diff --git a/tests/run-tests b/tests/run-tests
index 7e3f0c13..360605ab 100755
--- a/tests/run-tests
+++ b/tests/run-tests
@@ -6,158 +6,12 @@ echo_header() {
     { echo -e "==============================================================================\n$1"; } 2>/dev/null
 }
 
-get_fdroid_apk_filename() {
-    if [ -z $aapt ]; then
-        appid=$(androguard apkid "$1" | sed -En 's/ +"([a-z][^"]+)",$/\1/ip')
-        versionCode=$(androguard apkid "$1" | sed -En 's/ +"([0-9]+)",$/\1/p')
-        echo "${appid}_${versionCode}.apk"
-    else
-        $aapt dump badging "$1" | sed -n "s,^package: name='\(.*\)' versionCode='\([0-9][0-9]*\)' .*,\1_\2.apk,p"
-    fi
-}
-
-copy_apks_into_repo() {
-    set +x
-    find $APKDIR -type f -name '*.apk' -print0 | while IFS= read -r -d '' f; do
-        echo $f | grep -F -v -e unaligned -e unsigned -e badsig -e badcert -e bad-unicode -e janus.apk || continue
-        apk=`get_fdroid_apk_filename "$f"`
-        test "$f" -nt repo/$apk && rm -f repo/$apk  # delete existing if $f is newer
-        if [ ! -e repo/$apk ] && [ ! -e archive/$apk ]; then
-            echo "$f --> repo/$apk"
-            ln "$f" $1/repo/$apk || \
-                rsync -axv "$f" $1/repo/$apk # rsync if hard link is not possible
-	    touch $1/.found-apks
-        fi
-    done
-    if [ ! -e $1/.found-apks ]; then
-	echo "ERROR: The dir APKDIR must have APKs in it! $APKDIR does not."
-	exit 1
-    fi
-    set -x
-}
-
-# keep this as an old version to test the automatic parsing of build-tools
-# verion numbers in `fdroid init`
-create_fake_android_home() {
-    mkdir $1/tools
-    mkdir $1/platform-tools
-    mkdir $1/build-tools
-    mkdir $1/build-tools/19.0.2
-    touch $1/build-tools/19.0.2/aapt
-}
-
-create_test_dir() {
-    test -e $WORKSPACE/.testfiles || mkdir $WORKSPACE/.testfiles
-    mktemp -d $WORKSPACE/.testfiles/run-tests.XXXX
-}
-
-create_test_file() {
-    test -e $WORKSPACE/.testfiles || mkdir $WORKSPACE/.testfiles
-    TMPDIR=$WORKSPACE/.testfiles  mktemp
-}
-
-fdroid_init_with_prebuilt_keystore() {
-    if [ -z "$1" ]; then
-        keystore=$WORKSPACE/tests/keystore.jks
-    else
-        keystore="$1"
-    fi
-    $fdroid init --keystore $keystore --repo-keyalias=sova
-    echo 'keystorepass: r9aquRHYoI8+dYz6jKrLntQ5/NJNASFBacJh7Jv2BlI=' >> config.yml
-    echo 'keypass: r9aquRHYoI8+dYz6jKrLntQ5/NJNASFBacJh7Jv2BlI=' >> config.yml
-}
-
-is_MD5_disabled() {
-    javac $WORKSPACE/tests/IsMD5Disabled.java && java -cp $WORKSPACE/tests IsMD5Disabled
-}
-
-use_apksigner() {
-    python3 -c "
-import sys
-sys.path.insert(0, '$WORKSPACE')
-from fdroidserver import common
-c = {'sdk_path': '$ANDROID_HOME'}
-common.find_apksigner(c)
-exit(c.get('apksigner') is None)
-"
-}
-
-err_handler() {
-# remove this to prevent git conflicts and complaining
-    set +x
-    rm -rf "$WORKSPACE"/fdroidserver.egg-info/
-    rm -rf "$WORKSPACE"/.testfiles/run-tests.*
-    rm -rf "$WORKSPACE"/.testfiles/test_*
-    rm -f "$WORKSPACE"/.testfiles/tmp.*
-    test -d "$WORKSPACE"/.testfiles && \
-	(rmdir "$WORKSPACE"/.testfiles 2> /dev/null || \
-             rmdir --ignore-fail-on-non-empty "$WORKSPACE"/.testfiles 2> /dev/null)
-}
-
-trap err_handler INT EXIT
-
 #------------------------------------------------------------------------------#
-# "main"
-
-if [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
-    set +x
-    echo "Usage: $0 '/path/to/folder/with/apks'"
-    exit 1
-fi
-
-if [ -z "$ANDROID_HOME" ]; then
-    if python3 -c "import androguard"; then
-        echo "ANDROID_HOME is not set, using androguard"
-    else
-        echo "ERROR: ANDROID_HOME is not set, androguard is not available!"
-        exit 1
-    fi
-else
-    echo "Using ANDROID_HOME=$ANDROID_HOME"
-fi
 
 if [ -d tests ]; then
     cd tests
 fi
 
-if [ -z "$1" ]; then
-    APKDIR=`pwd`
-else
-    APKDIR=$1
-fi
-if [ ! -d "$APKDIR" ]; then
-    echo "ERROR: '$APKDIR' does not exist!"
-    exit 1
-fi
-
-if [ -z "$WORKSPACE" ]; then
-    WORKSPACE="$(dirname "$(pwd)")"
-    echo "Setting Workspace to $WORKSPACE"
-fi
-
-# allow the location of the script to be overridden
-if [ -z "$fdroid" ]; then
-    fdroid="$WORKSPACE/fdroid"
-fi
-
-# allow the location of aapt to be overridden
-if [ -z "$aapt" ]; then
-    aapt=`ls -1 $ANDROID_HOME/build-tools/*/aapt 2> /dev/null | sort | tail -1`
-fi
-
-# try to use GNU sed on OSX/BSD cuz BSD sed sucks
-if which gsed; then
-    sed="gsed"
-else
-    sed="sed"
-fi
-
-# allow the location of git to be overridden
-if [ -z "$git" ]; then
-    # shellcheck disable=SC2089
-    git="env HOME= GIT_AUTHOR_NAME='Test' GIT_AUTHOR_EMAIL='no@mail' GIT_COMMITTER_NAME='Test' GIT_COMMITTER_EMAIL='no@mail' git"
-fi
-
 set -x # show each command as it is executed
 
 #------------------------------------------------------------------------------#
@@ -166,1283 +20,9 @@ echo_header "run commit hooks"
 cd $WORKSPACE
 test -x ./hooks/pre-commit && ./hooks/pre-commit
 
-
 #------------------------------------------------------------------------------#
 echo_header "run unit tests"
 
 python3 -m unittest -v
 
-#------------------------------------------------------------------------------#
-echo_header "print fdroid version"
-
-$fdroid --version
-
-
-#------------------------------------------------------------------------------#
-echo_header 'run process when building and signing are on separate machines'
-
-if use_apksigner; then
-    REPOROOT=`create_test_dir`
-    cd $REPOROOT
-    cp $WORKSPACE/tests/keystore.jks $REPOROOT/
-    $fdroid init --keystore keystore.jks --repo-keyalias=sova
-    echo 'make_current_version_link: true' >> config.yml
-    echo 'keystorepass: r9aquRHYoI8+dYz6jKrLntQ5/NJNASFBacJh7Jv2BlI=' >> config.yml
-    echo 'keypass: r9aquRHYoI8+dYz6jKrLntQ5/NJNASFBacJh7Jv2BlI=' >> config.yml
-    echo 'keydname: "CN=Birdman, OU=Cell, O=Alcatraz, L=Alcatraz, S=California, C=US"' >> config.yml
-    test -d archive || mkdir archive
-    test -d metadata || mkdir metadata
-    cp $WORKSPACE/tests/metadata/info.guardianproject.urzip.yml metadata/
-    test -d repo || mkdir repo
-    test -d unsigned || mkdir unsigned
-    cp $WORKSPACE/tests/urzip-release-unsigned.apk unsigned/info.guardianproject.urzip_100.apk
-    $fdroid publish --verbose
-    $fdroid update --verbose --nosign
-    $fdroid signindex --verbose
-    test -e repo/index.xml
-    test -e repo/index.jar
-    test -e repo/index-v1.jar
-    test -e tmp/apkcache.json
-    ! test -z tmp/apkcache.json
-    test -L urzip.apk
-    grep -F '<application id=' repo/index.xml > /dev/null
-fi
-
-
-#------------------------------------------------------------------------------#
-echo_header "test UTF-8 metadata"
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-
-fdroid_init_with_prebuilt_keystore
-$sed -i.tmp 's,^ *repo_description.*,repo_description: |\n  获取已安装在您的设备上的应用的,' config.yml
-echo "mirrors: ['https://foo.bar/fdroid', 'http://secret.onion/fdroid']" >> config.yml
-mkdir metadata
-cp $WORKSPACE/tests/urzip.apk $WORKSPACE/tests/bad-unicode*.apk repo/
-cp $WORKSPACE/tests/metadata/info.guardianproject.urzip.yml metadata/
-
-$fdroid readmeta
-$fdroid update
-
-
-#------------------------------------------------------------------------------#
-echo_header 'copy git import and run "fdroid scanner" on it'
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-mkdir metadata
-echo "AutoName: Just A Test" > metadata/org.fdroid.ci.test.app.yml
-echo "WebSite: " >> metadata/org.fdroid.ci.test.app.yml
-echo "Builds:" >> metadata/org.fdroid.ci.test.app.yml
-echo " - versionName: 0.3" >> metadata/org.fdroid.ci.test.app.yml
-echo "   versionCode: 300" >> metadata/org.fdroid.ci.test.app.yml
-echo "   commit: 0.3" >> metadata/org.fdroid.ci.test.app.yml
-echo "   subdir: app" >> metadata/org.fdroid.ci.test.app.yml
-echo "   gradle:" >> metadata/org.fdroid.ci.test.app.yml
-echo "     - yes" >> metadata/org.fdroid.ci.test.app.yml
-echo "" >> metadata/org.fdroid.ci.test.app.yml
-echo "Repo: https://gitlab.com/fdroid/ci-test-app.git" >> metadata/org.fdroid.ci.test.app.yml
-echo "RepoType: git" >> metadata/org.fdroid.ci.test.app.yml
-mkdir build
-git clone https://gitlab.com/fdroid/ci-test-app.git build/org.fdroid.ci.test.app
-ls -l build/org.fdroid.ci.test.app
-$fdroid scanner org.fdroid.ci.test.app --verbose
-
-
-#------------------------------------------------------------------------------#
-echo_header "copy tests/repo, generate java/gpg keys, update, and gpgsign"
-
-REPOROOT=`create_test_dir`
-GNUPGHOME=$REPOROOT/gnupghome
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-cp -a \
-   $WORKSPACE/tests/config \
-   $WORKSPACE/tests/metadata \
-   $WORKSPACE/tests/repo \
-   $REPOROOT/
-cp -a $WORKSPACE/tests/gnupghome $GNUPGHOME
-chmod 0700 $GNUPGHOME
-echo "install_list: org.adaway" >> config.yml
-echo "uninstall_list: [com.android.vending, com.facebook.orca]" >> config.yml
-echo "gpghome: $GNUPGHOME" >> config.yml
-echo "gpgkey: CE71F7FB" >> config.yml
-echo "mirrors: ['http://foobarfoobarfoobar.onion/fdroid', 'https://foo.bar/fdroid']" >> config.yml
-$fdroid update --verbose --pretty
-test -e repo/index.xml
-test -e repo/index.jar
-test -e repo/index-v1.jar
-grep -F '<application id=' repo/index.xml > /dev/null
-grep -F '<install packageName=' repo/index.xml > /dev/null
-grep -F '<uninstall packageName=' repo/index.xml > /dev/null
-# OSX tests are run on Travis-CI, and gpg fails to launch gpg-agent there
-if [ "$TRAVIS_OS_NAME" != "osx" ] && which gpg; then
-    $fdroid gpgsign --verbose
-    $fdroid gpgsign --verbose
-    test -e repo/obb.mainpatch.current_1619.apk.asc
-    test -e repo/obb.main.twoversions_1101617_src.tar.gz.asc
-    ! test -e repo/obb.mainpatch.current_1619.apk.asc.asc
-    ! test -e repo/obb.main.twoversions_1101617_src.tar.gz.asc.asc
-    ! test -e repo/index.xml.asc
-fi
-
-v0timestamp=`$sed -n -e 's,.*timestamp="\([0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]\)".*,\1,p' repo/index.xml`
-v1timestamp=`$sed -n -e 's,.*"timestamp": \([0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]\).*,\1,p' repo/index-v1.json`
-test $v0timestamp -eq $v1timestamp
-
-# we can't easily reproduce the timestamps for things, so just hardcode them
-$sed -i.tmp -e 's,timestamp="[0-9]*",timestamp="1676634233",' repo/index.xml
-diff -uw $WORKSPACE/tests/repo/index.xml repo/index.xml
-$sed -i --expression='s,"timestamp": [0-9]*,"timestamp": 1676634233000,' repo/index-v1.json
-diff -uw $WORKSPACE/tests/repo/index-v1.json repo/index-v1.json
-$sed -z 's/,\s*"ipfsCIDv1": *"[a-z0-9]*"//g' $WORKSPACE/tests/repo/index-v2.json > repo/index-v2.org.json
-$sed -z 's/,\s*"ipfsCIDv1": *"[a-z0-9]*"//g' repo/index-v2.json > repo/index-v2.mod.json
-$sed -i --expression='s,"timestamp": [0-9]*,"timestamp": 1676634233000,' repo/index-v2.mod.json
-diff -uw repo/index-v2.org.json repo/index-v2.mod.json
-
-
-#------------------------------------------------------------------------------#
-echo_header 'test moving lots of APKs to the archive'
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-$sed -i.tmp '/allow_disabled_algorithms/d' config.yml
-test -d metadata || mkdir metadata
-cp $WORKSPACE/tests/metadata/*.yml metadata/
-echo 'Summary: good test version of urzip' > metadata/info.guardianproject.urzip.yml
-echo 'Summary: good MD5 sig, which is disabled algorithm' > metadata/org.bitbucket.tickytacky.mirrormirror.yml
-$sed -i.tmp '/ArchivePolicy:/d' metadata/*.yml
-test -d repo || mkdir repo
-cp $WORKSPACE/tests/urzip.apk \
-   $WORKSPACE/tests/org.bitbucket.tickytacky.mirrormirror_[0-9].apk \
-   $WORKSPACE/tests/repo/com.politedroid_[0-9].apk \
-   $WORKSPACE/tests/repo/obb.main.twoversions_110161[357].apk \
-   repo/
-printf '\narchive_older: 3\n' >> config.yml
-
-$fdroid update --pretty --nosign
-if use_apksigner; then
-    test `grep '<package>' archive/index.xml | wc -l` -eq 2
-    test `grep '<package>' repo/index.xml | wc -l` -eq 10
-else
-    echo "This will fail when jarsigner allows MD5 for APK signatures"
-    test `grep '<package>' archive/index.xml | wc -l` -eq 5
-    test `grep '<package>' repo/index.xml | wc -l` -eq 7
-fi
-
-
-#------------------------------------------------------------------------------#
-if ! use_apksigner; then
-    echo_header 'test per-app "Archive Policy"'
-
-    REPOROOT=`create_test_dir`
-    cd $REPOROOT
-    fdroid_init_with_prebuilt_keystore
-    test -d metadata || mkdir metadata
-    cp $WORKSPACE/tests/metadata/com.politedroid.yml metadata/
-    test -d repo || mkdir repo
-    cp $WORKSPACE/tests/repo/com.politedroid_[0-9].apk repo/
-    printf '\narchive_older: 3\n' >> config.yml
-
-    $fdroid update --pretty --nosign
-    test `grep '<package>' archive/index.xml | wc -l` -eq 0
-    test `grep '<package>' repo/index.xml | wc -l` -eq 4
-    grep -F com.politedroid_3.apk repo/index.xml
-    grep -F com.politedroid_4.apk repo/index.xml
-    grep -F com.politedroid_5.apk repo/index.xml
-    grep -F com.politedroid_6.apk repo/index.xml
-    test -e repo/com.politedroid_3.apk
-    test -e repo/com.politedroid_4.apk
-    test -e repo/com.politedroid_5.apk
-    test -e repo/com.politedroid_6.apk
-
-    echo "enable one app in the repo"
-    $sed -i.tmp 's,^ArchivePolicy: 4,ArchivePolicy: 1,' metadata/com.politedroid.yml
-    $fdroid update --pretty --nosign
-    test `grep '<package>' archive/index.xml | wc -l` -eq 3
-    test `grep '<package>' repo/index.xml | wc -l` -eq 1
-    grep -F com.politedroid_3.apk archive/index.xml
-    grep -F com.politedroid_4.apk archive/index.xml
-    grep -F com.politedroid_5.apk archive/index.xml
-    grep -F com.politedroid_6.apk repo/index.xml
-    test -e archive/com.politedroid_3.apk
-    test -e archive/com.politedroid_4.apk
