Notes for F-Droid maintainers
============================

Source repository
-----------------
This directory is the root of the standalone Android source repository.
There are no submodules, private build dependencies or external source trees.
Browse/download: https://git.glosira.com/
Anonymous clone: https://git.glosira.com/glosira-android.git
SSH is only for authenticated maintainer pushes; reviewers need no credentials.

Build recipe
------------
Template: packaging/com.glosira.app.fdroid.yml.in
Application: com.glosira.app.fdroid
Gradle module: app
Build from the tagged commit with subdir: app and gradle: [yes].
Build output: app/build/outputs/apk/release/app-release-unsigned.apk
No custom prebuild, binary download, API key or scanignore is required.
Version name/code are literal values in app/build.gradle.

Dependencies
------------
Direct Android runtime libraries:
- androidx.work:work-runtime-ktx:2.7.1 (Apache-2.0)
- androidx.core:core-ktx:1.7.0 (Apache-2.0)
Kotlin and transitive AndroidX libraries are resolved by Gradle from the usual
Maven repositories. There is no Firebase, Google Play Services, billing SDK,
advertising SDK, analytics SDK or proprietary push service in the native client.

Native functionality
--------------------
This is a WebView client with native WorkManager-based study reminders, native
notification permission handling and notification avatars, Android back
navigation, edge-to-edge/keyboard inset handling, and native loading/offline
screens. It is not an offline course bundle.

Network and data flow
---------------------
- MainActivity opens https://app.glosira.com. Remote HTML/JavaScript, course
  content and media come from the service; they are not independently frozen
  or built by F-Droid. The web service can change without an APK update.
- The WebView keeps the signed-in session in its own browser storage.
- A JavaScript bridge supplies the account session token and API base URL to
  private Android SharedPreferences for native reminders.
- WorkManager schedules reminder checks about once an hour, only with network
  connectivity. No request is made without a token and API URL; the app's
  notification setting also disables these checks. The authenticated request
  is GET <api_base>/private/reminder (normally /api/private/reminder).
- Notification content and character names come from the server. A successful
  reminder response may display a native notification. Android controls the
  actual background scheduling time; checks are not exact alarms.
- Uses the system WebView and its networking stack. Cleartext traffic is
  disabled in network_security_config.xml.
- This variant does not fetch app-config.json and has no native updater or
  forced link to the website APK. It does not install packages itself.

Permissions
-----------
INTERNET: load courses/media and request study reminders.
ACCESS_NETWORK_STATE: constrain background work to an available network.
POST_NOTIFICATIONS: show study reminders on Android 13+ (runtime permission).
The merged manifest also contains WAKE_LOCK, RECEIVE_BOOT_COMPLETED and
FOREGROUND_SERVICE from AndroidX WorkManager. They support its background-job
lifecycle; this client schedules periodic work, not a continuous foreground
service. The initialization provider authority uses com.glosira.app.fdroid,
so it does not conflict with the website edition. Inspect the merged manifest
or APK when updating AndroidX.
There is no advertising identifier, camera, microphone or location permission.

Review disclosures
------------------
The app depends on the hosted Glosira service, with no user-facing server
selector. The proposed metadata therefore declares TetheredNet. This source
export does not establish a freely licensed, self-hostable backend or publish
the remote web application's sources: NonFreeNet is declared conservatively.
Publishing this native wrapper alone must not be represented as publishing all
service code. Please assess the remote web interface and applicable labels
as part of inclusion review. No acceptance or reproducibility certification
is claimed by this preparation.

Licensing and artwork
---------------------
See LICENSING.txt. The owner must finalize license grants before submission.
Screenshots and icon are upstream Glosira assets; there are no external SDKs
embedded in those images. Store screenshots depict the shared online UI and
are illustrative captures, not a claim that all pictured content is offline.

Submission
----------
1. Owner finalizes licensing, public source URL, and the release tag.
2. Generate the final YAML using tools/render_metadata.py.
3. In an fdroiddata checkout, copy it to metadata/com.glosira.app.fdroid.yml.
4. Run fdroid rewritemeta com.glosira.app.fdroid and
   fdroid lint com.glosira.app.fdroid.
5. Run fdroid build --server com.glosira.app.fdroid:5 in the F-Droid build setup.
6. Submit the metadata merge request with build results and these review notes.
The upstream contact is sensei@glosira.com.

References
----------
https://f-droid.org/en/docs/Inclusion_Policy/
https://f-droid.org/en/docs/Submitting_to_F-Droid_Quick_Start_Guide/
https://f-droid.org/en/docs/Build_Metadata_Reference/
https://f-droid.org/en/docs/Anti-Features/