Fix release asset ordering so the in-app updater fetches the APK - #686
Merged
Conversation
GitHub's API returns release assets sorted by name, not upload order. The app's checkUpdate() always downloads assets[0], so once build_and_sign.sh started attaching SHA256SUMS.txt and BUILD-INFO.txt alongside the APK, those alphabetically-earlier names could be picked up instead of the APK (#681). Rename the metadata files using the APK filename as a literal prefix so it always sorts first.
checkUpdate() already opened the release's html_url (the GitHub release page) rather than a direct asset link, so tapping the notification was never downloading a raw file. But its title used the first release asset's filename, which is confusing and, per #681, could be a metadata file rather than the APK depending on asset ordering. Use the release's display name (e.g. "Version 2026072702") instead, falling back to a formatted tag if the release has no name.
kasnder
marked this pull request as ready for review
July 28, 2026 07:04
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #681. The GitHub API returns release assets sorted alphabetically by
name, not by upload order — confirmed by inspecting the existing
2026072701release, whose assets came back asBUILD-INFO.txt,SHA256SUMS.txt,TrackerControl-githubRelease-latest.apk(alphabetical),even though
build_and_sign.shlists the APK first on thegh release createcommand line.The app's update checker (
ServiceSinkhole#checkUpdate,app/src/main/java/eu/faircode/netguard/ServiceSinkhole.java:809) alwaysdownloads
assets[0]:So once
scripts/build_and_sign.shstarted attachingSHA256SUMS.txtandBUILD-INFO.txtalongside the signed APK, the updater could end up pointedat a metadata file instead of the APK.
scripts/build_and_sign.sh: rename the metadata assets toTrackerControl-githubRelease-latest.apk.sha256sumsandTrackerControl-githubRelease-latest.apk.build-info.txt. Using the APKfilename as a literal prefix guarantees the APK sorts first under any
lexicographic comparison (a string is always ordered before any longer
string it's a strict prefix of), regardless of case-folding rules — so
this holds even if GitHub's actual sort semantics change.
docs/RELEASING.md: updated the documented asset list and noted why thenaming matters.
Test plan
bash -n scripts/build_and_sign.sh2026072701/2026072702release assetdata via the GitHub API that assets are sorted by name.
APK first and the in-app updater picks it up.
Generated by Claude Code