New app: Gridlink Mail (app.gridlink)

tatelinkrequested to merge
tatelink/fdroiddata:add-app.gridlink into master

Gridlink Mail (app.gridlink)

A fork of Sterna Mail (app.sterna, already in F-Droid) by emon, GPL-3.0. The fork keeps emon's mail engine, sync layer and OpenPGP support and replaces the front end and the setup flow; it also adds CalDAV calendar and CardDAV contacts in the same app. The fork notice and attribution are at the top of the README.

@linsui, thanks for the review. All four points are addressed in the revised commit:

  1. This description now uses the App inclusion template with the boxes filled in.
  2. commit: is the full hash 8b166926236b922ea469857547716c1467fca475, no longer a tag.
  3. Binaries and AllowedAPKSigningKeys are set.
  4. The signing key is backed up: an encrypted copy now lives on separate storage that is itself backed up offsite, and the restore was tested rather than assumed.

The submission moves from 0.1.0 to 1.0.0 because 0.1.0 had no published release asset, so there was nothing for Binaries to verify against.

No proprietary dependencies. No Play Services, no Firebase, no ML Kit, no analytics. Push is UnifiedPush. The only tracked binary is gradle/wrapper/gradle-wrapper.jar.

Reproducible build, verified against the published binary. The APK attached to the GitHub release rebuilds byte-for-byte from the tagged tree:

3ca4b25dc6a9d91f353624e8078073482caeb17076982b9bcac707eb5f418575  gridlink-mail-1.0.0.apk (release asset)
3ca4b25dc6a9d91f353624e8078073482caeb17076982b9bcac707eb5f418575  app-release.apk (clean rebuild from 8b16692)

Signing cert SHA-256 17fac1d9740cdcf9fdb1e6857831b2fa9873f0869a6432e30980aaad732dca96 (RSA 4096, v2 scheme, minSdk 26).

That is not just my claim: setting Binaries makes fdroid build fetch the release APK and diff it against its own build, and that has already run on your runner for this MR and passed.

INFO: compared built binary to supplied reference binary successfully
INFO: supplied reference binary has allowed signer 17fac1d9740cdcf9fdb1e6857831b2fa9873f0869a6432e30980aaad732dca96

So the result is reproducible across environments, not only on my machine.

Three settings in app/build.gradle.kts exist purely to hold reproducibility and are commented as such, so please do not read them as cruft: vcsInfo { include = false } (otherwise the APK carries META-INF/version-control-info.textproto), dependenciesInfo { includeInApk = false }, and the ArtProfile task disable (the compiled assets/dexopt/baseline.prof is not byte-identical across build environments even when classes.dex is).

Toolchain note. The tree is on Kotlin 2.4.10, AGP 8.13 and KSP 2.3. fdroid build passes on your runner, so the image copes, but the log carries metadata is 2.4.0, expected 2.2.0 lines from the Kotlin stdlib. They are noise: the build exits 0 and the APK is identical to a cache-disabled build.

Fastlane metadata (icon, phone screenshots, changelog, descriptions) is at fastlane/metadata/android/en-US/ and is present at the tag.

Required

  • The app complies with the inclusion criteria
  • The original app author has been notified (and does not oppose the inclusion) Notice posted upstream at https://codeberg.org/emon/sterna-mail/issues/175
  • All related fdroiddata and RFP issues have been referenced in this merge request
  • Builds with fdroid build and all pipelines pass
  • There is an issue tracker and contact info of the author so that we can report bugs and contact the author.

Strongly Recommended

  • The upstream app source code repo contains the app metadata (summary/description/images/changelog/etc) in a Fastlane or Triple-T folder structure
  • Releases are tagged and auto update is enabled

Suggested

  • External repos are added as git submodules instead of srclibs
  • Enable Reproducible Builds
  • Multiple apks for native code
Edited by tatelink

Merge request reports