diff --git a/.gitignore b/.gitignore index b5cb536..49e9c1b 100644 --- a/.gitignore +++ b/.gitignore @@ -12,10 +12,10 @@ build/ output-metadata.json baselineProfiles/ -# ...except the deliberately committed release APKs under apk/, which exist so -# people can install the app without a build environment. This negation must come -# after `*.apk` above, because in .gitignore the last matching rule wins. -!apk/**/*.apk +# There is deliberately no exception re-including an APK. Release binaries are +# attached to a GitHub Release by the Release workflow, never committed: a binary +# in the repository is served through the raw file path, which a phone browser +# refuses or saves under the wrong name, and it bloats every clone for no gain. # ---- Local machine configuration --------------------------------------------- local.properties diff --git a/README.md b/README.md index b2be796..775c9f2 100644 --- a/README.md +++ b/README.md @@ -54,8 +54,17 @@ Every release contains: - **`discount-hunter-.apk`** — the optimised release build - **Source code (zip)** and **(tar.gz)** — generated by GitHub from the tagged commit -The APK is unsigned, so Android asks you to allow installation from your file manager the first -time. See [`apk/README.md`](apk/README.md) for the step-by-step. +The APK is **unsigned**, so Android will not install it until you allow your file manager to. The +first time: + +1. Tap the downloaded `.apk`. +2. Android says it is from an unknown source → **Settings** → allow your file manager to install apps. +3. Go back and tap the APK again. + +To withdraw that permission afterwards: **Settings → Apps → (your file manager) → Permissions → +Install unknown apps → Deny**. + +Requires **Android 7.0 (API 24)** or newer. Portrait orientation only. ### Build it yourself diff --git a/SECURITY.md b/SECURITY.md index 32cc77d..0777514 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,7 +12,9 @@ you find a real problem, there is a safe way to report it. | 1.0.x (current release) | ✅ | | Anything older | ❌ | -You are running the latest build from [`apk/`](apk/). Security fixes land there. +You are running the latest build from the +[Releases page](https://github.com/JuggyBob/DiscountHunterAndroid/releases/latest). Security fixes +land in the next release. ## What the app does and does not do diff --git a/apk/README.md b/apk/README.md deleted file mode 100644 index 7e5905e..0000000 --- a/apk/README.md +++ /dev/null @@ -1,75 +0,0 @@ -# Release APKs - -## Where to get the app - -**Download from the -[Releases page](https://github.com/JuggyBob/DiscountHunterAndroid/releases/latest) → Assets**, not -from this folder. - -Release assets are served to a phone as real downloads. A binary committed to a repository is not: -GitHub fetches it through the repository's raw file path, so a phone browser tends to either refuse -it or save it under the wrong name and extension. That is the whole reason this file exists — to -point somewhere that works. - -Every release carries: - -| Asset | What it is | -|-------|------------| -| `discount-hunter-.apk` | The optimised release build | -| Source code (zip) | Generated by GitHub from the tagged commit | -| Source code (tar.gz) | Same, as a tarball | - -The APK is built by the `Release` workflow in CI, not uploaded by hand, so the file you download is -the one the tests and lint ran against. - -The copy in this folder is a local build artefact kept for convenience. It is not what the README -links to, and it will drift from the releases. - -## Installing - -**The APKs are unsigned**, so Android will refuse them the first time. That is expected: - -1. Tap the downloaded `.apk` in your file manager. -2. Android will say the file is from an unknown source. Tap **Settings** → allow your file manager - to install apps. -3. Go back and tap the APK again. - -To remove that permission afterwards: **Settings → Apps → (your file manager) → Permissions → -Install unknown apps → Deny**. - -Requires **Android 7.0 (API 24)** or newer. Portrait orientation only. - -## Verifying what you downloaded - -The build is reproducible from the tagged source, so you can check that the APK matches the code: - -```bash -git checkout v1.0.0 -./gradlew assembleRelease -``` - -The resulting APK will not be byte-identical to the one here — Android build tools embed timestamps -and a build id — but its `versionName` and `versionCode` will match, and `aapt dump badging` on both -should agree. - -## Building your own - -Better if you want to change something, or you want a signed build for your own device: - -```bash -git clone https://github.com/JuggyBob/DiscountHunterAndroid.git -cd DiscountHunterAndroid -echo "sdk.dir=/path/to/Android/sdk" > local.properties -./gradlew assembleDebug # debug build -./gradlew assembleRelease # release build -``` - -For a signed release, see the commented signing steps in [`.github/workflows/release.yml`](../.github/workflows/release.yml). - -## Safety - -The app requests no dangerous permissions and sends nothing to a developer. See -[`SECURITY.md`](../SECURITY.md) for the threat model and how to report a vulnerability. - -Game names, cover art and prices belong to their respective owners. Discount Hunter is not affiliated -with Valve, GOG.com or Epic Games — it displays data their public APIs return. diff --git a/apk/release/app-release.apk b/apk/release/app-release.apk deleted file mode 100644 index d627026..0000000 Binary files a/apk/release/app-release.apk and /dev/null differ