initial: fdroidserver-ipfs image

Downstream of registry.gitlab.com/fdroid/docker-executable-fdroidserver:master,
patched for publishing F-Droid repos over IPFS:

  - install Debian ipfs-cid so fdroidserver populates ipfsCIDv1 on every
    package file (APKs, icons, screenshots), which fdroidclient with an
    IPFS-gateway mirror routes via CID natively
  - rehash.py wrapper that adds ipfsCIDv1 to entry["index"], renames the
    index to a content-addressed filename, and re-signs entry.jar after
    `fdroid update` — closes the cache-busting gap on the index file itself
  - entrypoint.sh chains rehash automatically after any `fdroid update`,
    so existing fdroid-via-docker wrappers need no changes

See SPEC.md for the rationale and Change 2's algorithm; README.md for
end-user usage.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,54 @@
+# fdroidserver-ipfs: docker-executable-fdroidserver patched for IPFS publishing.
+#
+# Two changes vs. upstream (see SPEC.md):
+#   1. Install ipfs-cid so fdroidserver populates ipfsCIDv1 on all package
+#      files (APKs, icons, screenshots). fdroidclient with an IPFS-gateway
+#      mirror configured then fetches those by CID.
+#   2. Install rehash.py as `fdroidserver-ipfs-rehash` — a post-`fdroid update`
+#      wrapper that adds ipfsCIDv1 to entry["index"], renames the index to a
+#      content-addressed filename, and re-signs entry.jar. Run it once after
+#      every `fdroid update`.
+#
+# Base is pinned via build-arg. The weekly cron in .gitea/workflows/build.yaml
+# picks up upstream :master refreshes without a source change.
+
+ARG FDROIDSERVER_IMAGE=registry.gitlab.com/fdroid/docker-executable-fdroidserver:master
+ARG IMAGE_SOURCE=
+
+FROM ${FDROIDSERVER_IMAGE}
+ARG IMAGE_SOURCE
+
+# Links the published OCI package to its source repo so Gitea inherits
+# visibility (public repo → publicly pullable image, no auth needed).
+LABEL org.opencontainers.image.source="${IMAGE_SOURCE}"
+LABEL org.opencontainers.image.description="fdroidserver with ipfs-cid + post-update CID/cache-bust wrapper for IPFS publishing."
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+
+# Change 1. Debian's ipfs-cid package installs the `ipfs_cid` *binary* that
+# fdroidserver finds via shutil.which(). The PyPI package of the same name
+# is a Python library only and ships no binary — using pip would silently
+# leave CID generation disabled.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ipfs-cid \
+ && rm -rf /var/lib/apt/lists/*
+
+# Change 2.
+COPY rehash.py /usr/local/bin/fdroidserver-ipfs-rehash
+RUN chmod +x /usr/local/bin/fdroidserver-ipfs-rehash
+
+# Override the upstream entrypoint so `fdroid update` automatically chains
+# into `fdroidserver-ipfs-rehash`. Drop-in for the wrapper script — callers
+# don't change their invocation.
+COPY entrypoint.sh /usr/local/bin/fdroidserver-ipfs-entrypoint
+RUN chmod +x /usr/local/bin/fdroidserver-ipfs-entrypoint
+ENTRYPOINT ["/usr/local/bin/fdroidserver-ipfs-entrypoint"]
+CMD ["--help"]
+
+# Sanity gate: source bsenv.sh (the upstream entrypoint does the same) so
+# ${fdroidserver} resolves, then verify every component our additions touch.
+RUN . /etc/profile.d/bsenv.sh \
+ && command -v ipfs_cid \
+ && test -x "${fdroidserver}/fdroid" \
+ && command -v fdroidserver-ipfs-rehash \
+ && command -v fdroidserver-ipfs-entrypoint \
+ && PYTHONPATH="${fdroidserver}" python3 -c "from fdroidserver import common, signindex"