-    test -e archive/com.politedroid_5.apk
-    test -e repo/com.politedroid_6.apk
-
-    echo "remove all apps from the repo"
-    $sed -i.tmp 's,^ArchivePolicy: 1,ArchivePolicy: 0,' metadata/com.politedroid.yml
-    $fdroid update --pretty --nosign
-    test `grep '<package>' archive/index.xml | wc -l` -eq 4
-    test `grep '<package>' repo/index.xml | wc -l` -eq 0
-    grep -F com.politedroid_3.apk archive/index.xml
-    grep -F com.politedroid_4.apk archive/index.xml
-    grep -F com.politedroid_5.apk archive/index.xml
-    grep -F com.politedroid_6.apk archive/index.xml
-    test -e archive/com.politedroid_3.apk
-    test -e archive/com.politedroid_4.apk
-    test -e archive/com.politedroid_5.apk
-    test -e archive/com.politedroid_6.apk
-    ! test -e repo/com.politedroid_6.apk
-
-    echo "move back one from archive to the repo"
-    $sed -i.tmp 's,^ArchivePolicy: 0,ArchivePolicy: 1,' metadata/com.politedroid.yml
-    $fdroid update --pretty --nosign
-    test `grep '<package>' archive/index.xml | wc -l` -eq 3
-    test `grep '<package>' repo/index.xml | wc -l` -eq 1
-    grep -F com.politedroid_3.apk archive/index.xml
-    grep -F com.politedroid_4.apk archive/index.xml
-    grep -F com.politedroid_5.apk archive/index.xml
-    grep -F com.politedroid_6.apk repo/index.xml
-    test -e archive/com.politedroid_3.apk
-    test -e archive/com.politedroid_4.apk
-    test -e archive/com.politedroid_5.apk
-    ! test -e archive/com.politedroid_6.apk
-    test -e repo/com.politedroid_6.apk
-
-    echo "set an earlier version as CVC and test that it's the only one not archived"
-    $sed -i.tmp 's,^CurrentVersionCode: 6,CurrentVersionCode: 5,' metadata/com.politedroid.yml
-    $fdroid update --pretty --nosign
-    test `grep '<package>' archive/index.xml | wc -l` -eq 3
-    test `grep '<package>' repo/index.xml | wc -l` -eq 1
-    grep -F com.politedroid_3.apk archive/index.xml
-    grep -F com.politedroid_4.apk archive/index.xml
-    grep -F com.politedroid_5.apk repo/index.xml
-    grep -F com.politedroid_6.apk archive/index.xml
-    test -e archive/com.politedroid_3.apk
-    test -e archive/com.politedroid_4.apk
-    test -e repo/com.politedroid_5.apk
-    ! test -e repo/com.politedroid_6.apk
-    test -e archive/com.politedroid_6.apk
-fi
-
-
-#------------------------------------------------------------------------------#
-echo_header 'test moving old APKs to and from the archive'
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-test -d metadata || mkdir metadata
-cp $WORKSPACE/tests/metadata/com.politedroid.yml metadata/
-$sed -i.tmp '/ArchivePolicy:/d' metadata/com.politedroid.yml
-test -d repo || mkdir repo
-cp $WORKSPACE/tests/repo/com.politedroid_[0-9].apk repo/
-printf '\narchive_older: 3\n' >> config.yml
-
-$fdroid update --pretty --nosign
-test `grep '<package>' archive/index.xml | wc -l` -eq 1
-test `grep '<package>' repo/index.xml | wc -l` -eq 3
-grep -F com.politedroid_3.apk archive/index.xml
-grep -F com.politedroid_4.apk repo/index.xml
-grep -F com.politedroid_5.apk repo/index.xml
-grep -F com.politedroid_6.apk repo/index.xml
-test -e archive/com.politedroid_3.apk
-test -e repo/com.politedroid_4.apk
-test -e repo/com.politedroid_5.apk
-test -e repo/com.politedroid_6.apk
-
-$sed -i.tmp 's,archive_older: 3,archive_older: 1,' config.yml
-$fdroid update --pretty --nosign
-test `grep '<package>' archive/index.xml | wc -l` -eq 3
-test `grep '<package>' repo/index.xml | wc -l` -eq 1
-grep -F com.politedroid_3.apk archive/index.xml
-grep -F com.politedroid_4.apk archive/index.xml
-grep -F com.politedroid_5.apk archive/index.xml
-grep -F com.politedroid_6.apk repo/index.xml
-test -e archive/com.politedroid_3.apk
-test -e archive/com.politedroid_4.apk
-test -e archive/com.politedroid_5.apk
-test -e repo/com.politedroid_6.apk
-
-# disabling deletes from the archive
-$sed -i.tmp 's/\(versionCode: 4\)/\1\n    disable: testing deletion/' metadata/com.politedroid.yml
-$fdroid update --pretty --nosign
-test `grep '<package>' archive/index.xml | wc -l` -eq 2
-test `grep '<package>' repo/index.xml | wc -l` -eq 1
-grep -F com.politedroid_3.apk archive/index.xml
-! grep -F com.politedroid_4.apk archive/index.xml
-grep -F com.politedroid_5.apk archive/index.xml
-grep -F com.politedroid_6.apk repo/index.xml
-test -e archive/com.politedroid_3.apk
-! test -e archive/com.politedroid_4.apk
-test -e archive/com.politedroid_5.apk
-test -e repo/com.politedroid_6.apk
-
-# disabling deletes from the repo, and promotes one from the archive
-$sed -i.tmp 's/\(versionCode: 6\)/\1\n    disable: testing deletion/' metadata/com.politedroid.yml
-$fdroid update --pretty --nosign
-test `grep '<package>' archive/index.xml | wc -l` -eq 1
-test `grep '<package>' repo/index.xml | wc -l` -eq 1
-grep -F com.politedroid_3.apk archive/index.xml
-grep -F com.politedroid_5.apk repo/index.xml
-! grep -F com.politedroid_6.apk repo/index.xml
-test -e archive/com.politedroid_3.apk
-test -e repo/com.politedroid_5.apk
-! test -e repo/com.politedroid_6.apk
-
-
-#------------------------------------------------------------------------------#
-echo_header 'test that verify can succeed and fail'
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-test -d tmp || mkdir tmp
-test -d unsigned || mkdir unsigned
-cp $WORKSPACE/tests/repo/com.politedroid_6.apk tmp/
-cp $WORKSPACE/tests/repo/com.politedroid_6.apk unsigned/
-$fdroid verify --reuse-remote-apk --verbose com.politedroid
-# force a fail
-cp $WORKSPACE/tests/repo/com.politedroid_5.apk unsigned/com.politedroid_6.apk
-! $fdroid verify --reuse-remote-apk --verbose com.politedroid
-
-
-#------------------------------------------------------------------------------#
-echo_header 'test allowing disabled signatures in repo and archive'
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-echo 'allow_disabled_algorithms: true' >> config.yml
-printf '\narchive_older: 3\n' >> config.yml
-test -d metadata || mkdir metadata
-cp $WORKSPACE/tests/metadata/com.politedroid.yml metadata/
-echo 'Summary: good test version of urzip' > metadata/info.guardianproject.urzip.yml
-echo 'Summary: good MD5 sig, disabled algorithm' > metadata/org.bitbucket.tickytacky.mirrormirror.yml
-$sed -i.tmp '/ArchivePolicy:/d' metadata/*.yml
-test -d repo || mkdir repo
-cp $WORKSPACE/tests/repo/com.politedroid_[0-9].apk \
-   $WORKSPACE/tests/org.bitbucket.tickytacky.mirrormirror_[0-9].apk \
-   $WORKSPACE/tests/urzip-badsig.apk \
-   repo/
-
-$fdroid update --pretty --nosign
-test `grep '<package>' archive/index.xml | wc -l` -eq 2
-test `grep '<package>' repo/index.xml | wc -l` -eq 6
-grep -F com.politedroid_3.apk archive/index.xml
-grep -F com.politedroid_4.apk repo/index.xml
-grep -F com.politedroid_5.apk repo/index.xml
-grep -F com.politedroid_6.apk repo/index.xml
-grep -F org.bitbucket.tickytacky.mirrormirror_1.apk archive/index.xml
-grep -F org.bitbucket.tickytacky.mirrormirror_2.apk repo/index.xml
-grep -F org.bitbucket.tickytacky.mirrormirror_3.apk repo/index.xml
-grep -F org.bitbucket.tickytacky.mirrormirror_4.apk repo/index.xml
-! grep -F urzip-badsig.apk repo/index.xml
-! grep -F urzip-badsig.apk archive/index.xml
-test -e archive/com.politedroid_3.apk
-test -e repo/com.politedroid_4.apk
-test -e repo/com.politedroid_5.apk
-test -e repo/com.politedroid_6.apk
-test -e archive/org.bitbucket.tickytacky.mirrormirror_1.apk
-test -e repo/org.bitbucket.tickytacky.mirrormirror_2.apk
-test -e repo/org.bitbucket.tickytacky.mirrormirror_3.apk
-test -e repo/org.bitbucket.tickytacky.mirrormirror_4.apk
-test -e archive/urzip-badsig.apk
-
-sed -i.tmp '/apksigner:/d' config.yml
-if ! use_apksigner; then
-    $sed -i.tmp '/allow_disabled_algorithms/d' config.yml
-    $fdroid update --pretty --nosign
-    test `grep '<package>' archive/index.xml | wc -l` -eq 5
-    test `grep '<package>' repo/index.xml | wc -l` -eq 3
-    grep -F org.bitbucket.tickytacky.mirrormirror_1.apk archive/index.xml
-    grep -F org.bitbucket.tickytacky.mirrormirror_2.apk archive/index.xml
-    grep -F org.bitbucket.tickytacky.mirrormirror_3.apk archive/index.xml
-    grep -F org.bitbucket.tickytacky.mirrormirror_4.apk archive/index.xml
-    grep -F com.politedroid_3.apk archive/index.xml
-    grep -F com.politedroid_4.apk repo/index.xml
-    grep -F com.politedroid_5.apk repo/index.xml
-    grep -F com.politedroid_6.apk repo/index.xml
-    ! grep -F urzip-badsig.apk repo/index.xml
-    ! grep -F urzip-badsig.apk archive/index.xml
-    test -e archive/org.bitbucket.tickytacky.mirrormirror_1.apk
-    test -e archive/org.bitbucket.tickytacky.mirrormirror_2.apk
-    test -e archive/org.bitbucket.tickytacky.mirrormirror_3.apk
-    test -e archive/org.bitbucket.tickytacky.mirrormirror_4.apk
-    test -e archive/com.politedroid_3.apk
-    test -e archive/urzip-badsig.apk
-    test -e repo/com.politedroid_4.apk
-    test -e repo/com.politedroid_5.apk
-    test -e repo/com.politedroid_6.apk
-fi
-
-# test unarchiving when disabled_algorithms are allowed again
-echo 'allow_disabled_algorithms: true' >> config.yml
-$fdroid update --pretty --nosign
-test `grep '<package>' archive/index.xml | wc -l` -eq 2
-test `grep '<package>' repo/index.xml | wc -l` -eq 6
-grep -F com.politedroid_3.apk archive/index.xml
-grep -F com.politedroid_4.apk repo/index.xml
-grep -F com.politedroid_5.apk repo/index.xml
-grep -F com.politedroid_6.apk repo/index.xml
-grep -F org.bitbucket.tickytacky.mirrormirror_1.apk archive/index.xml
-grep -F org.bitbucket.tickytacky.mirrormirror_2.apk repo/index.xml
-grep -F org.bitbucket.tickytacky.mirrormirror_3.apk repo/index.xml
-grep -F org.bitbucket.tickytacky.mirrormirror_4.apk repo/index.xml
-! grep -F urzip-badsig.apk repo/index.xml
-! grep -F urzip-badsig.apk archive/index.xml
-test -e archive/com.politedroid_3.apk
-test -e repo/com.politedroid_4.apk
-test -e repo/com.politedroid_5.apk
-test -e repo/com.politedroid_6.apk
-test -e archive/org.bitbucket.tickytacky.mirrormirror_1.apk
-test -e repo/org.bitbucket.tickytacky.mirrormirror_2.apk
-test -e repo/org.bitbucket.tickytacky.mirrormirror_3.apk
-test -e repo/org.bitbucket.tickytacky.mirrormirror_4.apk
-test -e archive/urzip-badsig.apk
-
-#------------------------------------------------------------------------------#
-echo_header 'rename apks with `fdroid update --rename-apks`, --nosign for speed'
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-echo 'keydname: "CN=Birdman, OU=Cell, O=Alcatraz, L=Alcatraz, S=California, C=US"' >> config.yml
-test -d metadata || mkdir metadata
-cp $WORKSPACE/tests/metadata/info.guardianproject.urzip.yml metadata/
-test -d repo || mkdir repo
-cp $WORKSPACE/tests/urzip.apk "repo/asdfiuhk urzip-πÇÇπÇÇ现代汉语通用字-български-عربي1234 ö.apk"
-$fdroid update --rename-apks --pretty --nosign
-test -e repo/info.guardianproject.urzip_100.apk
-grep -F 'info.guardianproject.urzip_100.apk' repo/index-v1.json repo/index.xml
-cp $WORKSPACE/tests/urzip-release.apk repo/
-$fdroid update --rename-apks --pretty --nosign
-test -e repo/info.guardianproject.urzip_100.apk
-test -e repo/info.guardianproject.urzip_100_b4964fd.apk
-grep -F 'info.guardianproject.urzip_100.apk' repo/index-v1.json repo/index.xml
-grep -F 'info.guardianproject.urzip_100_b4964fd.apk' repo/index-v1.json
-! grep -F 'info.guardianproject.urzip_100_b4964fd.apk' repo/index.xml
-cp $WORKSPACE/tests/urzip-release.apk repo/
-$fdroid update --rename-apks --pretty --nosign
-test -e repo/info.guardianproject.urzip_100.apk
-test -e repo/info.guardianproject.urzip_100_b4964fd.apk
-test -e duplicates/repo/info.guardianproject.urzip_100_b4964fd.apk
-grep -F 'info.guardianproject.urzip_100.apk' repo/index-v1.json repo/index.xml
-grep -F 'info.guardianproject.urzip_100_b4964fd.apk' repo/index-v1.json
-! grep -F 'info.guardianproject.urzip_100_b4964fd.apk' repo/index.xml
-
-#------------------------------------------------------------------------------#
-echo_header "test for added date being set correctly for repo and archive"
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-printf '\narchive_older: 3\n' >> config.yml
-mkdir -p {repo,archive,metadata,stats}
-cp $WORKSPACE/tests/repo/com.politedroid_5.apk archive
-cp $WORKSPACE/tests/repo/com.politedroid_6.apk repo
-cp $WORKSPACE/tests/repo/index-v2.json repo
-cp $WORKSPACE/tests/metadata/com.politedroid.yml metadata
-#TODO: the timestamp of the oldest apk in the file should be used, even if that
-# doesn't exist anymore
-$sed -i -e 's/ArchivePolicy:.*/ArchivePolicy: 1 versions/' metadata/com.politedroid.yml
-timestamp=1498176000000  # $(date -u --date=2017-01-01 +%s)000
-pwd
-
-$fdroid update --pretty --nosign
-grep -F "\"added\": $timestamp" repo/index-v1.json
-# the archive will have the added timestamp for the app and for the apk, both need to be there
-if [ $(grep -F "\"added\": $timestamp" archive/index-v1.json | wc -l) == 2 ]; then true; else false;fi
-
-#------------------------------------------------------------------------------#
-echo_header "test whatsnew from fastlane without CVC set"
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-mkdir -p metadata/com.politedroid/en-US/changelogs/
-cp $WORKSPACE/tests/repo/com.politedroid_6.apk repo
-cp $WORKSPACE/tests/metadata/com.politedroid.yml metadata
-echo "whatsnew test" > metadata/com.politedroid/en-US/changelogs/6.txt
-$sed -i -e '/CurrentVersion/d' metadata/com.politedroid.yml
-$fdroid update --pretty --nosign
-grep -F 'whatsnew' repo/index-v1.json
-
-#------------------------------------------------------------------------------#
-echo_header "test metadata checks"
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-
-mkdir repo
-cp $WORKSPACE/tests/urzip.apk $REPOROOT/repo/
-
-set +e
-$fdroid build
-if [ $? -eq 0 ]; then
-    echo "This should have failed because there is no metadata!"
