Zerion 3.0.14

Zerion 3.0.14 is a corrective release for 3.0.13. It fixes account creation on devices whose key store cannot look up the app's key before it exists, and makes the build reproduce byte for byte in F-Droid's build environment. It is otherwise identical to 3.0.13.

What is fixed

• First account on some devices. Since 3.0.12 the app refuses to generate
  its Android key store key when the key store throws on the lookup of that
  key, so a temporary key store failure can never replace the key that
  existing profiles depend on. On a fresh installation there is no profile to
  protect, but the guard still applied, and on devices whose key store throws
  when a never-created key is looked up, account creation failed with "Setup
  Failed" on every attempt. Google Play's review device is such a device;
  3.0.12 and 3.0.13 could not be set up there. 3.0.14 generates the key for
  the first account regardless and keeps the guard from then on. The dialog
  now names the cause. No data was ever at risk: the failure happened before
  any profile existed.
• Reproducible in F-Droid's layout. The Argon2 library the app build
  compiles from source is packaged unstripped, like every native library, so
  that the pinned Tor and Monero libraries stay byte-identical; its debug
  sections carried the absolute build directory, so the 3.0.13 APK
  reproduced only from the directory it was built in. The library is now
  compiled without debug sections; its machine code is unchanged. The
  reference APK of this release is the output of fdroid build --test in
  F-Droid's own build layout, signed with the release key.

Contacts on 3.0.12 and 3.0.13 keep working with 3.0.14. Tor stays at 0.4.9.13.

Verifying this build

APK SHA-256	4c6a0e2f063a0e1a203ad54c1378da07900e8765889f1cb869188dd34fdfe108
Signing certificate SHA-256	d7fdb11125890d133ae89d8ba4f4331d9045e21ef01d9899a7cdee6888f704c8
Source commit	7ae2d991b1f0099f79d4b9b6f10013ff65837456
Source tag	v3.0.14
Source tree	51e86ae4b1df48f5dca4ad5378e01a1e474b4214
Tor executable, arm64-v8a	29eb99c78c803cdada5948c193308544f5c30414032c3334c3a83a124fcb9426
Tor executable, armeabi-v7a	418976d0958c8b422d71126e9fe34986657b96672b4fe6059107e41a0f7b8eaa

release-manifest-3.0.14.json records the same values together with the hash
of every native library in the APK and the environment it was built in.
SHA256SUMS.txt covers the attached files.

The APK is the unsigned output of fdroid build --test --on-server com.professor.zerion:31400 in registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie
(F-Droid's build layout, Tor and Monero compiled from pinned source by the
recipe), signed outside the container with the same key as every previous
release. apksigcopier compare against that unsigned output passes and every
entry of the APK is identical.

The F-Droid metadata for 3.0.14 is prepared and pins this commit.

Full notes for every release are in CHANGELOG.md;
the limitations of 3.0.13, both fixed here, are in
SECURITY.md.