Reproducible Builds about notepad HOT 6 OPEN

@mshdabiola any word?

from notepad.

Hello 👋

Yes it was build with the latest tag

from notepad.

Where are your having problems

from notepad.

Yes it was build with the latest tag

At a clean tree, exactly from that commit, no reuse of artifacts from prior builds (as e.g. Android Studio does it if you do not run "clean project" first)?

Where are your having problems

With the diff :) As long as there's a diff, the two APKs are not identical. I've linked to the details from the initial comment here. Only if those APKs are identical one can be sure the shipped APK corresponds exactly to the code it says to correspond to – which confirms nothing was added, altered or removed.

from notepad.

If I get your point right, the APK you reproduce is different from mine?

It will be different because I used my signing key to sign my own apk

from notepad.

If I get your point right, the APK you reproduce is different from mine?

Yupp.

It will be different because I used my signing key to sign my own apk

(sigh) have you meanwhile taken a look at behind those links? And at the diff above? Nope, signing is not part of this. Actually, to put it into easy terms, your signing is transferred to my APK at the end of the process – because if the rest would be identical, after adding the same signing my APK should verify. That's how RB works.

So if the Dex has huge differences, that has nothing at all to do with signing, but rather with building. Reasons could be:

• built from different commits
• one build is from a "dirty tree" (artifacts from previous builds being reused, and things like that)
• different configuration. I've built with ./gradlew assembleRelease at the commandline; how did you build? I've asked that before already, but maybe with Android Studio, but not having run clean project before triggering the build? And did you maybe use different parameters? I see a lot of stuff in your build workflow. Is some of that required before running assembleRelease – or don't you even run assembleRelease but something else?

Here's basically what I do:

// remove the call to the signingConfig as we need an UNSIGNED APK:
sed -r '/signingConfigs.getByName/d' -i app/build.gradle.kts
// build the APK
./gradlew assembleRelease

from notepad.