search

nunchuk-io / nunchuk-android

Security and convenience. Get both with Nunchuk Bitcoin wallet.
https://nunchuk.io
GNU General Public License v3.0
45 stars 2 forks source link

The app is not reproducible #23

Open mohammadrafigh opened 1 year ago

mohammadrafigh commented 1 year ago

I tried to reproduce v1.9.32 with the following steps:

apt update
DEBIAN_FRONTEND=noninteractive apt install -y openjdk-11-jdk
cd /mnt
printf '\nstoreFile=nunchuk.pfx\nstorePassword=nunchuk_alias\nkeyPassword=nunchuk_alias\nkeyAlias=nunchuk_alias' > keystore.properties
keytool -genkey -alias nunchuk_alias -keystore nunchuk-app/nunchuk.pfx -storetype PKCS12 -keyalg RSA -keysize 4096 -storepass nunchuk_alias -keypass nunchuk_alias -validity 10000 -dname CN=IL
sed -i 's/io.nunchuk.android:nativesdk:\${nativeSdkVersion}/com.github.nunchuk-io:nunchuk-android-nativesdk-prebuild:1.1.61@aar/g' configs/dependencies.gradle
./gradlew assembleRelease

Now getting a diff between the built apk and the downloaded apk:

unzip -d /tmp/fromPlay_io.nunchuk.android_207 -qq /home/ws/1.9.32.apk
unzip -d /tmp/fromBuild_io.nunchuk.android_207 -qq /mnt/nunchuk-app/build/outputs/apk/production/release/nunchuk-app-production-release.apk
diff --brief --recursive /tmp/fromPlay_io.nunchuk.android_207 /tmp/fromBuild_io.nunchuk.android_207

Here are the results:

Files /tmp/fromPlay_io.nunchuk.android_207/AndroidManifest.xml and /tmp/fromBuild_io.nunchuk.android_207/AndroidManifest.xml differ
Files /tmp/fromPlay_io.nunchuk.android_207/assets/dexopt/baseline.prof and /tmp/fromBuild_io.nunchuk.android_207/assets/dexopt/baseline.prof differ
Files /tmp/fromPlay_io.nunchuk.android_207/assets/dexopt/baseline.profm and /tmp/fromBuild_io.nunchuk.android_207/assets/dexopt/baseline.profm differ
Files /tmp/fromPlay_io.nunchuk.android_207/classes2.dex and /tmp/fromBuild_io.nunchuk.android_207/classes2.dex differ
Files /tmp/fromPlay_io.nunchuk.android_207/classes3.dex and /tmp/fromBuild_io.nunchuk.android_207/classes3.dex differ
Files /tmp/fromPlay_io.nunchuk.android_207/classes4.dex and /tmp/fromBuild_io.nunchuk.android_207/classes4.dex differ
Files /tmp/fromPlay_io.nunchuk.android_207/classes5.dex and /tmp/fromBuild_io.nunchuk.android_207/classes5.dex differ
Files /tmp/fromPlay_io.nunchuk.android_207/classes.dex and /tmp/fromBuild_io.nunchuk.android_207/classes.dex differ
Only in /tmp/fromBuild_io.nunchuk.android_207/res: 03.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: 06.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: 06.xml
...
Only in /tmp/fromBuild_io.nunchuk.android_207/res: Al.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: Am.xml
Only in /tmp/fromPlay_io.nunchuk.android_207/res: anim
Only in /tmp/fromPlay_io.nunchuk.android_207/res: animator
Only in /tmp/fromPlay_io.nunchuk.android_207/res: animator-v21
Only in /tmp/fromPlay_io.nunchuk.android_207/res: anim-v21
Only in /tmp/fromBuild_io.nunchuk.android_207/res: an.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: aN.xml
...
Only in /tmp/fromBuild_io.nunchuk.android_207/res: dp.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: dP.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: DP.xml
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-anydpi-v21
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-anydpi-v24
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-hdpi-v4
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-ldpi-v4
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-ldrtl-hdpi-v17
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-ldrtl-mdpi-v17
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-ldrtl-xhdpi-v17
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-ldrtl-xxhdpi-v17
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-ldrtl-xxxhdpi-v17
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-mdpi-v4
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-v21
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-v23
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-watch-v20
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-xhdpi-v4
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-xxhdpi-v4
Only in /tmp/fromPlay_io.nunchuk.android_207/res: drawable-xxxhdpi-v4
Only in /tmp/fromBuild_io.nunchuk.android_207/res: DR.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: Ds.png
...
Only in /tmp/fromBuild_io.nunchuk.android_207/res: Fl.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: FM.9.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: fn.xml
Only in /tmp/fromPlay_io.nunchuk.android_207/res: font
Only in /tmp/fromBuild_io.nunchuk.android_207/res: FP.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: fr.9.png
...
Only in /tmp/fromBuild_io.nunchuk.android_207/res: Im.ttf
Only in /tmp/fromBuild_io.nunchuk.android_207/res: In.9.png
Only in /tmp/fromPlay_io.nunchuk.android_207/res: interpolator
Only in /tmp/fromPlay_io.nunchuk.android_207/res: interpolator-v21
Only in /tmp/fromBuild_io.nunchuk.android_207/res: io.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: -i.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: ir.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: IS.png
...
Only in /tmp/fromBuild_io.nunchuk.android_207/res: L5.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: L9.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: l9.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: lA.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: LA.xml
Only in /tmp/fromPlay_io.nunchuk.android_207/res: layout
Only in /tmp/fromPlay_io.nunchuk.android_207/res: layout-land
Only in /tmp/fromPlay_io.nunchuk.android_207/res: layout-ldrtl-v17
Only in /tmp/fromPlay_io.nunchuk.android_207/res: layout-sw600dp-v13
Only in /tmp/fromPlay_io.nunchuk.android_207/res: layout-v21
Only in /tmp/fromPlay_io.nunchuk.android_207/res: layout-v23
Only in /tmp/fromPlay_io.nunchuk.android_207/res: layout-v26
Only in /tmp/fromPlay_io.nunchuk.android_207/res: layout-watch-v20
Only in /tmp/fromBuild_io.nunchuk.android_207/res: lb.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: lB.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: lb.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: lc.xml
...
Only in /tmp/fromBuild_io.nunchuk.android_207/res: MA.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: MC.xml
Only in /tmp/fromPlay_io.nunchuk.android_207/res: menu
Only in /tmp/fromBuild_io.nunchuk.android_207/res: ME.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: Mg.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: MH.xml
Only in /tmp/fromPlay_io.nunchuk.android_207/res: mipmap-anydpi-v26
Only in /tmp/fromPlay_io.nunchuk.android_207/res: mipmap-hdpi-v4
Only in /tmp/fromPlay_io.nunchuk.android_207/res: mipmap-mdpi-v4
Only in /tmp/fromPlay_io.nunchuk.android_207/res: mipmap-xhdpi-v4
Only in /tmp/fromPlay_io.nunchuk.android_207/res: mipmap-xxhdpi-v4
Only in /tmp/fromPlay_io.nunchuk.android_207/res: mipmap-xxxhdpi-v4
Only in /tmp/fromBuild_io.nunchuk.android_207/res: MK.xml
...
Only in /tmp/fromBuild_io.nunchuk.android_207/res: nA.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: nA.ttf
Only in /tmp/fromPlay_io.nunchuk.android_207/res: navigation
Only in /tmp/fromBuild_io.nunchuk.android_207/res: NA.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: nC.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: nc.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: NC.xml
...
Only in /tmp/fromBuild_io.nunchuk.android_207/res: xc.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: xd.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: xH.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: xJ.png
Only in /tmp/fromBuild_io.nunchuk.android_207/res: --.xml
Only in /tmp/fromPlay_io.nunchuk.android_207/res: xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: XM.xml
Only in /tmp/fromBuild_io.nunchuk.android_207/res: XN.xml
...
Files /tmp/fromPlay_io.nunchuk.android_207/resources.arsc and /tmp/fromBuild_io.nunchuk.android_207/resources.arsc differ
Only in /tmp/fromPlay_io.nunchuk.android_207: stamp-cert-sha256

Note: The diff is truncated because it's too lengthy for Github.

