F-Droid reproducible build failed

[linsui]

Prerequisites

Describe the bug

https://gitlab.com/linsui/fdroiddata/-/jobs/7224096941 1.1.13 reproducible build failed. The content of the apk is identical but the zip metadata is different. I checked 1.1.11 again and I can still rebuild the apk.

To Reproduce

Screenshots and Logs

out.txt

Please complete the following information:

• Device:
• OS:
• Obtainium Version:

Additional context

[ImranR98]

Hmm. Do you have any ideas? I haven't changed anything that should affect this afaik.

[linsui]

I have no idea. Can you try rebuilding 1.1.11 and check if the apk is identical to the old one?

[ImranR98]

app-arm64-v8a-release.zip

[ImranR98]

Looks like the file hashes are not identical. I built this through GitHub actions so something might be different there.

[ImranR98]

Do you know what zip metadata is different? I'm assuming the APK signature is okay since Android did not complain when the app was updated.

[linsui]

This is the diff between your new build and old build of 1.1.11. diff.txt

The out.txt above is the diff between your build of 1.1.13 and our build.

[ImranR98]

Lol, I have no idea how to interpret these.

[licaon-kter]

That's how these look like when hitting aligning issues, iirc.

@linsui, none of the 4, 16, 64 values helped?

[linsui]

I didn't try. We shouldn't need to run zipalign again unless we modify the apk.

[licaon-kter]

Who is we? We are not modifying anything on purpose, we try to keep up with the "ever evolving" tooling that changes that, right?

[linsui]

Yes. It seems something in GHA or macOS or something else suddenly changed.

[licaon-kter]

tried 4 (not need as it's already 4), 16 and 64 with zipalign from Debian, but not helpful :crying_cat_face:

[ldeso]

The fact that the hash is different on every build may be explained by the Dependency Info Block, an encrypted proprietary blob from Google that is added to APK and AAB files by default and that is not reproducible. This causes the APK signature block to be different on every build even though the signature certificate remains the same.

You could try to remove this blob by adding the following to the file build.gradle:

android {
    // …

    dependenciesInfo {
        includeInApk false
        includeInBundle false
    }
}

[licaon-kter]

worth a try

[linsui]

The signature is not same.

[linsui]

Can you try signing the apk with apksigner from build-tools 34 or older?