The release job now waits for the android job, takes its APK, lists it in
SHA256SUMS.txt and uploads it as a release asset. The android job is no
longer optional. README describes installing the APK.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- scripts/setup-android-sdk.sh installs fixed versions of the Android
command-line tools (checksum verified), platform 34, build-tools
34.0.0 and NDK 28.2
- packaging/android/Containerfile + scripts/build-apk-container.sh build
the APK in a container (podman or docker) with JDK 17 and Rust 1.99
- New CI job "Android APK (experimental)": builds the APK and keeps it
as a workflow artifact, signed with the key from the secrets
ANDROID_KEYSTORE_B64/ANDROID_KEYSTORE_PASS/ANDROID_KEY_ALIAS if set.
Not part of the release yet; its failure doesn't block the release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shared groundwork:
- paths.rs: folders for data, settings and downloads per system (Linux XDG
unchanged, Windows %APPDATA%/%LOCALAPPDATA%, Android app folder)
- Linux-only parts behind cfg: Wayland on-screen keyboard (osk/wayland.rs),
display backend and app id, the vendored winit touch extensions
- run_with(event_loop) so that other entry points can start the app
Windows (#48):
- cross-compiled with MinGW into a portable ink-notes_<version>_x86_64.exe
(system DLLs only), no console window in release builds
- file picker: user folders and drives; held notebook locks are detected
(ERROR_LOCK_VIOLATION)
- updater: replaces the running .exe via rename, active at the next start
- octotablet panicking without the Tablet PC components no longer crashes
the app
- release: .exe built in CI and part of the signed checksums
- all library tests pass under wine
Android (#42):
- android_main entry point, winit with android-native-activity,
android_logger; octotablet and arboard left out there
- cargo check and the cdylib build for aarch64-linux-android pass; the window
surface does not follow the activity lifecycle yet
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
winit 0.29 draws the title bar itself on Wayland but only handles the
mouse there. A vendored copy of winit 0.29.15 (vendor/winit, used via
[patch.crates-io]) passes touches on the decorations to the frame like a
left click, so close, minimize and maximize work with a finger and
dragging the title bar moves the window.
CI no longer sets a global -D warnings, which would also apply to the
vendored crate; clippy still runs with -D warnings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Der Signaturschlüssel wurde mit `rsign generate -W` erzeugt und ist mit
leerem Passwort verschlüsselt; das minisign-CLI aus Ubuntu (0.11) verlangt
dafür ein Terminal und brach in der CI mit "Error while loading the secret
key file" ab.
- Workflow installiert rsign2 0.6.7 (ohne -D warnings) statt minisign
- build-release.sh signiert und verifiziert mit rsign; da rsign bei falscher
Key-ID mit Exit-Code 0 endet, wird zusätzlich die Erfolgsmeldung geprüft
- README: Signierwerkzeug und Fallstrick dokumentiert
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
setup-rust-toolchain installiert mit --profile minimal; ohne explizite
components fehlen rustfmt und clippy, wodurch die Quality Gates bei jedem
Release-Lauf sofort abbrachen (cargo fmt --check nach 2 Sekunden).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- SHA256SUMS.txt muss mit dem eingebauten Minisign-Schlüssel
(UPDATE_SIGNING_PUBLIC_KEY) signiert sein; fehlende oder ungültige
Signaturen und Versionen ohne Schlüssel lehnen Updates ab
- Prüfsummen und Signatur werden vor dem Paket geladen und geprüft
- build-release.sh signiert mit MINISIGN_SECRET_KEY und prüft, dass der
Schlüssel zum eingebauten öffentlichen Schlüssel passt; in der CI ist die
Signatur Pflicht
- publish-gitea-release.sh lädt SHA256SUMS.txt.minisig hoch
- README: Einrichtung des Schlüsselpaars dokumentiert
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
haraldandClaude Opus 5.5