checked in and packaged
+          # as-is (registerAndroidTasks=false in app/build.gradle.kts) so F-Droid's
+          # reproducible-build check passes — the plugin's build-time collector is
+          # environment-dependent and produced a non-reproducible res/M7.json.
+          # Fail if the committed file drifts from the current release dep graph.
+          tmpdir="$(mktemp -d)"
+          ./gradlew :app:exportLibraryDefinitions \
+            -PaboutLibraries.exportVariant=release \
+            -PaboutLibraries.exportPath="$tmpdir" --stacktrace
+          if ! diff -u app/src/main/res/raw/aboutlibraries.json "$tmpdir/aboutlibraries.json"; then
+            echo "::error::app/src/main/res/raw/aboutlibraries.json is stale. Regenerate: scripts/dgradle :app:exportLibraryDefinitions -PaboutLibraries.exportVariant=release -PaboutLibraries.exportPath=src/main/res/raw"
+            exit 1
+          fi
       - name: Assemble debug APK
         run: ./gradlew assembleDebug --stacktrace
       - name: Unit tests

app/build.gradle.kts

@@ -10,12 +10,33 @@ plugins {
 val appVersionName: String = project.property("VERSION_NAME") as String
 val appVersionCode: Int = (project.property("VERSION_CODE") as String).toInt()
 
-// Drop the build timestamp from the AboutLibraries-generated license JSON
-// so the resource is byte-identical across rebuilds (matters for F-Droid's
-// reproducible-build verification). Disabled by default in AboutLibraries
-// 14+; explicit on 11.x.
+// AboutLibraries' build-time collector is not reproducible: it scans whatever
+// dependency configurations happen to be resolvable in a given build, so the
+// generated license JSON (res/raw/aboutlibraries.json, obfuscated to res/M7.json
+// by resource shrinking) varies by environment — debug/test artifacts leak in
+// locally while F-Droid's isolated builder under-collects. That made F-Droid's
+// reproducible-build verification fail on the res/M7.json contents.
+//
+// Fix: don't generate the resource at build time. We check in a pre-generated,
+// release-only JSON and package that fixed file, so every builder (dev, CI,
+// F-Droid) embeds byte-identical bytes. `LibrariesContainer` in LicensesScreen
+// reads R.raw.aboutlibraries, which resolves to the committed file.
+//
+// Regenerate after changing dependencies (CI enforces this — see the
+// "AboutLibraries JSON drift check" step in android-ci.yaml). exportPath is
+// resolved relative to this module, so `src/main/res/raw` lands the file at
+// app/src/main/res/raw/aboutlibraries.json:
+//   scripts/dgradle :app:exportLibraryDefinitions \
+//     -PaboutLibraries.exportVariant=release \
+//     -PaboutLibraries.exportPath=src/main/res/raw
+//
+// `excludeFields=["generated"]` drops the build timestamp (default in
+// AboutLibraries 14+; explicit on 11.x); `filterVariants` keeps the
+// regenerated file release-only.
 aboutLibraries {
     excludeFields = arrayOf("generated")
+    filterVariants = arrayOf("release")
+    registerAndroidTasks = false
 }
 
 android {