MohGovIL / hamagen-react-native

Israel's Ministry of Health's COVID-19 Exposure Prevention App
https://health.gov.il/
MIT License
509 stars 153 forks source link

Add apkdiff.py file to compare built apk against various releases apks #239

Open emanuelb opened 4 years ago

emanuelb commented 4 years ago

Apk files contain signature information in them, thus building them with different sigs will result in different files, for reproducible-builds and comparing local builds apk against release apks (google-play / fdroid / etc..) a script is needed to avoid the signature in diffing the files.

apkdiff.py is used in multiple projects as way to check the self-build version of the app against the distributed version of the app (after it's reproducible-built) below list of apkdiff.py examples (look like it's mostly developed by Signal/Telegram and others are copying it from them): https://github.com/DrKLO/Telegram/blob/master/apkdiff.py https://github.com/signalapp/Signal-Android/blob/master/apkdiff/apkdiff.py https://github.com/secure-sign/securesign-android/blob/master/apkdiff/apkdiff.py https://github.com/mycelium-com/wallet-android/blob/master/apkdiff.py

The script which will be added to the repo need to ignore only the changes which are assumed to be there not more (aka avoid only the used signing version [v1,v2,v3,v4] diff, not all of them, etc..)