emanuelb
commented
3 years ago it's INCORRECT to compare apk generated from ./gradlew assembleRelease to apk downloaded from google-play if appbundle is used, in such case a apk generated with bundletool from the aab file generated by ./gradlew bundleRelease need to be done.
steps are (all commands to run in the Containerfile I written in: https://gitlab.com/walletscrutiny/walletScrutinyCom/-/issues/208):
-
download bundletool latest release (currently it's 1.6.0):
cd /home/appuser/app/sdk/; \ wget https://github.com/google/bundletool/releases/download/1.6.0/bundletool-all-1.6.0.jar; \ echo "fdabaa9137dd9d346a3571d010ee4404a4bae3f1641ebe2236ed4b74ee73bf6f bundletool-all-1.6.0.jar" | sha256sum -c; -
Build universal apk (this is done to compare against published apks which built this way, some providers do for apk uploaded to github, which is aked in issue #8)
cd /home/appuser/app/bitcoinorg; \ java -jar /home/appuser/app/sdk/bundletool-all-1.6.0.jar build-apks --bundle=/home/appuser/app/bitcoinorg/BitcoinWalletMobile/android/app/build/outputs/bundle/release/app-release.aab --mode=universal --output=/home/appuser/app/bitcoinorg/bitcoinorg-universal.apks; \ unzip /home/appuser/app/bitcoinorg/bitcoinorg-universal.apksThe universal apk will be located at:
/home/appuser/app/bitcoinorg/universal.apk -
Build matched apk to compare against apk downloaded from google-play
cd /home/appuser/app/bitcoinorg; java -jar /home/appuser/app/sdk/bundletool-all-1.6.0.jar build-apks --bundle=/home/appuser/app/bitcoinorg/BitcoinWalletMobile/android/app/build/outputs/bundle/release/app-release.aab --output=/home/appuser/app/bitcoinorg/bitcoinorg-all.apks; \Which will generate
bitcoinorg-all.apksfile, using it in below commandbundletool extract-apkswith matched--device-specargument to the device used to download apk from google-play is needed.
For example, Create file /home/appuser/app/sdk/pixel2.json with content:
{
"supportedAbis": ["arm64-v8a", "armeabi-v7a", "armeabi"],
"supportedLocales": ["en-US"],
"screenDensity": 560,
"sdkVersion": 30
}Then run:
java -jar /home/appuser/app/sdk/bundletool-all-1.6.0.jar extract-apks --apks=/home/appuser/app/bitcoinorg/bitcoinorg-all.apks --output-dir=/home/appuser/app/bitcoinorg/bitcoinorg-pixel2-apks --device-spec=/home/appuser/app/sdk/pixel2.jsonwhich will generate apks in directory /home/appuser/app/bitcoinorg/bitcoinorg-pixel2-apks that should be compared to what downloaded from google-play.
This are the steps to create apk that is matched to what downloaded from google-play when appbundles are used, unfortunately while writing this the google-play url return "We're sorry, the requested URL was not found on this server.", opened issue about it in: #9
if you have apk downloaded from google-play, create the apk from appbundle as described above (The json file need to match the spec used to download app from google-play) and publish the results.
Cobra-Bitcoin
Giszmo
I tried to reproduce the app I got from Google Play to make sure it matches the published source code but failed. My findings will be public on WalletScrutiny. The short version of the analysis is:
After running
The diff with what I get from Google Play is huge:
The diff ignoring what was only in my build and not in the Google version and the META-INF lines is still huge, with
index.android.bundlebeing obfuscated (minified) code.