Managed by Gothwad Tech & Dark Root. The Android application ID is com.gothwad.store (namespace/source package: com.gothwad.store). This replaces the earlier com.aistudio.gothwadstore.kzvqnp ID: Android treats it as a separate app, so install the new Kiwi Store build alongside the old one or uninstall the old one first. App data does not migrate automatically.
Native Kotlin / Jetpack Compose client for the existing GothwadTech/store Cloudflare Worker. The app never connects directly to Supabase and includes no backend credentials.
- Bottom tabs: Home | Apps | Kiwi | Games | Profile. The Kiwi tab lists exactly the apps that are live on the Kiwi Store web (kiwistore.gothwadtech.com) — it reads the Worker catalogue only, so no upstream mirror ever leaks into it.
- All five tabs share one header: the Kiwi Store icon on the left, the search field in the middle and the profile avatar on the right. Tapping the search field opens the search screen, so there is no separate search tab.
- Settings → App sources shows everything the app runs on: the Kiwi Store web catalogue, the F-Droid and IzzyOnDroid repositories with their URLs, index sizes, listing counts, sync times and failover mirrors — plus a live view of what is running right now (catalogue sync, download jobs, installer back-ends, network and account).
- Live published apps and games from the Worker, with category filters.
- F-Droid's public repository index is merged into Home, Apps, and Search; Gothwad listings win when the same package is present in both sources. F-Droid metadata is cached in memory for six hours.
- F-Droid APKs download directly from F-Droid through the existing foreground download/install flow; they are not proxied, hosted, or counted by Gothwad. A compact “From F-Droid” attribution is shown on list and detail screens.
- Debounced server-side search, canceling superseded requests.
- App details, screenshots, real ratings/reviews, developer replies, release notes, permissions and minimum-Android compatibility checks.
- APK downloads run in a foreground service with a notification, resume
support, publisher checksum verification and four installer back-ends
(PackageInstaller session, APK intent, Shizuku/Sui and root
pm install). Installation is user-driven, not silent. - Explicit loading, empty, unavailable and retry states. No demo fallback.
- Gothwad Accounts sign-in (OAuth 2.0 Authorization Code + PKCE) is wired to the real Accounts service, so the wishlist, the account library and reviews are stored in the Worker.
Legacy demo screen files remain for design reference but are not reachable from
MainActivity → MainStoreScreen.
The launcher icon is the Icon Kitchen set: an adaptive icon
(ic_launcher.xml + ic_launcher_background/foreground/monochrome) for
Android 8+, plus the legacy PNGs for every density. The Play Store listing
icon lives in docs/play_store_512.png.
Use Android Studio with JDK 17, Android SDK 36.1, and the included Gradle 9.3.1 wrapper. Android 7.0 / API 24 is the minimum device version.
./gradlew testDebugUnitTest lintDebug assembleDebug
# APK: app/build/outputs/apk/debug/app-debug.apkDefault API: https://kiwistore.gothwadtech.com/api/. For an HTTPS staging Worker:
./gradlew assembleDebug -PSTORE_API_BASE_URL=https://your-staging-host/api/The URL must include the trailing slash. Do not put tokens/keys in this URL.
Cleartext HTTP is disabled. Android's default debug key is generated locally;
no missing repository-local debug.keystore is required anymore. Release
signing retains the existing KEYSTORE_PATH, STORE_PASSWORD, KEY_PASSWORD
configuration and upload key alias. Do not commit signing keys.
Exactly like GothwadTech/browser and GothwadTech/launcher:
| Trigger | What happens |
|---|---|
Every push to main |
Tests + lint run, the Release APK, Debug APK and Play Store AAB are built, signed, checksummed and published as a GitHub Release (v1.0.<n>). |
v* tag push |
The same build, published under the tag. |
| Manual run | Same pipeline with an optional version name/code. |
The release assets are KiwiStore-v<version>-Release.apk,
KiwiStore-v<version>-Debug.apk and KiwiStore-v<version>-PlayStore.aab,
plus SIGNING.txt and SHA256SUMS.txt. The version code is derived from the
run number and is always raised above the last published release, so a new
build can update the previous one instead of failing with a version downgrade.
Signing uses the repository secrets RELEASE_KEYSTORE_BASE64,
KEYSTORE_PASSWORD, KEY_PASSWORD and KEY_ALIAS. When no permanent key is
configured, CI signs with a throwaway key and says so in SIGNING.txt and in
the release notes - a temporary-key build cannot be updated by a later
permanent-key build, so it has to be uninstalled first.
See docs/BUILD_AND_RELEASE.md for the full signing, versioning and troubleshooting details. See docs/ANDROID_INTEGRATION.md for the audited backend contract, device checks and next steps.
- install
KiwiStore-v1.0.15-Release.apkon a device (Android 7.0+). - Signed with the permanent release key, so it updates an earlier Kiwi Store installation instead of asking for a second copy.
The GitHub Actions runs are the verification for this repository - the sandbox that authors the code has no Java/Android SDK, so compile, test, lint, signing and signature checks happen in CI. Open the Actions tab for the newest run, or pull the latest release.
Device installation and the full native account feature parity are still not verified end to end.