diff options
| author | Lena <lena@omega> | 2026-07-01 00:00:00 +0000 |
|---|---|---|
| committer | Lena <lena@omega> | 2026-07-13 22:00:29 +0000 |
| commit | 2aa6920fb1568249d2466fa1b13760d1a51c0e8f (patch) | |
| tree | 5cd196d2017228cac43f2574d559d9a59b123a47 /metadata/reproducible-builds.md | |
| parent | 2593151ca2c67256442ad25b074504e3ecd3371f (diff) | |
| download | rsend-2aa6920fb1568249d2466fa1b13760d1a51c0e8f.tar.gz | |
ci: pin toolchains and verify release artifacts
Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.
Diffstat (limited to 'metadata/reproducible-builds.md')
| -rw-r--r-- | metadata/reproducible-builds.md | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/metadata/reproducible-builds.md b/metadata/reproducible-builds.md index 91b34f6..6885aa7 100644 --- a/metadata/reproducible-builds.md +++ b/metadata/reproducible-builds.md @@ -5,11 +5,11 @@ How rsend stays reproducible and what F-Droid needs to build it. Pinning ------- -Every tool and source version lives in ./versions: the rsync source and its -sha256, the Go version, the JDK release, the Android NDK, SDK platform, -build-tools, Gradle, the Android Gradle Plugin, and Kotlin. The build never -floats a version. The gradle files and go.mod repeat some pins because gradle -cannot source a shell file; ci/test.sh fails if they drift from ./versions. +Every tool and source version lives in ./versions: the rsync source, Go, JDK, +Android NDK, SDK platform, build-tools, command-line tools, Gradle, the Android +Gradle Plugin, and Kotlin. Directly downloaded archives have repository-owned +checksums. The gradle files and go.mod repeat some pins because gradle cannot +source a shell file; ci/test.sh fails if they drift from ./versions. Determinism @@ -22,7 +22,8 @@ Determinism - APK: no code shrinking (minifyEnabled false), the Google dependency-metadata block is dropped (dependenciesInfo off), and native libs use legacy packaging. -Verify locally by building twice and diffing the native libs: +Verify locally by building the complete unsigned APK twice and comparing it +byte for byte: make verify-repro |