-    exit 1
-else
-    echo "testing metadata checks passed"
-fi
-set -e
-
-mkdir $REPOROOT/metadata/
-cp $WORKSPACE/tests/metadata/org.smssecure.smssecure.yml $REPOROOT/metadata/
-$fdroid readmeta
-
-
-#------------------------------------------------------------------------------#
-echo_header "ensure commands that don't need the JDK work without a JDK configed"
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-mkdir repo
-mkdir metadata
-echo "License: GPL-2.0-only" >> metadata/fake.yml
-echo "Summary: Yup still fake" >> metadata/fake.yml
-echo "Categories: [Internet]" >> metadata/fake.yml
-echo "Description: |" >> metadata/fake.yml
-echo " this is fake" >> metadata/fake.yml
-
-# fake that no JDKs are available
-cat > config.yml <<EOF
-categories:
-  - Internet
-java_paths: {}
-EOF
-
-LOCAL_COPY_DIR=`create_test_dir`/fdroid
-mkdir -p $LOCAL_COPY_DIR/repo
-echo "local_copy_dir: $LOCAL_COPY_DIR" >> config.yml
-
-$fdroid checkupdates --allow-dirty || true
-which gpg && $fdroid gpgsign
-$fdroid lint
-$fdroid readmeta
-$fdroid rewritemeta fake
-$fdroid deploy
-$fdroid deploy
-$fdroid scanner
-
-# run these to get their output, but the are not setup, so don't fail
-$fdroid build || true
-$fdroid import || true
-$fdroid install --no || true
-
-
-#------------------------------------------------------------------------------#
-# only run this test if running from a git repo, not all files are in the tarball
-if [ -e .git/config ]; then
-    echo_header "create a source tarball"
-
-    cd $WORKSPACE
-    ./setup.py compile_catalog sdist
-
-    REPOROOT=`create_test_dir`
-    cd $REPOROOT
-    tar xzf `ls -1 $WORKSPACE/dist/fdroidserver-*.tar.gz | sort -n | tail -1`
-    cd $REPOROOT
-    # shellcheck disable=SC2211
-    ./fdroidserver-*/fdroid init
-    copy_apks_into_repo $REPOROOT
-    # shellcheck disable=SC2211
-    ./fdroidserver-*/fdroid update --create-metadata --verbose
-fi
-
-#------------------------------------------------------------------------------#
-echo_header "test config checks of local_copy_dir"
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-$fdroid init
-$fdroid update --create-metadata --verbose
-$fdroid readmeta
-LOCAL_COPY_DIR=`create_test_dir`/fdroid
-$fdroid deploy --local-copy-dir=$LOCAL_COPY_DIR
-$fdroid deploy --local-copy-dir=$LOCAL_COPY_DIR --verbose
-
-# now test the errors work
-set +e
-$fdroid deploy --local-copy-dir=thisisnotanabsolutepath
-if [ $? -eq 0 ]; then
-    echo "This should have failed because thisisnotanabsolutepath is not an absolute path!"
-    exit 1
-else
-    echo "testing absolute path checker passed"
-fi
-$fdroid deploy --local-copy-dir=/tmp/IReallyDoubtThisPathExistsasdfasdf
-if [ $? -eq 0 ]; then
-    echo "This should have failed because the path does not end with 'fdroid'!"
-    exit 1
-else
-    echo "testing dirname exists checker passed"
-fi
-$fdroid deploy --local-copy-dir=/tmp/IReallyDoubtThisPathExistsasdfasdf/fdroid
-if [ $? -eq 0 ]; then
-    echo "This should have failed because the dirname path does not exist!"
-    exit 1
-else
-    echo "testing dirname exists checker passed"
-fi
-set -e
-
-
-#------------------------------------------------------------------------------#
-echo_header "setup a new repo from scratch using ANDROID_HOME and do a local sync"
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-copy_apks_into_repo $REPOROOT
-$fdroid update --create-metadata --verbose
-$fdroid readmeta
-grep -F '<application id=' repo/index.xml > /dev/null
-
-LOCALCOPYDIR=`create_test_dir`/fdroid
-$fdroid deploy --local-copy-dir=$LOCALCOPYDIR
-NEWREPOROOT=`create_test_dir`
-cd $NEWREPOROOT
-fdroid_init_with_prebuilt_keystore
-echo "sync_from_local_copy_dir: true" >> config.yml
-$fdroid deploy --local-copy-dir=$LOCALCOPYDIR
-
-
-#------------------------------------------------------------------------------#
-# check that --android-home fails when dir does not exist or is not a dir
-
-REPOROOT=`create_test_dir`
-KEYSTORE=$REPOROOT/keystore.p12
-cd $REPOROOT
-set +e
-$fdroid init --keystore $KEYSTORE --android-home /opt/fakeandroidhome
-if [ $? -eq 0 ]; then
-    echo "This should have failed because /opt/fakeandroidhome does not exist!"
-    exit 1
-else
-    echo "testing android-home path checker passed"
-fi
-TESTFILE=`create_test_file`
-$fdroid init --keystore $KEYSTORE --android-home $TESTFILE
-if [ $? -eq 0 ]; then
-    echo "This should have failed because $TESTFILE is a file not a dir!"
-    exit 1
-else
-    echo "testing android-home not-dir checker passed"
-fi
-set -e
-
-
-#------------------------------------------------------------------------------#
-echo_header "check that fake android home passes 'fdroid init'"
-
-REPOROOT=`create_test_dir`
-FAKE_ANDROID_HOME=`create_test_dir`
-create_fake_android_home $FAKE_ANDROID_HOME
-KEYSTORE=$REPOROOT/keystore.p12
-cd $REPOROOT
-$fdroid init --keystore $KEYSTORE --android-home $FAKE_ANDROID_HOME
-
-
-#------------------------------------------------------------------------------#
-echo_header "check that 'fdroid init' fails when build-tools cannot be found"
-
-if [ -e /usr/bin/aapt ] || python3 -c 'import androguard'; then
-    echo "/usr/bin/aapt or androguard installed, not running test"
-else
-    REPOROOT=`create_test_dir`
-    FAKE_ANDROID_HOME=`create_test_dir`
-    create_fake_android_home $FAKE_ANDROID_HOME
-    rm -f $FAKE_ANDROID_HOME/build-tools/*/aapt
-    KEYSTORE=$REPOROOT/keystore.p12
-    cd $REPOROOT
-    set +e
-    $fdroid init --keystore $KEYSTORE --android-home $FAKE_ANDROID_HOME
-    [ $? -eq 0 ] && exit 1
-    set -e
-fi
-
-
-#------------------------------------------------------------------------------#
-echo_header "check that --android-home overrides ANDROID_HOME"
-
-REPOROOT=`create_test_dir`
-FAKE_ANDROID_HOME=`create_test_dir`
-create_fake_android_home $FAKE_ANDROID_HOME
-KEYSTORE=$REPOROOT/keystore.p12
-cd $REPOROOT
-$fdroid init --keystore $KEYSTORE --android-home $FAKE_ANDROID_HOME
-set +e
-grep $FAKE_ANDROID_HOME $REPOROOT/config.yml
-if [ $? -ne 0 ]; then
-    echo "the value set in --android-home '$FAKE_ANDROID_HOME' should override ANDROID_HOME '$ANDROID_HOME'"
-    exit 1
-fi
-set -e
-
-
-#------------------------------------------------------------------------------#
-# In this case, ANDROID_HOME is set to a fake, non-working version that will
-# be detected by fdroid as an Android SDK install.  It should use the path set
-# by --android-home over the one in ANDROID_HOME, therefore if it uses the one
-# in ANDROID_HOME, it won't work because it is a fake one.  Only
-# --android-home provides a working one.
-if [ -z "$ANDROID_HOME" ]; then
-    echo_header "SKIP setup a new repo from scratch with keystore and android-home set on cmd line"
-else
-    echo_header "setup a new repo from scratch with keystore and android-home set on cmd line"
-
-    REPOROOT=`create_test_dir`
-    KEYSTORE=$REPOROOT/keystore.p12
-    FAKE_ANDROID_HOME=`create_test_dir`
-    create_fake_android_home $FAKE_ANDROID_HOME
-    STORED_ANDROID_HOME=$ANDROID_HOME
-    unset ANDROID_HOME
-    echo "ANDROID_HOME: $ANDROID_HOME"
-    cd $REPOROOT
-    $fdroid init --keystore $KEYSTORE --android-home $STORED_ANDROID_HOME --no-prompt
-    test -e $KEYSTORE
-    copy_apks_into_repo $REPOROOT
-    $fdroid update --create-metadata --verbose
-    $fdroid readmeta
-    grep -F '<application id=' repo/index.xml > /dev/null
-    test -e repo/index.xml
-    test -e repo/index.jar
-    test -e repo/index-v1.jar
-    test -e tmp/apkcache.json
-    ! test -z tmp/apkcache.json
-    export ANDROID_HOME=$STORED_ANDROID_HOME
-fi
-
-#------------------------------------------------------------------------------#
-echo_header "check duplicate files are properly handled by fdroid update"
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-mkdir $REPOROOT/metadata
-cp -a $WORKSPACE/tests/metadata/obb.mainpatch.current.yml $REPOROOT/metadata
-cp $WORKSPACE/tests/repo/obb.mainpatch.current_1619.apk $REPOROOT/repo/
-cp $WORKSPACE/tests/repo/obb.mainpatch.current_1619_another-release-key.apk $REPOROOT/repo/
-$fdroid update --pretty
-grep -F 'obb.mainpatch.current_1619.apk' repo/index.xml repo/index-v1.json
-grep -F 'obb.mainpatch.current_1619_another-release-key.apk' repo/index-v1.json
-! grep -F 'obb.mainpatch.current_1619_another-release-key.apk' repo/index.xml
-# die if there are exact duplicates
-cp $WORKSPACE/tests/repo/obb.mainpatch.current_1619.apk $REPOROOT/repo/duplicate.apk
-! $fdroid update
-
-
-#------------------------------------------------------------------------------#
-echo_header "setup new repo from scratch using ANDROID_HOME, putting APKs in repo first"
-
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-mkdir repo
-copy_apks_into_repo $REPOROOT
-fdroid_init_with_prebuilt_keystore
-$fdroid update --create-metadata --verbose
-$fdroid readmeta
-grep -F '<application id=' repo/index.xml > /dev/null
-
-
-#------------------------------------------------------------------------------#
-echo_header "setup a new repo from scratch and generate a keystore"
-
-REPOROOT=`create_test_dir`
-KEYSTORE=$REPOROOT/keystore.p12
-cd $REPOROOT
-$fdroid init --keystore $KEYSTORE
-test -e $KEYSTORE
-copy_apks_into_repo $REPOROOT
-$fdroid update --create-metadata --verbose
-$fdroid readmeta
-test -e repo/index.xml
-test -e repo/index.jar
-test -e repo/index-v1.jar
-test -e tmp/apkcache.json
-! test -z tmp/apkcache.json
-grep -F '<application id=' repo/index.xml > /dev/null
-
-
-#------------------------------------------------------------------------------#
-echo_header "setup a new repo manually and generate a keystore"
-
-REPOROOT=`create_test_dir`
-KEYSTORE=$REPOROOT/keystore.p12
-cd $REPOROOT
-! test -e $KEYSTORE
-set +e
-$fdroid update
-if [ $? -eq 0 ]; then
-    echo "This should have failed because this repo has no keystore!"
-    exit 1
-else
-    echo '`fdroid update` prompted to add keystore'
-fi
-set -e
-$fdroid update --create-key
-test -e $KEYSTORE
-copy_apks_into_repo $REPOROOT
-$fdroid update --create-metadata --verbose
-$fdroid readmeta
-test -e repo/index.xml
-test -e repo/index.jar
-test -e repo/index-v1.jar
-test -e tmp/apkcache.json
-! test -z tmp/apkcache.json
-grep -F '<application id=' repo/index.xml > /dev/null
-
-
-#------------------------------------------------------------------------------#
-echo_header "setup a new repo from scratch, generate a keystore, then add APK and update"
-
-REPOROOT=`create_test_dir`
-KEYSTORE=$REPOROOT/keystore.p12
-cd $REPOROOT
-$fdroid init --keystore $KEYSTORE
-test -e $KEYSTORE
-copy_apks_into_repo $REPOROOT
-$fdroid update --create-metadata --verbose
-$fdroid readmeta
-test -e repo/index.xml
-test -e repo/index.jar
-test -e repo/index-v1.jar
-grep -F '<application id=' repo/index.xml > /dev/null
-test -e $REPOROOT/repo/info.guardianproject.urzip_100.apk || \
-    cp $WORKSPACE/tests/urzip.apk $REPOROOT/repo/
-$fdroid update --create-metadata --verbose
-$fdroid readmeta
-test -e repo/index.xml
-test -e repo/index.jar
-test -e repo/index-v1.jar
-test -e tmp/apkcache.json
-! test -z tmp/apkcache.json
-grep -F '<application id=' repo/index.xml > /dev/null
-
-
-#------------------------------------------------------------------------------#
-echo_header "setup a new repo from scratch with a HSM/smartcard"
-REPOROOT=`create_test_dir`
-cd $REPOROOT
-$fdroid init --keystore NONE
-test -e opensc-fdroid.cfg
-test ! -e NONE
-
-
-#------------------------------------------------------------------------------#
-echo_header "setup a new repo with no keystore, add APK, and update"
-
-REPOROOT=`create_test_dir`
-KEYSTORE=$REPOROOT/keystore.p12
-cd $REPOROOT
-touch fdroid-icon.png
-mkdir repo
-cp $WORKSPACE/tests/urzip.apk $REPOROOT/repo/
-set +e
-$fdroid update --create-metadata --verbose
-if [ $? -eq 0 ]; then
-    echo "This should have failed because this repo has no keystore!"
-    exit 1
-else
-    echo '`fdroid update` prompted to add keystore'
-fi
-set -e
-
-# now set up fake, non-working keystore setup
-touch $KEYSTORE
-echo "keystore: $KEYSTORE" >> config.yml
-echo 'repo_keyalias: foo' >> config.yml
-echo 'keystorepass: foo' >> config.yml
-echo 'keypass: foo' >> config.yml
-set +e
-$fdroid update --create-metadata --verbose
-if [ $? -eq 0 ]; then
-    echo "This should have failed because this repo has a bad/fake keystore!"
-    exit 1
-else
-    echo '`fdroid update` prompted to add keystore'
-fi
-set -e
-
-
-#------------------------------------------------------------------------------#
-echo_header "copy tests/repo, update with binary transparency log"
-
-REPOROOT=`create_test_dir`
-GIT_REMOTE=`create_test_dir`
-GNUPGHOME=$REPOROOT/gnupghome
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-cp -a $WORKSPACE/tests/metadata $WORKSPACE/tests/repo $REPOROOT/
-echo "binary_transparency_remote: $GIT_REMOTE" >> config.yml
-$fdroid update --verbose
-$fdroid deploy --verbose
-test -e repo/index.xml
-test -e repo/index.jar
-test -e repo/index-v1.jar
-grep -F '<application id=' repo/index.xml > /dev/null
-cd binary_transparency
-[ "$($git rev-list --count HEAD)" == "2" ]
-cd $GIT_REMOTE
-[ "$($git rev-list --count HEAD)" == "2" ]
-
-
-#------------------------------------------------------------------------------#
-echo_header "setup a new repo with keystore with APK, update, then without key"
-
-REPOROOT=`create_test_dir`
-KEYSTORE=$REPOROOT/keystore.jks
-cd $REPOROOT
-cp $WORKSPACE/tests/keystore.jks $KEYSTORE
-fdroid_init_with_prebuilt_keystore $KEYSTORE
-test -e $KEYSTORE
-cp $WORKSPACE/tests/urzip.apk $REPOROOT/repo/
-$fdroid update --create-metadata --verbose
-$fdroid readmeta
-test -e repo/index.xml
-test -e repo/index.jar
-test -e repo/index-v1.jar
-test -e tmp/apkcache.json
-! test -z tmp/apkcache.json
-grep -F '<application id=' repo/index.xml > /dev/null
-
-# now set fake repo_keyalias
-$sed -i.tmp 's,^ *repo_keyalias.*,repo_keyalias: fake,' $REPOROOT/config.yml
-set +e
-$fdroid update
-if [ $? -eq 0 ]; then
-    echo "This should have failed because this repo has a bad repo_keyalias!"
