[Distribution] Reproducible builds

[chtnnh]

Parent

Part of #79 (app distribution). Already listed under README “What is not built yet.”

Summary

Users who follow site trust guidance (“compile it yourself, or take it from a source you trust”) still cannot independently verify that a published APK matches this repository without reproducible builds.

Why it matters

For a protest tool, third-party rebuilds and checksums of source → binary matter more than store badges. Without reproducibility, Releases are “trust the maintainer’s CI” only.

Proposed direction

• Define toolchain pin (NDK, JDK, Expo/prebuild inputs, Gradle)
• Document a hermetic rebuild recipe that matches CI output byte-for-byte (or explain intentional differences)
• Publish rebuild instructions next to Releases / download page

Done when

• Documented recipe produces a matching APK (or documented, reviewable deltas)
• CI or a script checks reproducibility on release tags
• README item can move from “not built yet” to “how to verify”

Related

Signing + Releases children of #79; does not replace production signing.