Update Okanzo to v1.4.3 (disable opaque dependency metadata)

Puneet Chaurasiarequested to merge
punch-github/fdroiddata:okanzo-v1.4.2-reproducible into master

Update Okanzo to v1.4.3 after review

Reviewer request addressed

Per !56688 (comment 4200345268), the new release sets both dependenciesInfo.includeInApk = false and includeInBundle = false. Fix merged via https://github.com/cairn-labworks/Okanzo/pull/25.

The previous v1.4.2 pipeline successfully built and reproduced all three ABI APKs: https://gitlab.com/punch-github/fdroiddata/-/jobs/17891628549. Its final APK scan rejected DependencyInfoBlock. The proposed builds now target only v1.4.3; rejected v1.4.2 build entries are not retained.

Historical published builds, allowed developer key, anti-features, per-ABI commands, upstream-signed reproducibility policy, and scanner settings remain unchanged. No published APK was overwritten and no check is bypassed. The F-Droid build image, canonical SDK/app paths, Flutter 3.47.5 and Java environment are preserved.

Validation performed

  • Enforced Flutter lockfile, full formatting and clean analysis; 295 Flutter tests pass, including localized current-release highlights.
  • Exact-tag signed build succeeded: https://github.com/cairn-labworks/Okanzo/actions/runs/42825712296.
  • Verified package/version/codes/ABIs and v2 certificate against the existing allowed key for every APK.
  • Parsed every APK signing block: DependencyInfoBlock is absent.
  • fdroid scanner --exit-code passes for all three signed APKs using refreshed definitions.
  • AAB validates, code 13, expected upload key, and dependency metadata entry absent.
  • Published asset SHA-256 digests match the verified bytes.
  • Recipe generated with fdroid checkupdates --auto, checked against historical recipes and the existing policy; Binaries wrapping follows the current CI formatter.

Independent v1.4.3 source-build/reproducibility and APK-check results must come from the current MR pipeline; they are not inferred from the previous release.

Related upstream investigation: https://github.com/cairn-labworks/Okanzo/issues/24 Supersedes older v1.3.0 bot proposal !56278 (closed).

Edited by Puneet Chaurasia

Merge request reports