NeOMakinG
commented
3 months ago Hey @xrviv, sounds very interesting, I'll try to figure if we can build the project using gradle without any diffs
Open xrviv opened 3 months ago
NeOMakinG
commented
3 months ago Hey @xrviv, sounds very interesting, I'll try to figure if we can build the project using gradle without any diffs
xrviv
commented
3 months ago Hey @xrviv, sounds very interesting, I'll try to figure if we can build the project using gradle without any diffs
That would be awesome!
Thank you for the response.
xrviv
commented
3 months ago Please feel free to point out if I have some mistakes :)
Successful build with this Dockerfile
# Use Node.js 18 as the base image
FROM node:18
# Install necessary tools
RUN apt-get update && apt-get install -y \
openjdk-17-jdk \
build-essential \
wget \
unzip \
git \
&& rm -rf /var/lib/apt/lists/*
# Set environment variables for Android SDK
ENV ANDROID_HOME /usr/lib/android-sdk
ENV PATH ${PATH}:${ANDROID_HOME}/cmdline-tools/latest/bin:${ANDROID_HOME}/platform-tools
# Install Android command-line tools
RUN mkdir -p ${ANDROID_HOME}/cmdline-tools && \
cd ${ANDROID_HOME}/cmdline-tools && \
wget https://dl.google.com/android/repository/commandlinetools-linux-6858069_latest.zip -O tools.zip && \
unzip tools.zip -d ${ANDROID_HOME}/cmdline-tools && \
mv ${ANDROID_HOME}/cmdline-tools/cmdline-tools ${ANDROID_HOME}/cmdline-tools/latest && \
rm tools.zip
# Install SDK packages
RUN yes | sdkmanager --sdk_root=${ANDROID_HOME} \
"platforms;android-30" \
"build-tools;30.0.3" \
"platform-tools"
# Set working directory
WORKDIR /app
# Clone the repository
RUN git clone https://github.com/shapeshift/mobile-app.git .
# Checkout the specific commit
RUN git checkout 5836f656f240ce1494a2c9625365c18ae3d47bec
# Copy the .env.template to .env
RUN cp .env.template .env
# Install project dependencies
RUN yarn install
# Build the Android app
RUN cd android && ./gradlew assembleRelease
# The APK will be located at /app/android/app/build/outputs/apk/release/app-release.apk
# Set the default command
CMD ["bash"]> Task :react-native-webview:lintVitalAnalyzeRelease
> Task :expo-modules-core:lintVitalAnalyzeRelease
> Task :app:lintVitalReportRelease
> Task :app:lintVitalRelease
> Task :app:assembleRelease
BUILD SUCCESSFUL in 7m 54s
771 actionable tasks: 771 executed
Removing intermediate container 1d64e21f16b4
---> c9642207a53e
Step 13/13 : CMD ["bash"]
---> Running in 4535edcf21a4
Removing intermediate container 4535edcf21a4
---> e2306091089f
Successfully built e2306091089f
Successfully tagged shapeshift-build:latesthttps://asciinema.org/a/671137
Yay!
I will run a diff tomorrow :)
xrviv
commented
3 months ago The diffs:
After a successful build, we document the steps we've undertaken and publish an interim merge request. During the initial stages of our analysis, we try to reach out to the developers and inform them of our methodology and the resulting diffs. Differences in build variables, environment or some other cause, may result in a huge diff.
If developer outreach is successful, we can collaborate with the goal in making the build reproducible.
NeOMakinG
commented
3 months ago Nice!
How is the diff from your eyes? As @0xean was the release manager, he might have the build artifact to push in the github releases.
If you have a list of strange things you would like us to improve/change, feel free to share it and we'll make sure to add it in our kanban
Are you only performing a test on Android or can you also run a new test on the iOS part? Because it looks like the actual rating of the Apple app is wrong because the source file is up, you can still build the app, so we might pass more tests than the old app!
xrviv
commented
3 months ago How is the diff from your eyes? As @0xean was the release manager, he might have the build artifact to push in the github releases.
That would be helpful. The diff is quite big and extensive. But I also noticed that Shapeshift uses AABs and split apks. Can I verify this?
If you have a list of strange things you would like us to improve/change, feel free to share it and we'll make sure to add it in our kanban
It would be helpful if there is a Dockerfile from you officially. On our end, there is a lot of intuiting what goes to where and what. :)
We do not currently verify iOS apps, so, all iOS apps are currently nonverifiable on our end. @Giszmo would best explain the justification, but quick thought: Apple does something.
This is a big help and we appreciate it!
NeOMakinG
commented
3 months ago How is the diff from your eyes? As @0xean was the release manager, he might have the build artifact to push in the github releases.
That would be helpful. The diff is quite big and extensive. But I also noticed that Shapeshift uses AABs and split apks. Can I verify this?
Let's wait then, I see no blockers adding it if the build hasn't been deleted
If you have a list of strange things you would like us to improve/change, feel free to share it and we'll make sure to add it in our kanban
It would be helpful if there is a Dockerfile from you officially. On our end, there is a lot of intuiting what goes to where and what. :)
We are not using Docker to build the app, the workflow is quite old, we are currently manually building the app but we might be able to ease the workflow in the future, unfortunately we are pretty stuck with it for now regarding other priorities :(
Also, regarding the current release cycle, I'm not sure this is something we want to invest some time on considering the fact that we are not releasing very often, as you can see in the source code, this app act as a webview entrypoint meaning that the final content is the ShapeShift website even though we have a smallish local wallet handler
We do not currently verify iOS apps, so, all iOS apps are currently nonverifiable on our end. @Giszmo would best explain the justification, but quick thought: Apple does something.
This is a big help and we appreciate it!
Ok, thanks!
Hello again team Shapeshift.
Danny from Walletscrutiny.com. We verify android apps for reproducibility.
I'm currently trying to build your app using docker in a CLI environment. The README.txt build instructions mentions using Android Studio.
But it would be preferable if I were to build using the terminal. In this way, after the build, we can run a diff or diffoscope on the apks produced and the official apk from Google Play.
We'd appreciate your help on this.