From b511ab4dc0e3b40e66afa51c43f0cadc1caff148 Mon Sep 17 00:00:00 2001
From: Joe Julian <me@joejulian.name>
Date: Sun, 19 Apr 2026 20:27:14 -0700
Subject: [PATCH] Fix CI APK JDK selection

---
 APK.md    | 16 ++++++++--------
 Makefile  |  6 +++---
 README.md |  9 +++++----
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/APK.md b/APK.md
index af93d30..bad3187 100644
--- a/APK.md
+++ b/APK.md
@@ -12,10 +12,10 @@ Build the release-signed APK with:
 make apk-release
 ```
 
-`make apk` uses a local Java 25 install when `JAVA_HOME` points to one.
-If the host does not have a working Java 25 install, it falls back to the
-repo-managed Docker image in `packaging/docker/android-apk/`, which also builds
-with Java 25.
+`make apk` uses a supported local JDK when `JAVA_HOME` points to Java 21
+or Java 25. If the host does not have one of those working JDKs, it falls back
+to the repo-managed Docker image in `packaging/docker/android-apk/`, which
+builds with Java 25.
 
 `make apk` remains a developer build path and may use Gio's default debug or
 ephemeral signing behavior if no explicit signing key is provided.
@@ -26,7 +26,7 @@ Environment:
 
 - `ANDROID_SDK_ROOT` defaults to `/opt/android-sdk`.
 - `ANDROID_NDK_ROOT` defaults to `/opt/android-ndk`.
-- `JAVA_HOME` defaults to `/usr/lib/jvm/java-25-openjdk`.
+- `JAVA_HOME` defaults to `/usr/lib/jvm/java-25-openjdk`. Local builds support Java 25 and CI builds support Java 21.
 - `APK_BUILD_IMAGE` overrides the Docker image name used by `make apk-container`.
 - `APP_ID` overrides the Android application id.
 - `APP_VERSION` overrides the version shown inside KeePassGO itself.
@@ -49,7 +49,7 @@ Installed machine prerequisites expected by this repo:
 - `android-sdk-build-tools`
 - `android-platform-35`
 - `android-sdk-platform-tools`
-- a working Java 25 JDK install for `make apk-local`, or Docker for `make apk`
+- a working Java 21 or Java 25 JDK install for `make apk-local`, or Docker for `make apk`
 
 The repo tracks `gogio` as a Go tool, and the local build runs through:
 
@@ -67,8 +67,8 @@ The Android build uses the branded icon asset at:
 
 Note:
 
-- KeePassGO's documented Android build uses Java 25 locally.
-- If that host setup is unavailable, `make apk` falls back to the Docker image
+- KeePassGO's documented Android build uses Java 25 locally, while CI uses Java 21.
+- If neither supported host setup is available, `make apk` falls back to the Docker image
   so the build still runs under Java 25 instead of encoding a newer host JDK as
   a requirement.
 - Android runtime testing on the `KeepassGoAPI35` emulator showed a black-screen
diff --git a/Makefile b/Makefile
index eba6520..ba4ff32 100644
--- a/Makefile
+++ b/Makefile
@@ -46,10 +46,10 @@ endif
 
 .PHONY: apk apk-local apk-release apk-container apk-container-image archlinux-pkgbuild browser-bridge browser-extension-validate
 apk:
-	@if [ -x "$(JAVA_HOME)/bin/java" ] && "$(JAVA_HOME)/bin/java" -version 2>&1 | grep -q 'version "25'; then \
+	@if [ -x "$(JAVA_HOME)/bin/java" ] && "$(JAVA_HOME)/bin/java" -version 2>&1 | grep -Eq 'version "(21|25)([."]|$$)'; then \
 		$(MAKE) apk-local JAVA_HOME="$(JAVA_HOME)"; \
 	else \
-		echo "Using Dockerized Java 25 Android build because JAVA_HOME is not a working Java 25 install."; \
+		echo "Using Dockerized Java 25 Android build because JAVA_HOME is not a supported local JDK (21 or 25)."; \
 		$(MAKE) apk-container; \
 	fi
 
@@ -86,7 +86,7 @@ apk-local: android/keepassgo-android.jar
 apk-release:
 	@test -f "$(RELEASE_SIGNKEY)" || { echo "Release signing key not found at $(RELEASE_SIGNKEY)"; exit 1; }
 	@test -f "$(RELEASE_SIGNPASS_FILE)" || { echo "Release signing password file not found at $(RELEASE_SIGNPASS_FILE)"; exit 1; }
-	@$(MAKE) apk SIGNKEY="$(abspath $(RELEASE_SIGNKEY))" SIGNPASS_FILE="$(abspath $(RELEASE_SIGNPASS_FILE))"
+	@$(MAKE) apk SIGNKEY="$(abspath $(RELEASE_SIGNKEY))" SIGNPASS_FILE="$(abspath $(RELEASE_SIGNPASS_FILE))" JAVA_HOME="$(JAVA_HOME)"
 
 apk-container: apk-container-image
 	@command -v docker >/dev/null 2>&1 || { echo "docker is required for apk-container"; exit 1; }
diff --git a/README.md b/README.md
index fb720d3..0f2b00e 100644
--- a/README.md
+++ b/README.md
@@ -93,10 +93,11 @@ Package:
 make apk
 ```
 
-`make apk` prefers a local Java 25 install at `JAVA_HOME`. If that is not
-available, it falls back to the repo-managed Docker build image, which also
-uses Java 25. You still need the Android SDK and NDK installed and configured
-for real device or release packaging.
+`make apk` prefers a supported local JDK at `JAVA_HOME`. Java 25 is the
+local default, and Java 21 is also supported for CI builds. If neither is
+available, it falls back to the repo-managed Docker build image, which uses
+Java 25. You still need the Android SDK and NDK installed and configured for
+real device or release packaging.
 
 Release package: