Reproducible Builds

[IzzySoft]

Inclusion with IzzyOnDroid was requested here, and I'm just adding the app now. However, there are some open questions.

For one, why does the app require INTERNET? Just to load the GIF from Github? Is that really necessary? Asking because that causes the NonFreeNet anti-feature.

Next, I've tried to establish it as Reproducible Build (see: Reproducible Builds, special client support and more in our repo), but while I was able to successfully generate the APK using ./gradlew assembleRelease, the APK files were not identical. Was that APK really built from a clean tree at the commit the tag points to? If so, did I miss some build options? And if not, which commit was it?

Here's the APK diff:

-------------------------------
--- /dev/fd/63  2024-08-12 19:31:33.624832449 +0200
+++ /dev/fd/62  2024-08-12 19:31:33.624832449 +0200
@@ -3,11 +3,11 @@
   META-INF/version-control-info.textproto
   32-bit CRC value (hex):                         22383ae8
   assets/dexopt/baseline.prof
-  32-bit CRC value (hex):                         5454cff7
+  32-bit CRC value (hex):                         57d6dfbb
   assets/dexopt/baseline.profm
   32-bit CRC value (hex):                         688b5d12
   classes.dex
-  32-bit CRC value (hex):                         2be92cb8
+  32-bit CRC value (hex):                         be3ac998
   assets/monet_dark.attheme
   32-bit CRC value (hex):                         24e74c91
   assets/monet_light.attheme
@@ -17,9 +17,9 @@
   assets/monet_x_light.tgx-theme
   32-bit CRC value (hex):                         95453d11
   META-INF/services/a2.u
-  32-bit CRC value (hex):                         71dab404
+  32-bit CRC value (hex):                         fa3f68cb
   META-INF/services/b2.a
-  32-bit CRC value (hex):                         739c0a5d
+  32-bit CRC value (hex):                         d1123b08
   AndroidManifest.xml
   32-bit CRC value (hex):                         4a2d0398
   res/2K.9.png

And here the diff of the Dex:

--- /tmp/tmp.hH0ebiJgQ7 2024-08-12 19:32:15.768551332 +0200
+++ /tmp/tmp.XOYbrACavE 2024-08-12 19:32:15.908550400 +0200
@@ -1,10 +1,10 @@
-Processing '/tmp/tmp.M5n0fbZKEu'...
-Opened '/tmp/tmp.M5n0fbZKEu', DEX version '039'
+Processing '/tmp/tmp.OEdcl5lOTh'...
+Opened '/tmp/tmp.OEdcl5lOTh', DEX version '039'
 DEX file header:
 magic               : 'dex\n039\0'
-checksum            : 0f849aec
-signature           : 5e5a...f363
-file_size           : 1877556
+checksum            : 0367b546
+signature           : 47fa...ccf4
+file_size           : 1877560
 header_size         : 112
 link_size           : 0
 link_off            : 0 (0x000000)
@@ -20,7 +20,7 @@
 method_ids_off      : 161524 (0x0276f4)
 class_defs_size     : 2497
 class_defs_off      : 263796 (0x040674)
-data_size           : 1533856
+data_size           : 1533860
 data_off            : 343700 (0x053e94)

 access_flags        : 1025 (0x0401)
@@ -89288,7 +89288,7 @@
       registers     : 144
       ins           : 4
       outs          : 66
-      insns size    : 869 16-bit code units
+      insns size    : 871 16-bit code units
 | F1.c.a:(ZZLD/p;I)V
 |: move-object/from16 v0, v142
 |: move/from16 v1, v143
@@ -89320,7 +89320,7 @@
 |: invoke-virtual/range {v142}, LD/p;.M:()V
 |: move/from16 v2, v140
 |: move/from16 v1, v141
-|: goto/16 0355 // +031b
+|: goto/16 0357 // +031d
 |: invoke-virtual/range {v142}, LD/p;.O:()V
 |: and-int/lit8 v2, v1, #int 1 // #01
 |: if-eqz v2, 0055 // +0014
@@ -89692,12 +89692,13 @@
 |: sget-object v1, LF1/d;.a:LB/U0;
 |: shl-int/lit8 v3, v3, #int 3 // #03
 |: and-int/lit16 v3, v3, #int 7168 // #1c00
+|: or-int/lit16 v3, v3, #int 384 // #0180
 |: const/4 v4, #int 0 // #0
 |: invoke-static {v6, v4, v1, v0, v3}, LB/P;.e:(LB/H;LB/z0;LB/U0;LD/p;I)V
 |: move/from16 v1, v140
 |: invoke-virtual/range {v142}, LD/p;.t:()LD/s0;
 |: move-result-object v0
-|: if-eqz v0, 0364 // +000b
+|: if-eqz v0, 0366 // +000b
 |: new-instance v3, LF1/b;
 |: move/from16 v4, v143
 |: invoke-direct {v3, v4, v2, v1}, LF1/b;.<init>:(IZZ)V

We'd appreciate if you could help making your build reproducible. We've prepared some hints on reproducible builds for that.

Looking forward to your reply!

[mi-g-alex]

The internet is only for gif downloads.

Is it important? This is a few megabytes of the size of apk, as there were a lot of questions about how to use application.

I do not know why there is a difference in size. If you want, compare the dex files and you will see that there (if I remember correctly) there will be no difference.

And I didn't add last GitHub changes to app (PR #73 and #72) that's why U see difference

[IzzySoft]

Is it important?

Well, that's the question, right? Is the GIF important enough to justify an otherwise not needed INTERNET permission? Or could it simply be linked to, so who wants to see it can open it in a browser?

Speaking of anti-features: the TG clients your app can theme, do they include FOSS ones, or only proprietary clients?

I do not know why there is a difference in size. If you want, compare the dex files and you will see that there (if I remember correctly) there will be no difference.

The diff says otherwise. And as long as there's a difference, the APK files are not identical – and thus it's no Reproducible Build (just follow the link to the first paragraph, titled "why does it matter").

that's why U see difference

That might be – but a difference means, no RB. And the green RB shield is an indicator that the APK was indeed built from the very commit the tag points to – without anything added or removed.

[shuvashish76]

as there were a lot of questions about how to use application.

Is it possible to show how to use the app using https://github.com/AppIntro/AppIntro library ? if not IMO simply adding link for GitHub wiki is better solution.