-    exit 1
-else
-    echo '`fdroid update` prompted to add keystore'
-fi
-set -e
-
-# try creating a new keystore, but fail because the old one is there
-test -e $KEYSTORE
-set +e
-$fdroid update --create-key
-if [ $? -eq 0 ]; then
-    echo "This should have failed because a keystore is already there!"
-    exit 1
-else
-    echo '`fdroid update` complained about existing keystore'
-fi
-set -e
-
-# now actually create the key with the existing settings
-rm -f $KEYSTORE
-! test -e $KEYSTORE
-$fdroid update --create-key
-test -e $KEYSTORE
-
-
-#------------------------------------------------------------------------------#
-echo_header "setup a new repo from scratch using ANDROID_HOME with git mirror"
-
-# fake git remote server for repo mirror
-SERVER_GIT_MIRROR=`create_test_dir`
-cd $SERVER_GIT_MIRROR
-$git init --initial-branch=master
-$git config receive.denyCurrentBranch updateInstead
-
-REPOROOT=`create_test_dir`
-GIT_MIRROR=$REPOROOT/git-mirror
-cd $REPOROOT
-fdroid_init_with_prebuilt_keystore
-printf '\narchive_older: 3\n' >> config.yml
-printf "servergitmirrors: $SERVER_GIT_MIRROR\n" >> config.yml
-
-cp $WORKSPACE/tests/repo/com.politedroid_[345].apk repo/
-$fdroid update --create-metadata
-$fdroid deploy
-test -e $GIT_MIRROR/fdroid/repo/com.politedroid_3.apk
-test -e $GIT_MIRROR/fdroid/repo/com.politedroid_4.apk
-test -e $GIT_MIRROR/fdroid/repo/com.politedroid_5.apk
-test -e $SERVER_GIT_MIRROR/fdroid/repo/com.politedroid_3.apk
-test -e $SERVER_GIT_MIRROR/fdroid/repo/com.politedroid_4.apk
-test -e $SERVER_GIT_MIRROR/fdroid/repo/com.politedroid_5.apk
-date > $GIT_MIRROR/.git/test-stamp
-
-# add one more APK to trigger archiving
-cp $WORKSPACE/tests/repo/com.politedroid_6.apk repo/
-$fdroid update
-$fdroid deploy
-test -e $REPOROOT/archive/com.politedroid_3.apk
-! test -e $GIT_MIRROR/fdroid/archive/com.politedroid_3.apk
-! test -e $SERVER_GIT_MIRROR/fdroid/archive/com.politedroid_3.apk
-test -e $GIT_MIRROR/fdroid/repo/com.politedroid_4.apk
-test -e $GIT_MIRROR/fdroid/repo/com.politedroid_5.apk
-test -e $GIT_MIRROR/fdroid/repo/com.politedroid_6.apk
-test -e $SERVER_GIT_MIRROR/fdroid/repo/com.politedroid_4.apk
-test -e $SERVER_GIT_MIRROR/fdroid/repo/com.politedroid_5.apk
-test -e $SERVER_GIT_MIRROR/fdroid/repo/com.politedroid_6.apk
-before=`du -s --bytes $GIT_MIRROR/.git/ | awk '{print $1}'`
-
-echo "git_mirror_size_limit: 60kb" >> config.yml
-$fdroid update
-$fdroid deploy
-test -e $REPOROOT/archive/com.politedroid_3.apk
-! test -e $SERVER_GIT_MIRROR/fdroid/archive/com.politedroid_3.apk
-after=`du -s --bytes $GIT_MIRROR/.git/ | awk '{print $1}'`
-! test -e $GIT_MIRROR/.git/test-stamp
-$git -C "$GIT_MIRROR" gc
-$git -C "$SERVER_GIT_MIRROR" gc
-test $before -gt $after
-
-
-#------------------------------------------------------------------------------#
-echo_header "sign binary repo in offline box, then publishing from online box"
-
-OFFLINE_ROOT=`create_test_dir`
-KEYSTORE=$WORKSPACE/tests/keystore.p12
-LOCAL_COPY_DIR=`create_test_dir`/fdroid
-mkdir $LOCAL_COPY_DIR
-ONLINE_ROOT=`create_test_dir`
-SERVERWEBROOT=`create_test_dir`/fdroid
-
-# create offline binary transparency log
-cd $OFFLINE_ROOT
-mkdir binary_transparency
-cd binary_transparency
-$git init --initial-branch=master
-
-# fake git remote server for binary transparency log
-BINARY_TRANSPARENCY_REMOTE=`create_test_dir`
-
-# fake git remote server for repo mirror
-SERVER_GIT_MIRROR=`create_test_dir`
-cd $SERVER_GIT_MIRROR
-$git init --initial-branch=master
-$git config receive.denyCurrentBranch updateInstead
-
-cd $OFFLINE_ROOT
-fdroid_init_with_prebuilt_keystore
-printf '\narchive_older: 3\n' >> config.yml
-cp -a $WORKSPACE/tests/metadata $WORKSPACE/tests/repo $OFFLINE_ROOT/
-mkdir $OFFLINE_ROOT/unsigned
-cp $WORKSPACE/tests/urzip-release-unsigned.apk $OFFLINE_ROOT/unsigned
-
-echo "mirrors: ['http://foo.bar/fdroid', 'http://asdflkdsfjafdsdfhkjh.onion/fdroid']" >> config.yml
-echo "servergitmirrors: $SERVER_GIT_MIRROR" >> config.yml
-echo "local_copy_dir: $LOCAL_COPY_DIR" >> config.yml
-$fdroid update --pretty
-grep -F '<application id=' repo/index.xml > /dev/null
-grep -F '/fdroid/repo</mirror>' repo/index.xml
-grep -F '/fdroid/archive</mirror>' archive/index.xml
-test `grep '<mirror>' repo/index.xml | wc -l` -eq 2
-test `grep '<mirror>' archive/index.xml | wc -l` -eq 2
-cd binary_transparency
-[ "$($git rev-list --count HEAD)" == "1" ]
-cd ..
-$fdroid deploy --verbose
-test -e $LOCAL_COPY_DIR/unsigned/urzip-release-unsigned.apk
-grep -F '<application id=' $LOCAL_COPY_DIR/repo/index.xml > /dev/null
-cd $ONLINE_ROOT
-echo "local_copy_dir: $LOCAL_COPY_DIR" >> config.yml
-echo "sync_from_local_copy_dir: True" >> config.yml
-echo "serverwebroot: $SERVERWEBROOT" >> config.yml
-echo "servergitmirrors: $SERVER_GIT_MIRROR" >> config.yml
-echo "binary_transparency_remote: $BINARY_TRANSPARENCY_REMOTE" >> config.yml
-$fdroid deploy --verbose
-test -e $ONLINE_ROOT/unsigned/urzip-release-unsigned.apk
-test -e $SERVERWEBROOT/unsigned/urzip-release-unsigned.apk
-cd $BINARY_TRANSPARENCY_REMOTE
-[ "$($git rev-list --count HEAD)" == "1" ]
-cd $SERVER_GIT_MIRROR
-[ "$($git rev-list --count HEAD)" == "1" ] || [ "$(uname -s)" != "Linux" ]  # TODO fix on macOS
-
-
-#------------------------------------------------------------------------------#
-echo_header 'test extracting and publishing with developer signature'
-
-if use_apksigner; then
-    REPOROOT=`create_test_dir`
-    cd $REPOROOT
-    fdroid_init_with_prebuilt_keystore
-    echo 'keydname: "CN=Birdman, OU=Cell, O=Alcatraz, L=Alcatraz, S=California, C=US"' >> config.yml
-    test -d metadata || mkdir metadata
-    cp $WORKSPACE/tests/metadata/com.politedroid.yml metadata/
-    test -d repo || mkdir repo
-    test -d unsigned || mkdir unsigned
-    cp $WORKSPACE/tests/repo/com.politedroid_6.apk unsigned/
-    $fdroid signatures unsigned/com.politedroid_6.apk
-    test -d metadata/com.politedroid/signatures/6
-    test -f metadata/com.politedroid/signatures/6/MANIFEST.MF
-    test -f metadata/com.politedroid/signatures/6/RELEASE.RSA
-    test -f metadata/com.politedroid/signatures/6/RELEASE.SF
-    ! test -f repo/com.politedroid_6.apk
-    $fdroid publish
-    test -f repo/com.politedroid_6.apk
-    if which apksigner; then
-	apksigner verify repo/com.politedroid_6.apk
-    fi
-    if which jarsigner; then
-	jarsigner -verify repo/com.politedroid_6.apk
-    fi
-fi
-
-
-#------------------------------------------------------------------------------#
-echo_header 'test mirroring a repo'
-
-if which wget; then
-    TESTROOT=`create_test_dir`
-    REPOROOT=`create_test_dir`
-    cp -r "$WORKSPACE/tests" "$TESTROOT"
-    cd "$TESTROOT/tests"
-    test -d archive || mkdir archive
-    cp repo/index-v1.json $REPOROOT/
-    $fdroid update
-    $fdroid signindex
-    mv $REPOROOT/index-v1.json repo/index-v1.json
-
-    port=321${RANDOM:3}
-    test $(printf $port | wc -m) -le 3 && port=52734 # when $RANDOM doesn't work
-    timeout 5m python3 -m http.server $port --bind 127.0.0.1 > $REPOROOT/http.server.log 2>&1 &
-    http_server_pid=$!
-
-    cd $REPOROOT
-    # shellcheck disable=SC1007
-    http_proxy= HTTP_PROXY= $fdroid mirror http://127.0.0.1:${port}/
-    test -e 127.0.0.1\:${port}/repo/souch.smsbypass_9.apk
-    test -e 127.0.0.1\:${port}/repo/icons-640/souch.smsbypass.9.png
-    # the index shouldn't be saved unless it was verified
-    ! test -e 127.0.0.1\:${port}/repo/index-v1.jar
-    # shellcheck disable=SC1007
-    ! http_proxy= HTTP_PROXY= $fdroid mirror "http://127.0.0.1:${port}/?fingerprint=asdfasdf"
-    ! test -e 127.0.0.1\:${port}/repo/index-v1.jar
-    # shellcheck disable=SC1007
-    http_proxy= HTTP_PROXY= $fdroid mirror "http://127.0.0.1:${port}/?fingerprint=F49AF3F11EFDDF20DFFD70F5E3117B9976674167ADCA280E6B1932A0601B26F6"
-    test -e 127.0.0.1\:${port}/repo/index-v1.jar
-
-    # clean up
-    kill -9 $http_server_pid
-    rm -f 127.0.0.1\:${port}/repo/*.apk 127.0.0.1\:${port}/repo/*/*/*/*.png
-    sleep 1  # wait for webserver thread to quit
-else
-    echo "WARNING: wget not installed, skipping"
-fi
-
-#------------------------------------------------------------------------------#
-echo_header "Test recovering from from broken git submodules"
-
-# On some platforms, checkupdates submodule tests need explicit perms to use file:///
-export GIT_ALLOW_PROTOCOL=file
-
-ROOT=$(create_test_dir)
-cd "$ROOT"
-mkdir foo bar
-cd foo
-$git init
-echo a > a
-$git add a
-$git commit -m "a"
-
-cd ../bar
-$git init
-$git submodule add "file://$(pwd)/../foo" baz
-rm .gitmodules
-$git commit -am "a"
-rm -rf baz
-$git checkout baz
-$git tag 2
-
-cd ..
-mkdir repo
-mkdir metadata
-echo "RepoType: git" >> metadata/fake.yml
-echo "Repo: file://$(pwd)/bar" >> metadata/fake.yml
-echo "AutoUpdateMode: Version" >> metadata/fake.yml
-echo "UpdateCheckMode: Tags" >> metadata/fake.yml
-echo "UpdateCheckData: '|||'" >> metadata/fake.yml
-echo "CurrentVersion: 1" >> metadata/fake.yml
-echo "CurrentVersionCode: 1" >> metadata/fake.yml
-
-$fdroid checkupdates --allow-dirty
-grep "CurrentVersionCode: 2" metadata/fake.yml
-
-#------------------------------------------------------------------------------#
-echo_header "checkupdates ignore broken submodule"
-
-ROOT=$(create_test_dir)
-cd "$ROOT"
-mkdir foo bar
-cd foo
-$git init
-echo a > a
-$git add a
-$git commit -m a
-
-cd ../bar
-$git init
-$git submodule add "file://$(pwd)/../foo" baz
-$git commit -am a
-$git tag 2
-
-cd ../foo
-# delete the commit referenced in bar
-$git commit --amend -m aa
-$git reflog expire --expire=now --all
-$git gc --aggressive --prune=now
-
-cd ..
-mkdir repo
-mkdir metadata
-echo "RepoType: git" >> metadata/fake.yml
-echo "Repo: file://$(pwd)/bar" >> metadata/fake.yml
-echo "Builds:" >> metadata/fake.yml
-echo "   - versionName: 1" >> metadata/fake.yml
-echo "     versionCode: 1" >> metadata/fake.yml
-echo "     submodules: true" >> metadata/fake.yml
-echo "AutoUpdateMode: Version" >> metadata/fake.yml
-echo "UpdateCheckMode: Tags" >> metadata/fake.yml
-echo "UpdateCheckData: '|||'" >> metadata/fake.yml
-echo "CurrentVersion: 1" >> metadata/fake.yml
-echo "CurrentVersionCode: 1" >> metadata/fake.yml
-
-$fdroid checkupdates --allow-dirty
-grep "CurrentVersionCode: 2" metadata/fake.yml
-
-
-#------------------------------------------------------------------------------#
-echo_header "checkupdates check version in submodule"
-
-ROOT=$(create_test_dir)
-cd "$ROOT"
-mkdir app sub
-cd sub
-$git init
-echo 1 > ver
-$git add ver
-$git commit -m 1
-
-cd ../app
-$git init
-$git submodule add "file://$(pwd)/../sub"
-$git commit -am 1
-$git tag 1
-
-cd ../sub
-echo 2 > ver
-$git commit -am 2
-
-cd ../app
-$git init
-$git submodule update --remote
-$git commit -am 2
-
-cd ..
