Point the recipe at 1.11.4

AGENTS.md

@@ -34,13 +34,24 @@ Regenerate code after editing anything under generation:
   the template; every key added there must also be added to `app_de.arb`.
 
 **`SECURITY.md` states facts, not intentions**, and a change can make one of them false
-without touching it: that exactly one host is contacted (`api.transitous.org`), that the
-Android build asks for one permission (`INTERNET`), that there is no telemetry of any kind,
-and the list of foreign files the app parses. A second host — a map's tile server is the
-obvious one — a new permission, an analytics or crash-reporting dependency, or another
-format read from outside all turn a sentence there into a false claim about what the app
-does with someone's data. Correct it in the same commit; a security policy that has drifted
-is worse than none, because people rely on it.
+without touching it: which hosts are contacted (`api.transitous.org` for a connection
+search, `tile.openstreetmap.org` while a map is open, and nothing else), which permissions
+the app asks for and which its libraries merge in, that there is no telemetry of any kind,
+and the list of foreign files the app parses. A third host, a new permission, an analytics
+or crash-reporting dependency, or another format read from outside all turn a sentence
+there into a false claim about what the app does with someone's data. Correct it in the
+same commit; a security policy that has drifted is worse than none, because people rely
+on it.
+
+Both of those first two facts have already drifted once, which is why they are named as
+a pair. The tile server arrived with the map and left a file still saying one host; the
+five permissions androidx `work-runtime` merges in through `home_widget`'s Glance
+dependency left it saying four, and neither was noticed here: the second surfaced only
+when **F-Droid's code-quality report printed the list off the built APK**, which is what
+their store page publishes too — so what the manifest merger produces is on show whether
+or not this repository mentions it. The number to check is therefore the one in the APK (`androguard axml`, or the merger's own report under
+`build/app/outputs/logs/`), never the count of `uses-permission` lines in
+`android/app/src/main/AndroidManifest.xml`.
 
 ## Architecture
 

SECURITY.md

@@ -219,7 +219,7 @@ and hands back one file the user chose. The app never enumerates a gallery or a
 directory, and there is no camera capture.
 
 **Nothing else leaves the device.** There is no analytics, no crash reporting,
-and no telemetry of any kind, and the Android build declares four permissions:
+and no telemetry of any kind. This app declares four permissions of its own:
 `INTERNET`; `ACCESS_FINE_LOCATION` / `ACCESS_COARSE_LOCATION`, asked for only
 when the locate button is pressed; and `ACCESS_MEDIA_LOCATION`, asked for only
 when *Read where a photo was taken* is switched on in settings. The two location
@@ -228,6 +228,19 @@ between an exact and an approximate position; the app works either way. The medi
 one is granted to nobody until it is asked for, and the app works without it — a
 photograph simply attaches without the place it was taken.
 
+**The installed APK lists nine, and the other five are not this app's doing** —
+which is worth saying, because it is the list Android shows you and not the one
+above. `WAKE_LOCK`, `ACCESS_NETWORK_STATE`, `RECEIVE_BOOT_COMPLETED` and
+`FOREGROUND_SERVICE` are merged into the manifest by androidx `work-runtime`,
+which arrives through `home_widget`'s dependency on Glance — a widget toolkit
+this app does not use, its home-screen widget being ordinary `RemoteViews`. The
+ninth, `dev.calyptra.pappus.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION`, is
+generated by androidx `core` and is a signature-level permission, meaning only
+code signed with the same key as this app can hold it. None of the five is
+requested at runtime, none is reachable from anything the app does, and none of
+them is a *runtime* permission in Android's sense — no dialog exists that could
+grant them. They are declared because a library declared them.
+
 The Android build also links **no Google Play Services code at all**. Positioning
 goes through Android's own `LocationManager`, using a copy of the `geolocator`
 Android plugin with the Play Services client removed

fdroid/metadata/dev.calyptra.pappus.yml

@@ -1,3 +1,9 @@
+AntiFeatures:
+  TetheredNet:
+    en-US: Journey planning always goes to api.transitous.org, and map tiles always
+      come from tile.openstreetmap.org. Neither can be pointed at a different instance
+      from within the app. Both are contacted only when a search is run or the map
+      is opened; the app is otherwise offline.
 Categories:
   - Finance Manager
   - Navigation
@@ -18,7 +24,7 @@ Repo: https://github.com/Calyptra-Software/PappusTravelPlanner.git
 Builds:
   - versionName: 1.11.4
     versionCode: 4021
-    commit: 63ee5ac35f0645d2e6b4162f341c1930ee070cf3
+    commit: f5e0604134d7d8ae665cd18c1180a13b16915c55
     sudo:
       - mkdir -p /home/runner/work/PappusTravelPlanner
       - chown -R vagrant /home/runner
@@ -61,7 +67,7 @@ Builds:
 
   - versionName: 1.11.4
     versionCode: 4022
-    commit: 63ee5ac35f0645d2e6b4162f341c1930ee070cf3
+    commit: f5e0604134d7d8ae665cd18c1180a13b16915c55
     sudo:
       - mkdir -p /home/runner/work/PappusTravelPlanner
       - chown -R vagrant /home/runner
@@ -104,7 +110,7 @@ Builds:
 
   - versionName: 1.11.4
     versionCode: 4023
-    commit: 63ee5ac35f0645d2e6b4162f341c1930ee070cf3
+    commit: f5e0604134d7d8ae665cd18c1180a13b16915c55
     sudo:
       - mkdir -p /home/runner/work/PappusTravelPlanner
       - chown -R vagrant /home/runner