New app: Osmosis

Required

• The app complies with the inclusion criteria
• The original app author has been notified (and does not oppose the inclusion). I am the author.
• All related fdroiddata and RFP issues have been referenced in this merge request. There are none: this is a first submission by the author, so no RFP was filed.
• Builds with fdroid build and all pipelines pass. Green on my fork: https://gitlab.com/KonradIT/fdroiddata/-/pipelines/2739802749
• There is an issue tracker and contact info of the author so that we can report bugs and contact the author.

Strongly Recommended

• The upstream app source code repo contains the app metadata in a Fastlane folder structure. fastlane/metadata/android/en-US/ holds the title, short and full description, icon, 5 phone screenshots, 5 ten-inch screenshots and per-versionCode changelogs. No Summary or Description is set in fdroiddata.
• Releases are tagged and auto update is enabled, via UpdateCheckMode: Tags ^v[0-9.]+$ and AutoUpdateMode: Version. The tag filter is deliberate: the repo also carries per-camera testing tags such as v1.3.3-action1-playback that are not releases.

Suggested

• External repos are added as git submodules instead of srclibs. There are none. The only dependencies are androidx, Material Components and kotlinx-coroutines, from Google's Maven and Maven Central.
• Enable Reproducible Builds. Done, as requested in review: Binaries points at the signed APK attached to each GitHub release, and AllowedAPKSigningKeys pins the signing certificate. I have checked that the published v1.3.0 asset downloads and that its certificate is that exact fingerprint. My release CI builds on JDK 21 to match your buildserver.
• Multiple apks for native code. No native code, single universal APK of about 10 MB.

---

About the app

Osmosis is a media client for DJI Osmo action and gimbal cameras. It browses what is on the camera, previews and trims clips before download, and copies photos and videos into the phone's gallery. It can also stream the phone's GPS into the camera so recordings carry a track, and offload from DJI drones over QuickTransfer.

There is no DJI SDK involved: the DUML protocol was reverse engineered for this project and is documented in the repo. No accounts, no analytics, no activation, no cloud. The bundled network security config restricts traffic to the camera's own address, 192.168.2.1, and the INTERNET permission exists only to reach that local access point.

Notes for the reviewer

Everything raised in review is addressed, and the build now targets v1.3.0, commit afe9a2598cd08121987cdfe691dd2d702e2eaa0d:

1. dependenciesInfo { includeInApk = false; includeInBundle = false } - added; the APK lost about 4 KB.
2. JDK 21 - my release workflow was on 17 and now matches your buildserver, so the reproducibility comparison has the same toolchain on both sides.
3. Full commit hash instead of a tag name.
4. Binaries and AllowedAPKSigningKeys - reproducible builds enabled.

This MR originally targeted v1.2.5. That tag never produced an APK: its release build was killed by the GitHub Actions outage on 6 August and the run could not be restarted, so there was nothing for Binaries to point at. v1.3.0 is the first release built with all four changes in place, and it is a substantially better version to launch on - it adds DJI drone offload and a considerable amount of camera session hardening.

Two upstream changes were made earlier so this builds cleanly in your environment, both still in place:

• assembleRelease used to attach an empty signingConfig when keystore.properties was absent and die with missing required property "storeFile". It now attaches nothing in that case and emits app-release-unsigned.apk.
• The project was on Gradle 7.5.1, which refuses to start on any JDK past 19, and Debian trixie no longer packages openjdk-17. It is now AGP 8.5.2 / Gradle 8.7 / Kotlin 1.9.24 and builds on the default JDK 21 with no sudo or prebuild workarounds.

One scanner note: fdroid scanner warns about app/src/test/resources/manifests/*.bin. Those are captured camera protocol responses used as fixtures by the unit tests. They are not compiled into the APK and never reach the device.