-mkdir repo
-mkdir metadata
-cat > metadata/fake.yml <<EOF
-RepoType: git
-Repo: file://$(pwd)/app
-Builds:
-   - versionName: 0
-     versionCode: 0
-     submodules: true
-AutoUpdateMode: Version
-UpdateCheckMode: Tags
-UpdateCheckData: 'sub/ver|(\d)||'
-CurrentVersion: 0
-CurrentVersionCode: 0
-EOF
-
-$fdroid checkupdates --allow-dirty --auto -v
-grep "CurrentVersionCode: 1" metadata/fake.yml
-
-unset GIT_ALLOW_PROTOCOL
-
 echo SUCCESS
diff --git a/tests/test_integration.py b/tests/test_integration.py
new file mode 100644
index 00000000..3f66574a
--- /dev/null
+++ b/tests/test_integration.py
@@ -0,0 +1,1513 @@
+import itertools
+import os
+import re
+import shlex
+import shutil
+import subprocess
+import sys
+import threading
+import unittest
+from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+import loguru
+from datetime import UTC, datetime
+from androguard.core.apk import get_apkid
+from ruamel.yaml import YAML
+
+# suppress unnecessary logging output from get_apkid
+loguru.logger.disable("androguard")
+
+
+basedir = Path(__file__).parent
+FILES = basedir
+
+try:
+    WORKSPACE = Path(os.environ["WORKSPACE"])
+except KeyError:
+    WORKSPACE = basedir.parent
+
+from fdroidserver import common
+
+conf = {"sdk_path": os.getenv("ANDROID_HOME", "")}
+common.find_apksigner(conf)
+USE_APKSIGNER = "apksigner" in conf
+
+
+class IntegrationTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        try:
+            cls.fdroid_cmd = shlex.split(os.environ["fdroid"])
+        except KeyError:
+            cls.fdroid_cmd = [WORKSPACE / "fdroid"]
+
+        cls.tmp = WORKSPACE / ".testfiles"
+        cls.tmp_repo = cls.tmp / "repo"
+
+    def setUp(self):
+        self.prev_cwd = Path()
+        self.tmp_repo.mkdir(parents=True)
+        os.chdir(self.tmp_repo)
+
+    def tearDown(self):
+        os.chdir(self.prev_cwd)
+        shutil.rmtree(self.tmp)
+
+    def assert_run(self, *args, **kwargs):
+        proc = subprocess.run(*args, **kwargs)
+        self.assertEqual(proc.returncode, 0)
+        return proc
+
+    def assert_run_fail(self, *args, **kwargs):
+        proc = subprocess.run(*args, **kwargs)
+        self.assertNotEqual(proc.returncode, 0)
+        return proc
+
+    @staticmethod
+    def update_yaml(path, items, replace=False):
+        yaml = YAML()
+        doc = {}
+        if not replace:
+            try:
+                with open(path) as f:
+                    doc = yaml.load(f)
+            except FileNotFoundError:
+                pass
+        doc.update(items)
+        with open(path, "w") as f:
+            yaml.dump(doc, f)
+
+    @staticmethod
+    def remove_lines(path, unwanted_strings):
+        def contains_unwanted(line, unwanted_strings):
+            for str in unwanted_strings:
+                if str in line:
+                    return True
+            return False
+
+        with open(path) as f:
+            filtered = [
+                line for line in f if not contains_unwanted(line, unwanted_strings)
+            ]
+
+        with open(path, "w") as f:
+            for line in filtered:
+                f.write(line)
+
+    @staticmethod
+    def get_fdroid_apk_filename(file):
+        id, version_code, _ = get_apkid(file)
+        return f"{id}_{version_code}.apk"
+
+    @staticmethod
+    def copy_apks_into_repo():
+        def to_skip(name):
+            for str in [
+                "unaligned",
+                "unsigned",
+                "badsig",
+                "badcert",
+                "bad-unicode",
+                "janus.apk",
+            ]:
+                if str in name:
+                    return True
+            return False
+
+        for file in FILES.glob("*.apk"):
+            if not to_skip(file.name):
+                shutil.copy(
+                    file, Path("repo") / IntegrationTest.get_fdroid_apk_filename(file)
+                )
+
+    @staticmethod
+    def create_fake_android_home(path):
+        (path / "tools").mkdir()
+        (path / "platform-tools").mkdir()
+        (path / "build-tools/34.0.0").mkdir(parents=True)
+        (path / "build-tools/34.0.0/aapt").touch()
+
+    def fdroid_init_with_prebuilt_keystore(self, keystore_path=FILES / "keystore.jks"):
+        self.assert_run(
+            self.fdroid_cmd
+            + ["init", "--keystore", keystore_path, "--repo-keyalias", "sova"]
+        )
+        self.update_yaml(
+            "config.yml",
+            {
+                "keystorepass": "r9aquRHYoI8+dYz6jKrLntQ5/NJNASFBacJh7Jv2BlI=",
+                "keypass": "r9aquRHYoI8+dYz6jKrLntQ5/NJNASFBacJh7Jv2BlI=",
+            },
+        )
+
+    @unittest.skipUnless(USE_APKSIGNER, "requires apksigner")
+    def test_run_process_when_building_and_signing_are_on_separate_machines(self):
+        shutil.copy(FILES / "keystore.jks", "keystore.jks")
+        self.fdroid_init_with_prebuilt_keystore("keystore.jks")
+        self.update_yaml(
+            "config.yml",
+            {
+                "make_current_version_link": True,
+                "keydname": "CN=Birdman, OU=Cell, O=Alcatraz, L=Alcatraz, S=California, C=US",
+            },
+        )
+
+        Path("metadata").mkdir()
+        shutil.copy(FILES / "metadata/info.guardianproject.urzip.yml", "metadata")
+        Path("unsigned").mkdir()
+        shutil.copy(
+            FILES / "urzip-release-unsigned.apk",
+            "unsigned/info.guardianproject.urzip_100.apk",
+        )
+
+        self.assert_run(self.fdroid_cmd + ["publish", "--verbose"])
+        self.assert_run(self.fdroid_cmd + ["update", "--verbose", "--nosign"])
+        self.assert_run(self.fdroid_cmd + ["signindex", "--verbose"])
+
+        self.assertIn(
+            '<application id="info.guardianproject.urzip">',
+            Path("repo/index.xml").read_text(),
+        )
+        self.assertTrue(Path("repo/index.jar").is_file())
+        self.assertTrue(Path("repo/index-v1.jar").is_file())
+        apkcache = Path("tmp/apkcache.json")
+        self.assertTrue(apkcache.is_file())
+        self.assertTrue(apkcache.stat().st_size > 0)
+        self.assertTrue(Path("urzip.apk").is_symlink())
+
+    def test_utf8_metadata(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        self.update_yaml(
+            "config.yml",
+            {
+                "repo_description": "获取已安装在您的设备上的应用的",
+                "mirrors": ["https://foo.bar/fdroid", "http://secret.onion/fdroid"],
+            },
+        )
+        shutil.copy(FILES / "urzip.apk", "repo")
+        shutil.copy(FILES / "bad-unicode-πÇÇ现代通用字-български-عربي1.apk", "repo")
+        Path("metadata").mkdir()
+        shutil.copy(FILES / "metadata/info.guardianproject.urzip.yml", "metadata")
+
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+        self.assert_run(self.fdroid_cmd + ["update"])
+
+    def test_copy_git_import_and_run_fdroid_scanner_on_it(self):
+        url = "https://gitlab.com/fdroid/ci-test-app.git"
+        Path("metadata").mkdir()
+        self.update_yaml(
+            "metadata/org.fdroid.ci.test.app.yml",
+            {
+                "AutoName": "Just A Test",
+                "WebSite": None,
+                "Builds": [
+                    {
+                        "versionName": "0.3",
+                        "versionCode": 300,
+                        "commit": "0.3",
+                        "subdir": "app",
+                        "gradle": ["yes"],
+                    }
+                ],
+                "Repo": url,
+                "RepoType": "git",
+            },
+        )
+
+        self.assert_run(["git", "clone", url, "build/org.fdroid.ci.test.app"])
+        self.assert_run(
+            self.fdroid_cmd + ["scanner", "org.fdroid.ci.test.app", "--verbose"]
+        )
+
+    def test_copy_repo_generate_java_gpg_keys_update_and_gpgsign(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        shutil.copytree(FILES / "repo", "repo", dirs_exist_ok=True)
+        for dir in ["config", "metadata", "gnupghome"]:
+            shutil.copytree(FILES / dir, dir)
+        gnupghome = Path("gnupghome").resolve()
+        os.chmod(gnupghome, 0o700)
+        self.update_yaml(
+            "config.yml",
+            {
+                "install_list": "org.adaway",
+                "uninstall_list": ["com.android.vending", "com.facebook.orca"],
+                "gpghome": str(gnupghome),
+                "gpgkey": "CE71F7FB",
+                "mirrors": [
+                    "http://foobarfoobarfoobar.onion/fdroid",
+                    "https://foo.bar/fdroid",
+                ],
+            },
+        )
+        self.assert_run(
+            self.fdroid_cmd + ["update", "--verbose", "--pretty"],
+            env=os.environ | {"LC_MESSAGES": "en_US.UTF-8"},
+        )
+        index_xml = Path("repo/index.xml").read_text()
+        self.assertIn("<application id=", index_xml)
+        self.assertIn("<install packageName=", index_xml)
+        self.assertIn("<uninstall packageName=", index_xml)
+        self.assertTrue(Path("repo/index.jar").is_file())
+        self.assertTrue(Path("repo/index-v1.jar").is_file())
+
+        # OSX tests are run on Travis-CI, and gpg fails to launch gpg-agent there
+        if os.getenv("TRAVIS_OS_NAME") != "osx":
+            self.assert_run(self.fdroid_cmd + ["gpgsign", "--verbose"])
+
+            self.assertTrue(Path("repo/obb.mainpatch.current_1619.apk.asc").is_file())
+            self.assertTrue(
+                Path("repo/obb.main.twoversions_1101617_src.tar.gz.asc").is_file()
+            )
+            self.assertFalse(
+                Path("repo/obb.mainpatch.current_1619.apk.asc.asc").exists()
+            )
+            self.assertFalse(
+                Path("repo/obb.main.twoversions_1101617_src.tar.gz.asc.asc").exists()
+            )
+            self.assertFalse(Path("repo/index.xml.asc").exists())
+
+        index_v1_json = Path("repo/index-v1.json").read_text()
+        v0_timestamp = re.search(r'timestamp="(\d+)"', index_xml).group(1)
+        v1_timestamp = re.search(r'"timestamp": (\d+)', index_v1_json).group(1)[:-3]
+        self.assertEqual(v0_timestamp, v1_timestamp)
+
+        # we can't easily reproduce the timestamps for things, so just hardcode them
+        index_xml = re.sub(r'timestamp="\d+"', 'timestamp="1676634233"', index_xml)
+        self.assertEqual((FILES / "repo/index.xml").read_text(), index_xml)
+        index_v1_json = re.sub(
+            r'"timestamp": (\d+)', '"timestamp": 1676634233000', index_v1_json
+        )
+        self.assertEqual((FILES / "repo/index-v1.json").read_text(), index_v1_json)
+
+        expected_index_v2_json = (FILES / "repo/index-v2.json").read_text()
+        expected_index_v2_json = re.sub(
+            r',\s*"ipfsCIDv1":\s*"[\w]+"', "", expected_index_v2_json
+        )
+
+        index_v2_json = Path("repo/index-v2.json").read_text()
+        index_v2_json = re.sub(
+            r'"timestamp": (\d+)', '"timestamp": 1676634233000', index_v2_json
+        )
+        index_v2_json = re.sub(r',\s*"ipfsCIDv1":\s*"[\w]+"', "", index_v2_json)
+        self.assertEqual(index_v2_json, expected_index_v2_json)
+
+    def test_moving_lots_of_apks_to_the_archive(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        Path("metadata").mkdir()
+        for path in (FILES / "metadata").glob("*.yml"):
+            shutil.copy(path, "metadata")
+        self.update_yaml(
+            "metadata/info.guardianproject.urzip.yml",
+            {"Summary": "good test version of urzip"},
+            replace=True,
+        )
+        self.update_yaml(
+            "metadata/org.bitbucket.tickytacky.mirrormirror.yml",
+            {"Summary": "good MD5 sig, which is disabled algorithm"},
+            replace=True,
+        )
+        for file in Path("metadata").glob("*.yml"):
+            self.remove_lines(file, ["ArchivePolicy:"])
+        for file in itertools.chain(
+            FILES.glob("urzip.apk"),
+            FILES.glob("org.bitbucket.tickytacky.mirrormirror_[0-9].apk"),
+            FILES.glob("repo/com.politedroid_[0-9].apk"),
+            FILES.glob("repo/obb.main.twoversions_110161[357].apk"),
+        ):
+            shutil.copy(file, "repo")
+        self.update_yaml("config.yml", {"archive_older": 3})
+
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        with open("archive/index.xml") as f:
+            archive_cnt = sum(1 for line in f if "<package>" in line)
+        with open("repo/index.xml") as f:
+            repo_cnt = sum(1 for line in f if "<package>" in line)
+        if USE_APKSIGNER:
+            self.assertEqual(archive_cnt, 2)
+            self.assertEqual(repo_cnt, 10)
+        else:
+            # This will fail when jarsigner allows MD5 for APK signatures
+            self.assertEqual(archive_cnt, 5)
+            self.assertEqual(repo_cnt, 7)
+
+    @unittest.skipIf(USE_APKSIGNER, "runs only without apksigner")
+    def test_per_app_archive_policy(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        Path("metadata").mkdir()
+        shutil.copy(FILES / "metadata/com.politedroid.yml", "metadata")
+        for file in FILES.glob("repo/com.politedroid_[0-9].apk"):
+            shutil.copy(file, "repo")
+        self.update_yaml("config.yml", {"archive_older": 3})
+
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        repo = Path("repo/index.xml").read_text()
+        repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+        archive = Path("archive/index.xml").read_text()
+        archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+        self.assertEqual(repo_cnt, 4)
+        self.assertEqual(archive_cnt, 0)
+        self.assertIn("com.politedroid_3.apk", repo)
+        self.assertIn("com.politedroid_4.apk", repo)
+        self.assertIn("com.politedroid_5.apk", repo)
+        self.assertIn("com.politedroid_6.apk", repo)
+        self.assertTrue(Path("repo/com.politedroid_3.apk").is_file())
+        self.assertTrue(Path("repo/com.politedroid_4.apk").is_file())
+        self.assertTrue(Path("repo/com.politedroid_5.apk").is_file())
+        self.assertTrue(Path("repo/com.politedroid_6.apk").is_file())
+
+        # enable one app in the repo
+        self.update_yaml("metadata/com.politedroid.yml", {"ArchivePolicy": 1})
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        repo = Path("repo/index.xml").read_text()
+        repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+        archive = Path("archive/index.xml").read_text()
+        archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+        self.assertEqual(repo_cnt, 1)
+        self.assertEqual(archive_cnt, 3)
+        self.assertIn("com.politedroid_6.apk", repo)
+        self.assertIn("com.politedroid_3.apk", archive)
+        self.assertIn("com.politedroid_4.apk", archive)
+        self.assertIn("com.politedroid_5.apk", archive)
+        self.assertTrue(Path("repo/com.politedroid_6.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_4.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_5.apk").is_file())
+
+        # remove all apps from the repo
+        self.update_yaml("metadata/com.politedroid.yml", {"ArchivePolicy": 0})
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        repo = Path("repo/index.xml").read_text()
+        repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+        archive = Path("archive/index.xml").read_text()
+        archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+        self.assertEqual(repo_cnt, 0)
+        self.assertEqual(archive_cnt, 4)
+        self.assertIn("com.politedroid_3.apk", archive)
+        self.assertIn("com.politedroid_4.apk", archive)
+        self.assertIn("com.politedroid_5.apk", archive)
+        self.assertIn("com.politedroid_6.apk", archive)
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_4.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_5.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_6.apk").is_file())
+        self.assertFalse(Path("repo/com.politedroid_6.apk").exists())
+
+        # move back one from archive to the repo
+        self.update_yaml("metadata/com.politedroid.yml", {"ArchivePolicy": 1})
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        repo = Path("repo/index.xml").read_text()
+        repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+        archive = Path("archive/index.xml").read_text()
+        archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+        self.assertEqual(repo_cnt, 1)
+        self.assertEqual(archive_cnt, 3)
+        self.assertIn("com.politedroid_6.apk", repo)
+        self.assertIn("com.politedroid_3.apk", archive)
+        self.assertIn("com.politedroid_4.apk", archive)
+        self.assertIn("com.politedroid_5.apk", archive)
+        self.assertTrue(Path("repo/com.politedroid_6.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_4.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_5.apk").is_file())
