F-Droid reproducible build failed

[linsui]

https://gitlab.com/fdroid/fdroiddata/-/jobs/8455720563 Your apk is not built from the tag. Could you please rebuild it from the tag?

[Razeeman]

Hello! Built apk again and updated release. Can f-droid build be triggered again?

[linsui]

We find that there is a DependencyInfoBlock in your APK.

It's a Signing block added by AGP and encrypted with the Google public key so it can't be read by anyone else except Google. You can read more about it here and here.

While this was added a while ago, we were only enforcing it for new apps, and recently we started scanning updates too.

Could you please disable it with the following code?

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

Thanks!

[Razeeman]

Didn't know about this. Is this a requirement for publishing recent update? Or it could be published without it and I will make this change for the next update?

[linsui]

You can make this change for the next update. :)