release: 2.0.1, sign without re-aligning so F-Droid can reproduce the APK

[pasichDev]

Merge order: this PR → tag v2.0.1 → update fdroiddata !50123 to 2.0.1.

What

• release.yml signs with apksigner --alignment-preserved true --v1-signing-enabled false.
• Version 2.0.1 (versionCode 20001): CHANGELOG section and changelogs/20001.txt in all 9 locales. No app code changes.

Why

F-Droid's build of v2.0.0 is byte-identical to ours (same sha256 as a local unsigned build), but the published APK did not verify after F-Droid copied its signature onto that build (CHUNKED_SHA512 digest mismatch). apksigner replaced AGP's zero-byte alignment padding with its own 0xd935 extra field, which moved every uncompressed entry by 4 bytes. With the alignment preserved, the signed APK is the unsigned zip plus the signing block. The v1 scheme is not needed at minSdk 26.

The 2.0.0 APK already on GitHub cannot be matched, so F-Droid starts from 2.0.1.

Testing

• Signed F-Droid's own unsigned build with a throwaway key using the new flags: apksigcopier compare passes. The same check on the published 2.0.0 APK reproduces F-Droid's error.
• StoreMetadataTest passes (CHANGELOG versionCode matches version.properties).

Not verified: the release workflow itself; it runs on the v2.0.1 tag.

[github-actions]

Coverage (core/security)

Overall Project	68.54%	🍏

There is no coverage information present for the Files changed