fix(fdroid): pin the toolchain inside the recipe, not the whole repo

A root rust-toolchain.toml moved every build and CI job to the April
stable, when the recipe is the only thing that needs a fixed rustc.
scripts/fdroid-build.sh now installs 1.98.0 and tauri-cli 2.9.6 itself, so
the workflows and the fdroiddata metadata carry no version of their own.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: JSKitty

.github/workflows/fdroid.yaml

@@ -16,7 +16,6 @@ on:
       - docs/fdroid/**
       - package.json
       - package-lock.json
-      - rust-toolchain.toml
       - src-tauri/Cargo.toml
       - src-tauri/Cargo.lock
       - src-tauri/tauri.fdroid.conf.json
@@ -37,11 +36,9 @@ jobs:
         with:
           node-version: 20
 
-      # Reads rust-toolchain.toml, the same pin F-Droid's recipe installs.
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: 1.95.0
-          targets: aarch64-linux-android
+      # Only rustup is needed here; scripts/fdroid-build.sh installs the
+      # toolchain it pins.
+      - uses: dtolnay/rust-toolchain@stable
 
       - uses: actions/setup-java@v4
         with:
@@ -60,9 +57,6 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y cmake clang libclang-dev pkg-config
 
-      - name: Tauri CLI from source
-        run: cargo install tauri-cli --version 2.9.6 --locked
-
       - name: Prepare (network stage)
         run: scripts/fdroid-build.sh prepare
 

.github/workflows/publish.yaml

@@ -276,10 +276,9 @@ jobs:
         with:
           node-version: 20
 
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: 1.95.0
-          targets: aarch64-linux-android
+      # Only rustup is needed here; scripts/fdroid-build.sh installs the
+      # toolchain it pins.
+      - uses: dtolnay/rust-toolchain@stable
 
       - uses: actions/setup-java@v4
         with:
@@ -298,9 +297,6 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y cmake clang libclang-dev pkg-config
 
-      - name: Tauri CLI from source
-        run: cargo install tauri-cli --version 2.9.6 --locked
-
       - name: Build the F-Droid flavour
         run: scripts/fdroid-build.sh
 

docs/fdroid/README.md

@@ -76,8 +76,8 @@ tag matches it (F-Droid strips both signatures and compares), uncomment `Binarie
 `AllowedAPKSigningKeys` in the metadata. From then on F-Droid publishes Vector's own signature, and
 the app carries the reproducible badge.
 
-What already holds the two builds together: the pinned Rust toolchain (`rust-toolchain.toml`), NDK
-`29.0.14206865`, `tauri-cli` 2.9.6, `--remap-path-prefix` on every path that differs between
+What already holds the two builds together: the Rust toolchain and `tauri-cli` versions pinned at
+the top of `scripts/fdroid-build.sh`, NDK `29.0.14206865`, `--remap-path-prefix` on every path that differs between
 machines, and `SOURCE_DATE_EPOCH` from the commit. What can still break it and has not been
 measured yet: whisper.cpp's cmake build, R8 output across JDK builds, and Gradle's APK packaging.
 The first F-Droid build of a tag will say which, in their `verification` log.

docs/fdroid/io.vectorapp.yml

@@ -43,10 +43,6 @@ Builds:
     ndk: 29.0.14206865
     prebuild:
       - cd ../../../..
-      - export PATH="$HOME/.cargo/bin:$PATH"
-      - rustup toolchain install 1.95.0 --profile minimal --target aarch64-linux-android
-      - rustup default 1.95.0
-      - cargo install tauri-cli --version 2.9.6 --locked
       - scripts/fdroid-build.sh prepare
     build:
       - cd ../../../..

rust-toolchain.toml

@@ -17,7 +17,15 @@ export ANDROID_NDK_HOME="$NDK_HOME"
 export ANDROID_NDK="$NDK_HOME"   # cmake's Android toolchain (whisper.cpp)
 export PATH="$HOME/.cargo/bin:$PATH"
 
+# The one place the toolchain is pinned: F-Droid's rebuild has to compile
+# with the same rustc and Tauri CLI as the released flavour it is compared to.
+RUST_TOOLCHAIN=1.98.0
+TAURI_CLI_VERSION=2.9.6
+export RUSTUP_TOOLCHAIN="$RUST_TOOLCHAIN"
+
 prepare() {
+    rustup toolchain install "$RUST_TOOLCHAIN" --profile minimal --target aarch64-linux-android
+    cargo install tauri-cli --version "$TAURI_CLI_VERSION" --locked
     npm ci --ignore-scripts
     # Globs expand here, after npm ci: a fresh clone has no node_modules yet.
     rm -rf node_modules/@tauri-apps/cli node_modules/@tauri-apps/cli-* \