+        self.assertFalse(Path("archive/com.politedroid_6.apk").exists())
+
+        # set an earlier version as CVC and test that it's the only one not archived
+        self.update_yaml("metadata/com.politedroid.yml", {"CurrentVersionCode": 5})
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        repo = Path("repo/index.xml").read_text()
+        repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+        archive = Path("archive/index.xml").read_text()
+        archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+        self.assertEqual(repo_cnt, 1)
+        self.assertEqual(archive_cnt, 3)
+        self.assertIn("com.politedroid_5.apk", repo)
+        self.assertIn("com.politedroid_3.apk", archive)
+        self.assertIn("com.politedroid_4.apk", archive)
+        self.assertIn("com.politedroid_6.apk", archive)
+        self.assertTrue(Path("repo/com.politedroid_5.apk").is_file())
+        self.assertFalse(Path("repo/com.politedroid_6.apk").exists())
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_4.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_6.apk").is_file())
+
+    def test_moving_old_apks_to_and_from_the_archive(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        Path("metadata").mkdir()
+        shutil.copy(FILES / "metadata/com.politedroid.yml", "metadata")
+        self.remove_lines("metadata/com.politedroid.yml", ["ArchivePolicy:"])
+        for file in FILES.glob("repo/com.politedroid_[0-9].apk"):
+            shutil.copy(file, "repo")
+        self.update_yaml("config.yml", {"archive_older": 3})
+
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        repo = Path("repo/index.xml").read_text()
+        repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+        self.assertEqual(repo_cnt, 3)
+        self.assertIn("com.politedroid_4.apk", repo)
+        self.assertIn("com.politedroid_5.apk", repo)
+        self.assertIn("com.politedroid_6.apk", repo)
+        self.assertTrue(Path("repo/com.politedroid_4.apk").is_file())
+        self.assertTrue(Path("repo/com.politedroid_5.apk").is_file())
+        self.assertTrue(Path("repo/com.politedroid_6.apk").is_file())
+        archive = Path("archive/index.xml").read_text()
+        archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+        self.assertEqual(archive_cnt, 1)
+        self.assertIn("com.politedroid_3.apk", archive)
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+
+        self.update_yaml("config.yml", {"archive_older": 1})
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        repo = Path("repo/index.xml").read_text()
+        repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+        self.assertEqual(repo_cnt, 1)
+        self.assertIn("com.politedroid_6.apk", repo)
+        self.assertTrue(Path("repo/com.politedroid_6.apk").is_file())
+        archive = Path("archive/index.xml").read_text()
+        archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+        self.assertEqual(archive_cnt, 3)
+        self.assertIn("com.politedroid_3.apk", archive)
+        self.assertIn("com.politedroid_4.apk", archive)
+        self.assertIn("com.politedroid_5.apk", archive)
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_4.apk").is_file())
+        self.assertTrue(Path("archive/com.politedroid_5.apk").is_file())
+
+        # disabling deletes from the archive
+        metadata_path = Path("metadata/com.politedroid.yml")
+        metadata = metadata_path.read_text()
+        metadata = re.sub(
+            "versionCode: 4", "versionCode: 4\n    disable: testing deletion", metadata
+        )
+        metadata_path.write_text(metadata)
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        repo = Path("repo/index.xml").read_text()
+        repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+        self.assertEqual(repo_cnt, 1)
+        self.assertIn("com.politedroid_6.apk", repo)
+        self.assertTrue(Path("repo/com.politedroid_6.apk").is_file())
+        archive = Path("archive/index.xml").read_text()
+        archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+        self.assertEqual(archive_cnt, 2)
+        self.assertIn("com.politedroid_3.apk", archive)
+        self.assertNotIn("com.politedroid_4.apk", archive)
+        self.assertIn("com.politedroid_5.apk", archive)
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertFalse(Path("archive/com.politedroid_4.apk").exists())
+        self.assertTrue(Path("archive/com.politedroid_5.apk").is_file())
+
+        # disabling deletes from the repo, and promotes one from the archive
+        metadata = re.sub(
+            "versionCode: 6", "versionCode: 6\n    disable: testing deletion", metadata
+        )
+        metadata_path.write_text(metadata)
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        repo = Path("repo/index.xml").read_text()
+        repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+        self.assertEqual(repo_cnt, 1)
+        self.assertIn("com.politedroid_5.apk", repo)
+        self.assertNotIn("com.politedroid_6.apk", repo)
+        self.assertTrue(Path("repo/com.politedroid_5.apk").is_file())
+        self.assertFalse(Path("repo/com.politedroid_6.apk").exists())
+        archive = Path("archive/index.xml").read_text()
+        archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+        self.assertEqual(archive_cnt, 1)
+        self.assertIn("com.politedroid_3.apk", archive)
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertFalse(Path("archive/com.politedroid_6.apk").exists())
+
+    def test_that_verify_can_succeed_and_fail(self):
+        Path("tmp").mkdir()
+        Path("unsigned").mkdir()
+        shutil.copy(FILES / "repo/com.politedroid_6.apk", "tmp")
+        shutil.copy(FILES / "repo/com.politedroid_6.apk", "unsigned")
+        self.assert_run(
+            self.fdroid_cmd
+            + ["verify", "--reuse-remote-apk", "--verbose", "com.politedroid"]
+        )
+        # force a fail
+        shutil.copy(
+            FILES / "repo/com.politedroid_5.apk", "unsigned/com.politedroid_6.apk"
+        )
+        self.assert_run_fail(
+            self.fdroid_cmd
+            + ["verify", "--reuse-remote-apk", "--verbose", "com.politedroid"]
+        )
+
+    def test_allowing_disabled_signatures_in_repo_and_archive(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        self.update_yaml(
+            "config.yml", {"allow_disabled_algorithms": True, "archive_older": 3}
+        )
+        Path("metadata").mkdir()
+        shutil.copy(FILES / "metadata/com.politedroid.yml", "metadata")
+        self.update_yaml(
+            "metadata/info.guardianproject.urzip.yml",
+            {"Summary": "good test version of urzip"},
+            replace=True,
+        )
+        self.update_yaml(
+            "metadata/org.bitbucket.tickytacky.mirrormirror.yml",
+            {"Summary": "good MD5 sig, disabled algorithm"},
+            replace=True,
+        )
+        for file in Path("metadata").glob("*.yml"):
+            self.remove_lines(file, ["ArchivePolicy:"])
+        for file in itertools.chain(
+            FILES.glob("urzip-badsig.apk"),
+            FILES.glob("org.bitbucket.tickytacky.mirrormirror_[0-9].apk"),
+            FILES.glob("repo/com.politedroid_[0-9].apk"),
+        ):
+            shutil.copy(file, "repo")
+
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        repo = Path("repo/index.xml").read_text()
+        repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+        archive = Path("archive/index.xml").read_text()
+        archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+        self.assertEqual(repo_cnt, 6)
+        self.assertEqual(archive_cnt, 2)
+        self.assertIn("com.politedroid_4.apk", repo)
+        self.assertIn("com.politedroid_5.apk", repo)
+        self.assertIn("com.politedroid_6.apk", repo)
+        self.assertIn("com.politedroid_3.apk", archive)
+        self.assertIn("org.bitbucket.tickytacky.mirrormirror_2.apk", repo)
+        self.assertIn("org.bitbucket.tickytacky.mirrormirror_3.apk", repo)
+        self.assertIn("org.bitbucket.tickytacky.mirrormirror_4.apk", repo)
+        self.assertIn("org.bitbucket.tickytacky.mirrormirror_1.apk", archive)
+        self.assertNotIn("urzip-badsig.apk", repo)
+        self.assertNotIn("urzip-badsig.apk", archive)
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertTrue(Path("repo/com.politedroid_4.apk").is_file())
+        self.assertTrue(Path("repo/com.politedroid_5.apk").is_file())
+        self.assertTrue(Path("repo/com.politedroid_6.apk").is_file())
+        self.assertTrue(
+            Path("archive/org.bitbucket.tickytacky.mirrormirror_1.apk").is_file()
+        )
+        self.assertTrue(
+            Path("repo/org.bitbucket.tickytacky.mirrormirror_2.apk").is_file()
+        )
+        self.assertTrue(
+            Path("repo/org.bitbucket.tickytacky.mirrormirror_3.apk").is_file()
+        )
+        self.assertTrue(
+            Path("repo/org.bitbucket.tickytacky.mirrormirror_4.apk").is_file()
+        )
+        self.assertTrue(Path("archive/urzip-badsig.apk").is_file())
+
+        if not USE_APKSIGNER:
+            self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+            repo = Path("repo/index.xml").read_text()
+            repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
+            archive = Path("archive/index.xml").read_text()
+            archive_cnt = sum(1 for line in archive.splitlines() if "<package>" in line)
+            self.assertEqual(repo_cnt, 3)
+            self.assertEqual(archive_cnt, 5)
+            self.assertIn("com.politedroid_4.apk", repo)
+            self.assertIn("com.politedroid_5.apk", repo)
+            self.assertIn("com.politedroid_6.apk", repo)
+            self.assertNotIn("urzip-badsig.apk", repo)
+            self.assertIn("org.bitbucket.tickytacky.mirrormirror_1.apk", archive)
+            self.assertIn("org.bitbucket.tickytacky.mirrormirror_2.apk", archive)
+            self.assertIn("org.bitbucket.tickytacky.mirrormirror_3.apk", archive)
+            self.assertIn("org.bitbucket.tickytacky.mirrormirror_4.apk", archive)
+            self.assertIn("com.politedroid_3.apk", archive)
+            self.assertNotIn("urzip-badsig.apk", archive)
+            self.assertTrue(Path("repo/com.politedroid_4.apk").is_file())
+            self.assertTrue(Path("repo/com.politedroid_5.apk").is_file())
+            self.assertTrue(Path("repo/com.politedroid_6.apk").is_file())
+            self.assertTrue(
+                Path("archive/org.bitbucket.tickytacky.mirrormirror_1.apk").is_file()
+            )
+            self.assertTrue(
+                Path("archive/org.bitbucket.tickytacky.mirrormirror_2.apk").is_file()
+            )
+            self.assertTrue(
+                Path("archive/org.bitbucket.tickytacky.mirrormirror_3.apk").is_file()
+            )
+            self.assertTrue(
+                Path("archive/org.bitbucket.tickytacky.mirrormirror_4.apk").is_file()
+            )
+            self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+            self.assertTrue(Path("archive/urzip-badsig.apk").is_file())
+
+        # test unarchiving when disabled_algorithms are allowed again
+        self.update_yaml("config.yml", {"allow_disabled_algorithms": True})
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        with open("archive/index.xml") as f:
+            archive_cnt = sum(1 for line in f if "<package>" in line)
+        with open("repo/index.xml") as f:
+            repo_cnt = sum(1 for line in f if "<package>" in line)
+        self.assertEqual(repo_cnt, 6)
+        self.assertEqual(archive_cnt, 2)
+        self.assertIn("com.politedroid_4.apk", repo)
+        self.assertIn("com.politedroid_5.apk", repo)
+        self.assertIn("com.politedroid_6.apk", repo)
+        self.assertIn("org.bitbucket.tickytacky.mirrormirror_2.apk", repo)
+        self.assertIn("org.bitbucket.tickytacky.mirrormirror_3.apk", repo)
+        self.assertIn("org.bitbucket.tickytacky.mirrormirror_4.apk", repo)
+        self.assertNotIn("urzip-badsig.apk", repo)
+        self.assertIn("com.politedroid_3.apk", archive)
+        self.assertIn("org.bitbucket.tickytacky.mirrormirror_1.apk", archive)
+        self.assertNotIn("urzip-badsig.apk", archive)
+        self.assertTrue(Path("repo/com.politedroid_4.apk").is_file())
+        self.assertTrue(Path("repo/com.politedroid_5.apk").is_file())
+        self.assertTrue(Path("repo/com.politedroid_6.apk").is_file())
+        self.assertTrue(
+            Path("repo/org.bitbucket.tickytacky.mirrormirror_2.apk").is_file()
+        )
+        self.assertTrue(
+            Path("repo/org.bitbucket.tickytacky.mirrormirror_3.apk").is_file()
+        )
+        self.assertTrue(
+            Path("repo/org.bitbucket.tickytacky.mirrormirror_4.apk").is_file()
+        )
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertTrue(
+            Path("archive/org.bitbucket.tickytacky.mirrormirror_1.apk").is_file()
+        )
+        self.assertTrue(Path("archive/urzip-badsig.apk").is_file())
+
+    def test_rename_apks_with_fdroid_update_rename_apks_opt_nosign_opt_for_speed(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        self.update_yaml(
+            "config.yml",
+            {
+                "keydname": "CN=Birdman, OU=Cell, O=Alcatraz, L=Alcatraz, S=California, C=US"
+            },
+        )
+        Path("metadata").mkdir()
+        shutil.copy(FILES / "metadata/info.guardianproject.urzip.yml", "metadata")
+        shutil.copy(
+            FILES / "urzip.apk",
+            "repo/asdfiuhk urzip-πÇÇπÇÇ现代汉语通用字-български-عربي1234 ö.apk",
+        )
+        self.assert_run(
+            self.fdroid_cmd + ["update", "--rename-apks", "--pretty", "--nosign"]
+        )
+        self.assertTrue(Path("repo/info.guardianproject.urzip_100.apk").is_file())
+        index_xml = Path("repo/index.xml").read_text()
+        index_v1_json = Path("repo/index-v1.json").read_text()
+        self.assertIn("info.guardianproject.urzip_100.apk", index_v1_json)
+        self.assertIn("info.guardianproject.urzip_100.apk", index_xml)
+
+        shutil.copy(FILES / "urzip-release.apk", "repo")
+        self.assert_run(
+            self.fdroid_cmd + ["update", "--rename-apks", "--pretty", "--nosign"]
+        )
+        self.assertTrue(Path("repo/info.guardianproject.urzip_100.apk").is_file())
+        self.assertTrue(
+            Path("repo/info.guardianproject.urzip_100_b4964fd.apk").is_file()
+        )
+        index_xml = Path("repo/index.xml").read_text()
+        index_v1_json = Path("repo/index-v1.json").read_text()
+        self.assertIn("info.guardianproject.urzip_100.apk", index_v1_json)
+        self.assertIn("info.guardianproject.urzip_100.apk", index_xml)
+        self.assertIn("info.guardianproject.urzip_100_b4964fd.apk", index_v1_json)
+        self.assertNotIn("info.guardianproject.urzip_100_b4964fd.apk", index_xml)
+
+        shutil.copy(FILES / "urzip-release.apk", "repo")
+        self.assert_run(
+            self.fdroid_cmd + ["update", "--rename-apks", "--pretty", "--nosign"]
+        )
+        self.assertTrue(Path("repo/info.guardianproject.urzip_100.apk").is_file())
+        self.assertTrue(
+            Path("repo/info.guardianproject.urzip_100_b4964fd.apk").is_file()
+        )
+        self.assertTrue(
+            Path("duplicates/repo/info.guardianproject.urzip_100_b4964fd.apk").is_file()
+        )
+        index_xml = Path("repo/index.xml").read_text()
+        index_v1_json = Path("repo/index-v1.json").read_text()
+        self.assertIn("info.guardianproject.urzip_100.apk", index_v1_json)
+        self.assertIn("info.guardianproject.urzip_100.apk", index_xml)
+        self.assertIn("info.guardianproject.urzip_100_b4964fd.apk", index_v1_json)
+        self.assertNotIn("info.guardianproject.urzip_100_b4964fd.apk", index_xml)
+
+    def test_for_added_date_being_set_correctly_for_repo_and_archive(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        self.update_yaml("config.yml", {"archive_older": 3})
+        Path("metadata").mkdir()
+        Path("archive").mkdir()
+        Path("stats").mkdir()
+        shutil.copy(FILES / "repo/com.politedroid_6.apk", "repo")
+        shutil.copy(FILES / "repo/index-v2.json", "repo")
+        shutil.copy(FILES / "repo/com.politedroid_5.apk", "archive")
+        shutil.copy(FILES / "metadata/com.politedroid.yml", "metadata")
+
+        # TODO: the timestamp of the oldest apk in the file should be used, even
+        #       if that doesn't exist anymore
+        self.update_yaml("metadata/com.politedroid.yml", {"ArchivePolicy": 1})
+
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        timestamp = int(datetime(2017, 6, 23, tzinfo=UTC).timestamp()) * 1000
+        index_v1_json = Path("repo/index-v1.json").read_text()
+        self.assertIn(f'"added": {timestamp}', index_v1_json)
