build: the F-Droid script takes back every APK released before it updates, so no laptop's run deletes one

Its upload mirrors the working folder with --delete-after, and a folder on
another laptop held none of the APKs released from the first: its run would
have published an index without them and deleted them from halkyon.app.
Each APK the published indexes (repo and archive) name now comes from the
repository first unless the folder has it, its SHA-256 checked against the
index's either way.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

tool/fdroid_repo.sh

@@ -16,8 +16,9 @@
 # SHA-256 is pinned in tool/release/fdroid-index-certificate.sha256: an index
 # signed otherwise would make the F-Droid app refuse the repository. Its password
 # comes from $HALKYON_FDROID_KEYSTORE_PASSWORD, or is asked for; it's never
-# written down. Needs fdroidserver v2.4.5 (pipx), rsync, a JDK, the Android SDK,
+# written down. Needs fdroidserver v2.4.5 (pipx), rsync, curl, jq, a JDK, the Android
-# and the ssh host ramiel-fdroid.
+# SDK, and the ssh host ramiel-fdroid. APKs released before that the working folder
+# lacks come from the repository first (restore, below).
 set -euo pipefail
 cd "$(git rev-parse --show-toplevel)"
 
@@ -43,7 +44,7 @@ case "${1:-}" in
   *) apk="$1" ;;
 esac
 
-for tool in fdroid rsync; do
+for tool in fdroid rsync curl jq; do
   command -v "$tool" >/dev/null || fail "$tool is missing."
 done
 # fdroid takes jarsigner and keytool from the PATH, apksigner from the SDK.
@@ -79,6 +80,39 @@ fi
 
 step 'Updating the F-Droid repository'
 mkdir -p "$working/repo"
+
+# A working folder on another laptop, or a new one, holds none of the APKs released
+# before, and the upload below mirrors it with --delete-after: so every APK the
+# published indexes name (repo and archive) comes from the repository first, unless the
+# folder has it, its SHA-256 checked against the index's either way. The index is the
+# repository's own, over HTTPS; the check guards against a broken download, not
+# against the halkyon.app server.
+restore() {
+  local dir="$1" status name hash type
+  mkdir -p "$working/$dir"
+  status=$(curl -sSL -o "$working/$dir/.published-index" -w '%{http_code}' \
+    "${repo_url%/repo}/$dir/index-v1.json") || fail "Can't reach the published $dir index."
+  case "$status" in
+    200) ;;
+    404) return 0 ;; # nothing published there yet
+    *) fail "The published $dir index answered $status." ;;
+  esac
+  jq -r '.packages[][] | [.apkName, .hash, .hashType] | @tsv' "$working/$dir/.published-index" |
+    while IFS=$'\t' read -r name hash type; do
+      [ "$type" = sha256 ] || fail "$name: the index gives no SHA-256."
+      [[ "$name" =~ ^[A-Za-z0-9._-]+\.apk$ ]] || fail "An APK named $name in the index."
+      if [ ! -f "$working/$dir/$name" ]; then
+        echo "  $dir/$name from the repository"
+        curl -sSfL -o "$working/$dir/$name.part" "${repo_url%/repo}/$dir/$name"
+        mv "$working/$dir/$name.part" "$working/$dir/$name"
+      fi
+      echo "$hash  $working/$dir/$name" | sha256sum --check --quiet ||
+        fail "$dir/$name isn't the APK the index names."
+    done
+  rm "$working/$dir/.published-index"
+}
+restore repo
+restore archive
 cp -r tool/release/fdroid/. "$working/"
 # fdroid refuses a config.yml others can read.
 chmod 600 "$working/config.yml"