GingerCal 1.1: apksigner v1 signing so Android 2.3 installs it; add Pangolin VPS setup notes

README.md

@@ -106,19 +106,28 @@ you should turn `proxy_ssl_verify` on.
 
 Menu key: Sync, New event, Calendars, Settings. Tap an event for details, Edit and Delete.
 
+If installation fails, check the file arrived whole (53 KB; some browsers save a truncated or
+renamed `.apk.zip`) and that there are a few MB free on the internal storage. On a PC with
+`adb`, `adb install GingerCal.apk` prints the exact reason (`INSTALL_FAILED_...`).
+
 ## Building
 
-Needs JDK 11+, Python 3 with Pillow, and `d8` (Android SDK build-tools). No Gradle, no aapt:
-`tools/mkapk.py` writes the binary manifest and resource table itself.
+Needs JDK 11+, Python 3 with Pillow, `d8` and `apksigner.jar` (Android SDK build-tools), and
+`apktool.jar` (2.9+, which bundles Google's `aapt` and smali). No Gradle.
 
 ```sh
-./build.sh                                   # uses ./stubs to compile
-ANDROID_JAR=$SDK/platforms/android-10/android.jar ./build.sh   # or the real platform jar
+D8=d8 APKTOOL=~/apktool.jar APKSIGNER=$SDK/build-tools/34.0.0/lib/apksigner.jar ./build.sh
+# add ANDROID_JAR=$SDK/platforms/android-10/android.jar to compile against the real platform
 ```
 
-`gingercal.keystore` (password `android`) is the key the supplied APK was signed with; keep
-building with it so updates install over the existing app. A different key means uninstalling
-first. Signing uses SHA-1 because Android before 4.3 rejects anything else.
+Pipeline: javac → d8 → baksmali/smali (clean dex 035) → `aapt` v1 for manifest and resources →
+`apksigner` v1 signature → zipalign. The script ends by running `apksigner verify` for API 8–10
+and checking the dex header, and fails rather than produce an APK that 2.3 would reject.
+
+Don't sign with `jarsigner`: modern versions add PKCS#7 signed attributes, which Android only
+accepts from 4.4, so the phone refuses to install it. That was the bug in the first build.
+`gingercal.keystore` (password `android`) is the signing key; keep using it so updates install
+over the existing app.
 
 Tests (desktop JVM, need a CalDAV server such as Radicale on :5232 with user `xose`/`secret`):
 
@@ -137,7 +146,8 @@ declarations.
 - `android/` activities, sync service, alarms, SQLite cache, Apache HttpClient transport
 - `stubs/` compile-only Android API 10 signatures (never packaged)
 - `bridge/` nginx legacy-TLS bridge: config, compose file, certificate script
-- `tools/` APK packer, icon, zipalign, d8 workaround, API checker
+- `res/` app name; the icon is drawn at build time (mdpi + ldpi for the Galaxy Mini)
+- `tools/` icon, dex disassembler helper, zipalign, dex/API checkers, d8 workaround
 
 ## Security notes