+        # the archive will have the added timestamp for the app and for the apk,
+        # both need to be there
+        with open("archive/index-v1.json") as f:
+            count = sum(1 for line in f if f'"added": {timestamp}' in line)
+        self.assertEqual(count, 2)
+
+    def test_whatsnew_from_fastlane_without_cvc_set(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        Path("metadata/com.politedroid/en-US/changelogs").mkdir(parents=True)
+        shutil.copy(FILES / "repo/com.politedroid_6.apk", "repo")
+        shutil.copy(FILES / "metadata/com.politedroid.yml", "metadata")
+        self.remove_lines("metadata/com.politedroid.yml", ["CurrentVersion:"])
+        Path("metadata/com.politedroid/en-US/changelogs/6.txt").write_text(
+            "whatsnew test"
+        )
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
+        index_v1_json = Path("repo/index-v1.json").read_text()
+        self.assertIn("whatsnew test", index_v1_json)
+
+    def test_metadata_checks(self):
+        Path("repo").mkdir()
+        shutil.copy(FILES / "urzip.apk", "repo")
+        # this should fail because there is no metadata
+        self.assert_run_fail(self.fdroid_cmd + ["build"])
+        Path("metadata").mkdir()
+        shutil.copy(FILES / "metadata/org.smssecure.smssecure.yml", "metadata")
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+
+    def test_ensure_commands_that_dont_need_the_jdk_work_without_a_jdk_configured(self):
+        Path("repo").mkdir()
+        Path("metadata").mkdir()
+        self.update_yaml(
+            "metadata/fake.yml",
+            {
+                "License": "GPL-2.0-only",
+                "Summary": "Yup still fake",
+                "Categories": ["Internet"],
+                "Description": "this is fake",
+            },
+        )
+        # fake that no JDKs are available
+        self.update_yaml(
+            "config.yml", {"categories": ["Internet"], "java_paths": {}}, replace=True
+        )
+        local_copy_dir = self.tmp / "fdroid"
+        (local_copy_dir / "repo").mkdir(parents=True)
+        self.update_yaml(
+            "config.yml", {"local_copy_dir": str(local_copy_dir.resolve())}
+        )
+
+        subprocess.run(self.fdroid_cmd + ["checkupdates", "--allow-dirty"])
+        if shutil.which("gpg"):
+            self.assert_run(self.fdroid_cmd + ["gpgsign"])
+        self.assert_run(self.fdroid_cmd + ["lint"])
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+        self.assert_run(self.fdroid_cmd + ["rewritemeta", "fake"])
+        self.assert_run(self.fdroid_cmd + ["deploy"])
+        self.assert_run(self.fdroid_cmd + ["scanner"])
+
+        # run these to get their output, but the are not setup, so don't fail
+        subprocess.run(self.fdroid_cmd + ["build"])
+        subprocess.run(self.fdroid_cmd + ["import"])
+        subprocess.run(self.fdroid_cmd + ["install", "-n"])
+
+    def test_config_checks_of_local_copy_dir(self):
+        self.assert_run(self.fdroid_cmd + ["init"])
+        self.assert_run(self.fdroid_cmd + ["update", "--create-metadata", "--verbose"])
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+        local_copy_dir = (self.tmp / "fdroid").resolve()
+        local_copy_dir.mkdir()
+        self.assert_run(
+            self.fdroid_cmd + ["deploy", "--local-copy-dir", local_copy_dir]
+        )
+        self.assert_run(
+            self.fdroid_cmd
+            + ["deploy", "--local-copy-dir", local_copy_dir, "--verbose"]
+        )
+
+        # this should fail because thisisnotanabsolutepath is not an absolute path
+        self.assert_run_fail(
+            self.fdroid_cmd + ["deploy", "--local-copy-dir", "thisisnotanabsolutepath"]
+        )
+        # this should fail because the path doesn't end with "fdroid"
+        self.assert_run_fail(
+            self.fdroid_cmd
+            + ["deploy", "--local-copy-dir", "/tmp/IReallyDoubtThisPathExistsasdfasdf"]
+        )
+        # this should fail because the dirname path does not exist
+        self.assert_run_fail(
+            self.fdroid_cmd
+            + [
+                "deploy",
+                "--local-copy-dir",
+                "/tmp/IReallyDoubtThisPathExistsasdfasdf/fdroid",
+            ]
+        )
+
+    def test_setup_a_new_repo_from_scratch_using_android_home_and_do_a_local_sync(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        self.copy_apks_into_repo()
+        self.assert_run(self.fdroid_cmd + ["update", "--create-metadata", "--verbose"])
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+        self.assertIn("<application id=", Path("repo/index.xml").read_text())
+
+        local_copy_dir = self.tmp / "fdroid"
+        self.assert_run(
+            self.fdroid_cmd + ["deploy", "--local-copy-dir", local_copy_dir]
+        )
+
+        (new_tmp_repo := self.tmp / "new_repo").mkdir()
+        os.chdir(new_tmp_repo)
+        self.fdroid_init_with_prebuilt_keystore()
+        self.update_yaml("config.yml", {"sync_from_local_copy_dir": True})
+        self.assert_run(
+            self.fdroid_cmd + ["deploy", "--local-copy-dir", local_copy_dir]
+        )
+
+    def test_check_that_android_home_opt_fails_when_dir_does_not_exist_or_is_not_a_dir(
+        self,
+    ):
+        # this should fail because /opt/fakeandroidhome does not exist
+        self.assert_run_fail(
+            self.fdroid_cmd
+            + [
+                "init",
+                "--keystore",
+                "keystore.p12",
+                "--android-home",
+                "/opt/fakeandroidhome",
+            ]
+        )
+        Path("test_file").touch()
+        # this should fail because test_file is not a directory
+        self.assert_run_fail(
+            self.fdroid_cmd
+            + ["init", "--keystore", "keystore.p12", "--android-home", "test_file"]
+        )
+
+    def test_check_that_fake_android_home_passes_fdroid_init(self):
+        android_home = self.tmp / "android-sdk"
+        android_home.mkdir()
+        self.create_fake_android_home(android_home)
+        self.assert_run(
+            self.fdroid_cmd
+            + ["init", "--keystore", "keystore.p12", "--android-home", android_home]
+        )
+
+    @unittest.skip
+    def test_check_that_fdroid_init_fails_when_build_tools_cannot_be_found(self):
+        (fake_android_home := self.tmp / "android-sdk").mkdir()
+        self.create_fake_android_home(fake_android_home)
+        (fake_android_home / "build-tools/34.0.0/aapt").unlink()
+        self.assert_run_fail(
+            self.fdroid_cmd
+            + [
+                "init",
+                "--keystore",
+                "keystore.p12",
+                "--android-home",
+                fake_android_home,
+            ]
+        )
+
+    def check_that_android_home_opt_overrides_android_home_env_var(self):
+        (fake_android_home := self.tmp / "android-sdk").mkdir()
+        self.create_fake_android_home(fake_android_home)
+        self.assert_run(
+            self.fdroid_cmd
+            + [
+                "init",
+                "--keystore",
+                "keystore.p12",
+                "--android-home",
+                fake_android_home,
+            ]
+        )
+        # the value set in --android-home should override $ANDROID_HOME
+        self.assertIn(str(fake_android_home), Path("config.yml").read_text())
+
+    @unittest.skipUnless(
+        "ANDROID_HOME" in os.environ, "runs only with ANDROID_HOME set"
+    )
+    def setup_a_new_repo_from_scratch_with_keystore_and_android_home_opt_set_on_cmd_line(
+        self,
+    ):
+        # In this case, ANDROID_HOME is set to a fake, non-working version that
+        # will be detected by fdroid as an Android SDK install. It should use
+        # the path set by --android-home over the one in ANDROID_HOME, therefore
+        # if it uses the one in ANDROID_HOME, it won't work because it is a fake
+        # one.  Only --android-home provides a working one.
+        real_android_home = os.environ["ANDROID_HOME"]
+        (fake_android_home := self.tmp / "android-sdk").mkdir()
+        env = os.environ.copy()
+        env["ANDROID_HOME"] = str(fake_android_home)
+        self.assert_run(
+            self.fdroid_cmd
+            + [
+                "init",
+                "--keystore",
+                "keystore.p12",
+                "--android-home",
+                real_android_home,
+                "--no-prompt",
+            ],
+            env=env,
+        )
+        self.assertTrue(Path("keystore.p12").is_file())
+        self.copy_apks_into_repo()
+        self.assert_run(
+            self.fdroid_cmd + ["update", "--create-metadata", "--verbose"], env=env
+        )
+        self.assert_run(self.fdroid_cmd + ["readmeta"], env=env)
+        self.assertIn("<application id=", Path("repo/index.xml").read_text())
+        self.assertTrue(Path("repo/index.jar").is_file())
+        self.assertTrue(Path("repo/index-v1.jar").is_file())
+        apkcache = Path("tmp/apkcache.json")
+        self.assertTrue(apkcache.is_file())
+        self.assertTrue(apkcache.stat().st_size > 0)
+
+    def test_check_duplicate_files_are_properly_handled_by_fdroid_update(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        Path("metadata").mkdir()
+        shutil.copy(FILES / "metadata/obb.mainpatch.current.yml", "metadata")
+        shutil.copy(FILES / "repo/obb.mainpatch.current_1619.apk", "repo")
+        shutil.copy(
+            FILES / "repo/obb.mainpatch.current_1619_another-release-key.apk", "repo"
+        )
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty"])
+        index_xml = Path("repo/index.xml").read_text()
+        index_v1_json = Path("repo/index-v1.json").read_text()
+        self.assertNotIn(
+            "obb.mainpatch.current_1619_another-release-key.apk", index_xml
+        )
+        self.assertIn("obb.mainpatch.current_1619.apk", index_xml)
+        self.assertIn("obb.mainpatch.current_1619.apk", index_v1_json)
+        self.assertIn(
+            "obb.mainpatch.current_1619_another-release-key.apk", index_v1_json
+        )
+        # die if there are exact duplicates
+        shutil.copy(FILES / "repo/obb.mainpatch.current_1619.apk", "repo/duplicate.apk")
+        self.assert_run_fail(self.fdroid_cmd + ["update"])
+
+    def test_setup_new_repo_from_scratch_using_android_home_env_var_putting_apks_in_repo_first(
+        self,
+    ):
+        Path("repo").mkdir()
+        self.copy_apks_into_repo()
+        self.fdroid_init_with_prebuilt_keystore()
+        self.assert_run(self.fdroid_cmd + ["update", "--create-metadata", "--verbose"])
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+        self.assertIn("<application id=", Path("repo/index.xml").read_text())
+
+    def test_setup_a_new_repo_from_scratch_and_generate_a_keystore(self):
+        self.assert_run(self.fdroid_cmd + ["init", "--keystore", "keystore.p12"])
+        self.assertTrue(Path("keystore.p12").is_file())
+        self.copy_apks_into_repo()
+        self.assert_run(self.fdroid_cmd + ["update", "--create-metadata", "--verbose"])
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+        self.assertIn("<application id=", Path("repo/index.xml").read_text())
+        self.assertTrue(Path("repo/index.jar").is_file())
+        self.assertTrue(Path("repo/index-v1.jar").is_file())
+        apkcache = Path("tmp/apkcache.json")
+        self.assertTrue(apkcache.is_file())
+        self.assertTrue(apkcache.stat().st_size > 0)
+
+    def test_setup_a_new_repo_manually_and_generate_a_keystore(self):
+        self.assertFalse(Path("keystore.p12").exists())
+        # this should fail because this repo has no keystore
+        self.assert_run_fail(self.fdroid_cmd + ["update"])
+        self.assert_run(self.fdroid_cmd + ["update", "--create-key"])
+        self.assertTrue(Path("keystore.p12").is_file())
+        self.copy_apks_into_repo()
+        self.assert_run(self.fdroid_cmd + ["update", "--create-metadata", "--verbose"])
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+        self.assertIn("<application id=", Path("repo/index.xml").read_text())
+        self.assertTrue(Path("repo/index.jar").is_file())
+        self.assertTrue(Path("repo/index-v1.jar").is_file())
+        apkcache = Path("tmp/apkcache.json")
+        self.assertTrue(apkcache.is_file())
+        self.assertTrue(apkcache.stat().st_size > 0)
+
+    def test_setup_a_new_repo_from_scratch_generate_a_keystore_then_add_apk_and_update(
+        self,
+    ):
+        self.assert_run(self.fdroid_cmd + ["init", "--keystore", "keystore.p12"])
+        self.assertTrue(Path("keystore.p12").is_file())
+        self.copy_apks_into_repo()
+        self.assert_run(self.fdroid_cmd + ["update", "--create-metadata", "--verbose"])
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+        self.assertIn("<application id=", Path("repo/index.xml").read_text())
+        self.assertTrue(Path("repo/index.jar").is_file())
+        self.assertTrue(Path("repo/index-v1.jar").is_file())
+
+        if not Path("repo/info.guardianproject.urzip_100.apk").exists():
+            shutil.copy(FILES / "urzip.apk", "repo")
+        self.assert_run(self.fdroid_cmd + ["update", "--create-metadata", "--verbose"])
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+        self.assertIn("<application id=", Path("repo/index.xml").read_text())
+        self.assertTrue(Path("repo/index.jar").is_file())
+        self.assertTrue(Path("repo/index-v1.jar").is_file())
+        apkcache = Path("tmp/apkcache.json")
+        self.assertTrue(apkcache.is_file())
+        self.assertTrue(apkcache.stat().st_size > 0)
+        self.assertIn("<application id=", Path("repo/index.xml").read_text())
+
+    def test_setup_a_new_repo_from_scratch_with_a_hsm_or_smartcard(self):
+        self.assert_run(self.fdroid_cmd + ["init", "--keystore", "NONE"])
+        self.assertTrue(Path("opensc-fdroid.cfg").is_file())
+        self.assertFalse(Path("NONE").exists())
+
+    def test_setup_a_new_repo_with_no_keystore_add_apk_and_update(self):
+        Path("fdroid-icon.png").touch()
+        Path("repo").mkdir()
+        shutil.copy(FILES / "urzip.apk", "repo")
+        # this should fail because this repo has no keystore
+        self.assert_run_fail(
+            self.fdroid_cmd + ["update", "--create-metadata", "--verbose"]
+        )
+
+        # now set up fake, non-working keystore setup
+        Path("keystore.p12").touch()
+        self.update_yaml(
+            "config.yml",
+            {
+                "keystore": "keystore.p12",
+                "repo_keyalias": "foo",
+                "keystorepass": "foo",
+                "keypass": "foo",
+            },
+        )
+        # this should fail because this repo has a bad/fake keystore
+        self.assert_run_fail(
+            self.fdroid_cmd + ["update", "--create-metadata", "--verbose"]
+        )
+
+    def test_copy_tests_repo_update_with_binary_transparency_log(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        shutil.copytree(FILES / "repo", "repo", dirs_exist_ok=True)
+        shutil.copytree(FILES / "metadata", "metadata")
+        git_remote = self.tmp / "git_remote"
+        self.update_yaml("config.yml", {"binary_transparency_remote": str(git_remote)})
+        self.assert_run(self.fdroid_cmd + ["update", "--verbose"])
+        self.assert_run(self.fdroid_cmd + ["deploy", "--verbose"])
+        self.assertIn("<application id=", Path("repo/index.xml").read_text())
+        self.assertTrue(Path("repo/index.jar").is_file())
+        self.assertTrue(Path("repo/index-v1.jar").is_file())
+        os.chdir("binary_transparency")
+        proc = self.assert_run(
+            ["git", "rev-list", "--count", "HEAD"], capture_output=True
+        )
+        self.assertEqual(int(proc.stdout), 2)
+        os.chdir(git_remote)
+        proc = self.assert_run(
+            ["git", "rev-list", "--count", "HEAD"], capture_output=True
+        )
+        self.assertEqual(int(proc.stdout), 2)
+
+    def test_setup_a_new_repo_with_keystore_with_apk_update_then_without_key(self):
+        shutil.copy(FILES / "keystore.jks", "keystore.jks")
+        self.fdroid_init_with_prebuilt_keystore("keystore.jks")
+        shutil.copy(FILES / "urzip.apk", "repo")
+        self.assert_run(self.fdroid_cmd + ["update", "--create-metadata", "--verbose"])
+        self.assert_run(self.fdroid_cmd + ["readmeta"])
+        self.assertIn("<application id=", Path("repo/index.xml").read_text())
+        self.assertTrue(Path("repo/index.jar").is_file())
+        self.assertTrue(Path("repo/index-v1.jar").is_file())
+        apkcache = Path("tmp/apkcache.json")
+        self.assertTrue(apkcache.is_file())
+        self.assertTrue(apkcache.stat().st_size > 0)
+
+        # now set fake repo_keyalias
+        self.update_yaml("config.yml", {"repo_keyalias": "fake"})
+        # this should fail because this repo has a bad repo_keyalias
