New app: Nightbell

Required

• The app complies with the inclusion criteria
• The original app author has been notified (and does not oppose the inclusion)
• All related fdroiddata and RFP issues have been referenced in this merge request
• Builds with fdroid build and all pipelines pass
• There is an issue tracker and contact info of the author so that we can report bugs and contact the author.

Strongly Recommended

• The upstream app source code repo contains the app metadata (summary/description/images/changelog/etc) in a Fastlane or Triple-T folder structure
• Releases are tagged and auto update is enabled

Suggested

• External repos are added as git submodules instead of srclibs
• Enable Reproducible Builds
• Multiple apks for native code

---

About the app

Nightbell is an Android uptime monitor. Checks run on the phone, with no server and no account, and an outage arrives as a full-screen page with a looping alarm rather than a notification you swipe away.

Package: me.river.nightbell Source: https://github.com/riveerxd/nightbell Website: https://nightbell.app License: Apache-2.0

Metadata

No Summary or Description in fdroiddata, per the template's guidance. The app repo carries fastlane/metadata/android/en-US/ with title, short and full description, icon, a feature graphic, five phone screenshots, and a changelog per versionCode.

scandelete: artifacts is the one entry that needs justifying. The repo keeps its released APKs and their R8 mapping files under artifacts/, and the mapping files are gzipped, which the scanner reports as archives. They are kept because a release stack trace is unreadable without the matching mapping, and they are build output rather than build input: nothing in build.gradle.kts, settings.gradle.kts or gradle.properties references artifacts/ at all, so deleting the directory before the scan clears the finding without touching what gets compiled. Happy to switch to scanignore, or to a narrower path such as artifacts/mapping, if either is preferred.

Reproducible build

Verifying against my own signature, so Binaries and AllowedAPKSigningKeys are both set and fdroid build passes on my fork. Getting there took two releases and the reasons are worth stating, since both are things a reviewer might otherwise have to find for me.

3.0.2 failed on two of the 148 files, classes.dex and assets/dexopt/baseline.prof. One cause rather than two: this buildserver runs openjdk 21.0.12 and that APK was built on 21.0.11, and a different JDK gives R8 a different dex. The baseline profile is compiled out of app/src/main/baselineProfiles/*.txt into dex method indices, so it moved with the dex. baseline.profm, which holds no indices, was identical throughout.

3.0.3 then failed the APK scan on found extra signing block 'Dependency metadata'. That is AGP's default, 6,486 bytes so that Play can report on the libraries a build pulled in, and this app is not on Play. 3.0.4 sets dependenciesInfo { includeInApk = false }. It is a separate release rather than a rebuild because the setting is source and you build the tag.

Both fixes are recorded next to the version in app/build.gradle.kts, along with the third constraint they imply: commit the version bump before building the APK, or the revision AGP writes into META-INF/version-control-info.textproto points at the previous commit and the comparison fails on that file alone.

Build

Single module, no product flavours, no NDK, no checked-in jars or aars. Gradle 8.13 via the committed wrapper, AGP 8.13.2, Kotlin 2.2.21, Java 17, compileSdk 36, minSdk 26, targetSdk 36.

The project signs its own GitHub releases, but both halves of that are guarded behind if (keystoreProps.isNotEmpty()) in app/build.gradle.kts, so a tree with no signing material builds an unsigned release APK rather than failing to configure.

Anti-features

None. No ads, analytics, tracking or crash reporting. Dependencies are androidx, Compose, kotlinx-serialization, kotlinx-coroutines and OkHttp.