Loading
common, publish: support v2/v3-only sigdirs in developer signature graft
metadata_find_signing_files only emits a tuple when the per-vc sigdir contains v1 (JAR) META-INF (.RSA + .SF + MANIFEST.MF), so apps signed with v2/v3 only (sigdir holds just APKSigningBlock + APKSigningBlockOffset) skip the developer-signed graft branch in publish.py and only the f-droid-keystore variant ends up in the repo.
Widen the gate to emit (None, None, None, v2_files) for v2-only sigdirs and walk that tuple through publish.py. apksigcopier already supports v2-only patching via do_patch(..., v1_only=None); the gap was the gatekeeper plus a small APK Signing Block parser to read the developer fingerprint out of the saved block (used for the file-name suffix and for metadata_find_developer_signature so index grouping keeps working).
apk_implant_signatures now takes sigdir directly; v1 callers pass metadata_get_sigdir(appid, vercode), removing the # FIXME-flagged os.path.dirname(manifest) detour.
Verified end-to-end with it.belloworld.mercurygram vc 6666048: fdroid publish on a stripped-unsigned copy of the GitHub Releases APK produces both <appid>_<vc>.apk (f-droid keystore) and <appid>_<vc>_<devfp7>.apk (developer keystore, sha256 1e73de10...); both verify under apksigner v2+v3, and the developer-signed variant is byte-identical to the upstream APK.
Closes #1065 (closed)