+        self.assert_run_fail(self.fdroid_cmd + ["update"])
+
+        # this should fail because a keystore is already there
+        self.assert_run_fail(self.fdroid_cmd + ["update", "--create-key"])
+
+        # now actually create the key with the existing settings
+        Path("keystore.jks").unlink()
+        self.assert_run(self.fdroid_cmd + ["update", "--create-key"])
+        self.assertTrue(Path("keystore.jks").is_file())
+
+    def test_setup_a_new_repo_from_scratch_using_android_home_env_var_with_git_mirror(
+        self,
+    ):
+        (server_git_mirror := self.tmp / "server_git_mirror").mkdir()
+        self.assert_run(
+            ["git", "-C", server_git_mirror, "init", "--initial-branch", "master"]
+        )
+        self.assert_run(
+            [
+                "git",
+                "-C",
+                server_git_mirror,
+                "config",
+                "receive.denyCurrentBranch",
+                "updateInstead",
+            ]
+        )
+
+        self.fdroid_init_with_prebuilt_keystore()
+        self.update_yaml(
+            "config.yml",
+            {"archive_older": 3, "servergitmirrors": str(server_git_mirror)},
+        )
+        for file in FILES.glob("repo/com.politedroid_[345].apk"):
+            shutil.copy(file, "repo")
+        self.assert_run(self.fdroid_cmd + ["update", "--create-metadata"])
+        self.assert_run(self.fdroid_cmd + ["deploy"])
+        git_mirror = Path("git-mirror")
+        self.assertTrue((git_mirror / "fdroid/repo/com.politedroid_3.apk").is_file())
+        self.assertTrue((git_mirror / "fdroid/repo/com.politedroid_4.apk").is_file())
+        self.assertTrue((git_mirror / "fdroid/repo/com.politedroid_5.apk").is_file())
+        self.assertTrue(
+            (server_git_mirror / "fdroid/repo/com.politedroid_3.apk").is_file()
+        )
+        self.assertTrue(
+            (server_git_mirror / "fdroid/repo/com.politedroid_4.apk").is_file()
+        )
+        self.assertTrue(
+            (server_git_mirror / "fdroid/repo/com.politedroid_5.apk").is_file()
+        )
+        (git_mirror / ".git/test-stamp").write_text(str(datetime.now()))
+
+        # add one more APK to trigger archiving
+        shutil.copy(FILES / "repo/com.politedroid_6.apk", "repo")
+        self.assert_run(self.fdroid_cmd + ["update"])
+        self.assert_run(self.fdroid_cmd + ["deploy"])
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertFalse((git_mirror / "fdroid/archive/com.politedroid_3.apk").exists())
+        self.assertFalse(
+            (server_git_mirror / "fdroid/archive/com.politedroid_3.apk").exists()
+        )
+        self.assertTrue((git_mirror / "fdroid/repo/com.politedroid_4.apk").is_file())
+        self.assertTrue((git_mirror / "fdroid/repo/com.politedroid_5.apk").is_file())
+        self.assertTrue((git_mirror / "fdroid/repo/com.politedroid_6.apk").is_file())
+        self.assertTrue(
+            (server_git_mirror / "fdroid/repo/com.politedroid_4.apk").is_file()
+        )
+        self.assertTrue(
+            (server_git_mirror / "fdroid/repo/com.politedroid_5.apk").is_file()
+        )
+        self.assertTrue(
+            (server_git_mirror / "fdroid/repo/com.politedroid_6.apk").is_file()
+        )
+        before = sum(
+            f.stat().st_size for f in (git_mirror / ".git").glob("**/*") if f.is_file()
+        )
+
+        self.update_yaml("config.yml", {"git_mirror_size_limit": "60kb"})
+        self.assert_run(self.fdroid_cmd + ["update"])
+        self.assert_run(self.fdroid_cmd + ["deploy"])
+        self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
+        self.assertFalse(
+            (server_git_mirror / "fdroid/archive/com.politedroid_3.apk").exists()
+        )
+        after = sum(
+            f.stat().st_size for f in (git_mirror / ".git").glob("**/*") if f.is_file()
+        )
+        self.assertFalse((git_mirror / ".git/test-stamp").exists())
+        self.assert_run(["git", "-C", git_mirror, "gc"])
+        self.assert_run(["git", "-C", server_git_mirror, "gc"])
+        self.assertGreater(before, after)
+
+    def test_sign_binary_repo_in_offline_box_then_publishing_from_online_box(self):
+        (offline_root := self.tmp / "offline_root").mkdir()
+        (local_copy_dir := self.tmp / "local_copy_dir/fdroid").mkdir(parents=True)
+        (online_root := self.tmp / "online_root").mkdir()
+        (server_web_root := self.tmp / "server_web_root/fdroid").mkdir(parents=True)
+
+        # create offline binary transparency log
+        (offline_root / "binary_transparency").mkdir()
+        os.chdir(offline_root / "binary_transparency")
+        self.assert_run(["git", "init", "--initial-branch", "master"])
+
+        # fake git remote server for binary transparency log
+        (binary_transparency_remote := self.tmp / "binary_transparency_remote").mkdir()
+
+        # fake git remote server for repo mirror
+        (server_git_mirror := self.tmp / "server_git_mirror").mkdir()
+        os.chdir(server_git_mirror)
+        self.assert_run(["git", "init", "--initial-branch", "master"])
+        self.assert_run(["git", "config", "receive.denyCurrentBranch", "updateInstead"])
+
+        os.chdir(offline_root)
+        self.fdroid_init_with_prebuilt_keystore()
+        shutil.copytree(FILES / "repo", "repo", dirs_exist_ok=True)
+        shutil.copytree(FILES / "metadata", "metadata")
+        Path("unsigned").mkdir()
+        shutil.copy(FILES / "urzip-release-unsigned.apk", "unsigned")
+        self.update_yaml(
+            "config.yml",
+            {
+                "archive_older": 3,
+                "mirrors": [
+                    "http://foo.bar/fdroid",
+                    "http://asdflkdsfjafdsdfhkjh.onion/fdroid",
+                ],
+                "servergitmirrors": str(server_git_mirror),
+                "local_copy_dir": str(local_copy_dir),
+            },
+        )
+        self.assert_run(self.fdroid_cmd + ["update", "--pretty"])
+        index_xml = Path("repo/index.xml").read_text()
+        self.assertIn("<application id=", index_xml)
+        self.assertIn("/fdroid/repo</mirror>", index_xml)
+        mirror_cnt = sum(1 for line in index_xml.splitlines() if "<mirror>" in line)
+        self.assertEqual(mirror_cnt, 2)
+
+        archive_xml = Path("archive/index.xml").read_text()
+        self.assertIn("/fdroid/archive</mirror>", archive_xml)
+        mirror_cnt = sum(1 for line in archive_xml.splitlines() if "<mirror>" in line)
+        self.assertEqual(mirror_cnt, 2)
+
+        os.chdir("binary_transparency")
+        proc = self.assert_run(
+            ["git", "rev-list", "--count", "HEAD"], capture_output=True
+        )
+        self.assertEqual(int(proc.stdout), 1)
+        os.chdir(offline_root)
+        self.assert_run(self.fdroid_cmd + ["deploy", "--verbose"])
+        self.assertTrue(
+            Path(local_copy_dir / "unsigned/urzip-release-unsigned.apk").is_file()
+        )
+        self.assertIn(
+            "<application id=", (local_copy_dir / "repo/index.xml").read_text()
+        )
+        os.chdir(online_root)
+        self.update_yaml(
+            "config.yml",
+            {
+                "local_copy_dir": str(local_copy_dir),
+                "sync_from_local_copy_dir": True,
+                "serverwebroot": str(server_web_root),
+                "servergitmirrors": str(server_git_mirror),
+                "binary_transparency_remote": str(binary_transparency_remote),
+            },
+        )
+        self.assert_run(self.fdroid_cmd + ["deploy", "--verbose"])
+        self.assertTrue((online_root / "unsigned/urzip-release-unsigned.apk").is_file())
+        self.assertTrue(
+            (server_web_root / "unsigned/urzip-release-unsigned.apk").is_file()
+        )
+        os.chdir(binary_transparency_remote)
+        proc = self.assert_run(
+            ["git", "rev-list", "--count", "HEAD"], capture_output=True
+        )
+        self.assertEqual(int(proc.stdout), 1)
+        os.chdir(server_git_mirror)
+        proc = self.assert_run(
+            ["git", "rev-list", "--count", "HEAD"], capture_output=True
+        )
+        if sys.platform != "darwin":  # TODO: fix on macOS
+            self.assertEqual(int(proc.stdout), 1)
+
+    @unittest.skipUnless(USE_APKSIGNER, "requires apksigner")
+    def test_extracting_and_publishing_with_developer_signature(self):
+        self.fdroid_init_with_prebuilt_keystore()
+        self.update_yaml(
+            "config.yml",
+            {
+                "keydname": "CN=Birdman, OU=Cell, O=Alcatraz, L=Alcatraz, S=California, C=US"
+            },
+        )
+        Path("metadata").mkdir()
+        shutil.copy(FILES / "metadata/com.politedroid.yml", "metadata")
+        Path("unsigned").mkdir()
+        shutil.copy(FILES / "repo/com.politedroid_6.apk", "unsigned")
+        self.assert_run(
+            self.fdroid_cmd + ["signatures", "unsigned/com.politedroid_6.apk"]
+        )
+        self.assertTrue(
+            Path("metadata/com.politedroid/signatures/6/MANIFEST.MF").is_file()
+        )
+        self.assertTrue(
+            Path("metadata/com.politedroid/signatures/6/RELEASE.RSA").is_file()
+        )
+        self.assertTrue(
+            Path("metadata/com.politedroid/signatures/6/RELEASE.SF").is_file()
+        )
+        self.assertFalse(Path("repo/com.politedroid_6.apk").exists())
+        self.assert_run(self.fdroid_cmd + ["publish"])
+        self.assertTrue(Path("repo/com.politedroid_6.apk").is_file())
+        if shutil.which("apksigner"):
+            self.assert_run(["apksigner", "verify", "repo/com.politedroid_6.apk"])
+        if shutil.which("jarsigner"):
+            self.assert_run(["jarsigner", "-verify", "repo/com.politedroid_6.apk"])
+
+    @unittest.skipUnless(shutil.which("wget"), "requires wget")
+    def test_mirroring_a_repo(self):
+        tmp_test = self.tmp / "test"
+        tmp_test.mkdir()
+        shutil.copytree(FILES, tmp_test, dirs_exist_ok=True)
+        os.chdir(tmp_test)
+        Path("archive").mkdir()
+        shutil.copy("repo/index-v1.json", self.tmp_repo)
+        self.assert_run(self.fdroid_cmd + ["update"])
+        self.assert_run(self.fdroid_cmd + ["signindex"])
+        shutil.move(self.tmp_repo / "index-v1.json", "repo/index-v1.json")
+
+        class RequestHandler(SimpleHTTPRequestHandler):
+            def __init__(self, *args, **kwargs):
+                super().__init__(*args, directory=tmp_test, **kwargs)
+
+        httpd = ThreadingHTTPServer(("127.0.0.1", 0), RequestHandler)
+        threading.Thread(target=httpd.serve_forever).start()
+
+        os.chdir(self.tmp_repo)
+        host, port = httpd.socket.getsockname()
+        url, output_dir = f"http://{host}:{port}/", Path(f"{host}:{port}")
+        env = os.environ.copy()
+        env.pop("http_proxy", None)
+        self.assert_run(self.fdroid_cmd + ["mirror", url], env=env)
+        self.assertTrue((output_dir / "repo/souch.smsbypass_9.apk").is_file())
+        self.assertTrue((output_dir / "repo/icons-640/souch.smsbypass.9.png").is_file())
+        # the index shouldn't be saved unless it was verified
+        self.assertFalse((output_dir / "repo/index-v1.jar").exists())
+        self.assert_run_fail(
+            self.fdroid_cmd + ["mirror", f"{url}?fingerprint=asdfasdf"], env=env
+        )
+        self.assertFalse((output_dir / "repo/index-v1.jar").exists())
+        self.assert_run(
+            self.fdroid_cmd
+            + [
+                "mirror",
+                f"{url}?fingerprint=F49AF3F11EFDDF20DFFD70F5E3117B9976674167ADCA280E6B1932A0601B26F6",
+            ],
+            env=env,
+        )
+        self.assertTrue((output_dir / "repo/index-v1.jar").is_file())
+
+        httpd.shutdown()
+
+    def test_recovering_from_broken_git_submodules(self):
+        Path("foo").mkdir()
+        Path("bar").mkdir()
+        os.chdir("foo")
+        self.assert_run(["git", "init"])
+        Path("a").write_text("a")
+        self.assert_run(["git", "add", "a"])
+        self.assert_run(["git", "commit", "-m", "a"])
+
+        os.chdir("../bar")
+        self.assert_run(["git", "init"])
+        self.assert_run(
+            ["git", "submodule", "add", f"file://{Path().resolve()}/../foo", "baz"],
+            env=os.environ | {"GIT_ALLOW_PROTOCOL": "file"},
+        )
+        Path(".gitmodules").unlink()
+        self.assert_run(["git", "commit", "-am", "a"])
+        shutil.rmtree("baz")
+        self.assert_run(["git", "checkout", "baz"])
+        self.assert_run(["git", "tag", "2"])
+
+        os.chdir("..")
+        Path("repo").mkdir()
+        Path("metadata").mkdir()
+        self.update_yaml(
+            "metadata/fake.yml",
+            {
+                "RepoType": "git",
+                "Repo": f"file://{Path().resolve()}/bar",
+                "AutoUpdateMode": "Version",
+                "UpdateCheckMode": "Tags",
+                "UpdateCheckData": "|||",
+                "CurrentVersion": 1,
+                "CurrentVersionCode": 1,
+            },
+        )
+        self.assert_run(self.fdroid_cmd + ["checkupdates", "--allow-dirty"])
+        self.assertIn("CurrentVersionCode: 2", Path("metadata/fake.yml").read_text())
+
+    def test_checkupdates_ignore_broken_submodule(self):
+        Path("foo").mkdir()
+        Path("bar").mkdir()
+        os.chdir("foo")
+        self.assert_run(["git", "init"])
+        Path("a").write_text("a")
+        self.assert_run(["git", "add", "a"])
+        self.assert_run(["git", "commit", "-m", "a"])
+
+        os.chdir("../bar")
+        self.assert_run(["git", "init"])
+        self.assert_run(
+            ["git", "submodule", "add", f"file://{Path().resolve()}/../foo", "baz"],
+            env=os.environ | {"GIT_ALLOW_PROTOCOL": "file"},
+        )
+        self.assert_run(["git", "commit", "-am", "a"])
+        self.assert_run(["git", "tag", "2"])
+
+        os.chdir("../foo")
+        # delete the commit referenced in bar
+        self.assert_run(["git", "commit", "--amend", "-m", "aa"])
+        self.assert_run(["git", "reflog", "expire", "--expire", "now", "--all"])
+        self.assert_run(["git", "gc", "--aggressive", "--prune=now"])
+
+        os.chdir("..")
+
+        Path("repo").mkdir()
+        Path("metadata").mkdir()
+        self.update_yaml(
+            "metadata/fake.yml",
+            {
+                "RepoType": "git",
+                "Repo": f"file://{Path().resolve()}/bar",
+                "Builds": [{"versionName": 1, "versionCode": 1, "submodules": True}],
+                "AutoUpdateMode": "Version",
+                "UpdateCheckMode": "Tags",
+                "UpdateCheckData": "|||",
+                "CurrentVersion": 1,
+                "CurrentVersionCode": 1,
+            },
+        )
+        self.assert_run(self.fdroid_cmd + ["checkupdates", "--allow-dirty"])
+        self.assertIn("CurrentVersionCode: 2", Path("metadata/fake.yml").read_text())
+
+    def test_checkupdates_check_version_in_submodule(self):
+        Path("app").mkdir()
+        Path("sub").mkdir()
+        os.chdir("sub")
+        self.assert_run(["git", "init"])
+        Path("ver").write_text("1")
+        self.assert_run(["git", "add", "ver"])
+        self.assert_run(["git", "commit", "-m", "1"])
+
+        os.chdir("../app")
+        self.assert_run(["git", "init"])
+        self.assert_run(
+            ["git", "submodule", "add", f"file://{Path().resolve()}/../sub"],
+            env=os.environ | {"GIT_ALLOW_PROTOCOL": "file"},
+        )
+        self.assert_run(["git", "commit", "-am", "1"])
+        self.assert_run(["git", "tag", "1"])
+
+        os.chdir("../sub")
+        Path("ver").write_text("2")
+        self.assert_run(["git", "commit", "-am", "2"])
+
+        os.chdir("../app")
+        self.assert_run(["git", "init"])
+        self.assert_run(
+            ["git", "submodule", "update", "--remote"],
+            env=os.environ | {"GIT_ALLOW_PROTOCOL": "file"},
+        )
+        self.assert_run(["git", "commit", "-am", "2"])
+
+        os.chdir("..")
+        Path("repo").mkdir()
+        Path("metadata").mkdir()
+        self.update_yaml(
+            "metadata/fake.yml",
+            {
+                "RepoType": "git",
+                "Repo": f"file://{Path().resolve()}/app",
+                "Builds": [{"versionName": 0, "versionCode": 0, "submodules": True}],
+                "AutoUpdateMode": "Version",
+                "UpdateCheckMode": "Tags",
+                "UpdateCheckData": r"sub/ver|(\d)||",
+                "CurrentVersion": 0,
+                "CurrentVersionCode": 0,
+            },
+        )
+        self.assert_run(
+            self.fdroid_cmd + ["checkupdates", "--allow-dirty", "--auto", "-v"],
+            env=os.environ | {"GIT_ALLOW_PROTOCOL": "file"},
+        )
+        self.assertIn("CurrentVersionCode: 1", Path("metadata/fake.yml").read_text())