Giszmo commented 2 months ago

Apparently there's news regarding this: https://github.com/nunchuk-io/nunchuk-android/commit/72373c3531f49bdf085fb0cbb3b10ba10884e85b

We will give it another try.

keraliss commented 1 month ago

hey, keraliss from walletscrutiny. i tested v1.9.51, and found diffs in the apks. First of all, the build instructions were super helpful. we were able to generate the split apks following the info. we also extracted split apks from our adb-connected device, and ran the apkdiff.py

got this result - 

keraliss@keraliss:~/projects/walletScrutiny_build/nunchuck/neww/reproducible-builds$ ./apkdiff.py ../apks/built-apks/splits/base-master.apk ../apks/device-apks/base.apk
APK file classes.dex does not match
APKs are different!
keraliss@keraliss:~/projects/walletScrutiny_build/nunchuck/neww/reproducible-builds$ ./apkdiff.py ../apks/built-apks/splits/base-arm64_v8a.apk ../apks/device-apks/split_config.arm64_v8a.apk
APKs are the same!
keraliss@keraliss:~/projects/walletScrutiny_build/nunchuck/neww/reproducible-builds$ ./apkdiff.py ../apks/built-apks/splits/base-xxhdpi.apk ../apks/device-apks/split_config.xxhdpi.apk
file res/drawable-ldrtl-xxhdpi-v17/abc_spinner_mtrl_am_alpha.9.png not found in second APK
APKs are different!

we also compared all the apks one to one, and got this - 

keraliss@keraliss:~/projects/walletScrutiny_build/nunchuck/neww/apks$ diff --recursive device-apks/base built-apks/splits/base-master
Binary files device-apks/base/AndroidManifest.xml and built-apks/splits/base-master/AndroidManifest.xml differ
Binary files device-apks/base/assets/dexopt/baseline.prof and built-apks/splits/base-master/assets/dexopt/baseline.prof differ
Binary files device-apks/base/classes2.dex and built-apks/splits/base-master/classes2.dex differ
Binary files device-apks/base/classes3.dex and built-apks/splits/base-master/classes3.dex differ
Binary files device-apks/base/classes4.dex and built-apks/splits/base-master/classes4.dex differ
Binary files device-apks/base/classes5.dex and built-apks/splits/base-master/classes5.dex differ
Binary files device-apks/base/classes6.dex and built-apks/splits/base-master/classes6.dex differ
Binary files device-apks/base/classes.dex and built-apks/splits/base-master/classes.dex differ
Binary files device-apks/base/res/xml/splits0.xml and built-apks/splits/base-master/res/xml/splits0.xml differ
Binary files device-apks/base/resources.arsc and built-apks/splits/base-master/resources.arsc differ
Only in device-apks/base: stamp-cert-sha256
keraliss@keraliss:~/projects/walletScrutiny_build/nunchuck/neww/apks$ diff --recursive device-apks/split_config.arm64_v8a built-apks/splits/base-arm64_v8a
Binary files device-apks/split_config.arm64_v8a/AndroidManifest.xml and built-apks/splits/base-arm64_v8a/AndroidManifest.xml differ
Only in device-apks/split_config.arm64_v8a: META-INF
Only in device-apks/split_config.arm64_v8a: stamp-cert-sha256
keraliss@keraliss:~/projects/walletScrutiny_build/nunchuck/neww/apks$ diff --recursive device-apks/split_config.en built-apks/splits/base-en
Binary files device-apks/split_config.en/AndroidManifest.xml and built-apks/splits/base-en/AndroidManifest.xml differ
Only in device-apks/split_config.en: META-INF
Binary files device-apks/split_config.en/resources.arsc and built-apks/splits/base-en/resources.arsc differ
Only in device-apks/split_config.en: stamp-cert-sha256
keraliss@keraliss:~/projects/walletScrutiny_build/nunchuck/neww/apks$ diff --recursive device-apks/split_config.xxhdpi built-apks/splits/base-xxhdpi
Binary files device-apks/split_config.xxhdpi/AndroidManifest.xml and built-apks/splits/base-xxhdpi/AndroidManifest.xml differ
Only in device-apks/split_config.xxhdpi: META-INF
Only in device-apks/split_config.xxhdpi/res: drawable-hdpi-v4
Only in device-apks/split_config.xxhdpi/res: drawable-ldrtl-hdpi-v17
Only in built-apks/splits/base-xxhdpi/res: drawable-ldrtl-xxhdpi-v17
Only in built-apks/splits/base-xxhdpi/res: drawable-xhdpi-v4
Only in built-apks/splits/base-xxhdpi/res: drawable-xxhdpi-v4
Binary files device-apks/split_config.xxhdpi/resources.arsc and built-apks/splits/base-xxhdpi/resources.arsc differ
Only in device-apks/split_config.xxhdpi: stamp-cert-sha256

you can check my full review -here

giahuy98 commented 1 month ago

Hey @keraliss, First, thanks for the tests. Regarding the result, could you send your .aab and .apk files here? Does your device have Nunchuk 1.9.51 installed from the Play Store or the GitHub release page?