diff options
Diffstat (limited to 'metadata')
| -rw-r--r-- | metadata/reproducible-builds.md | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/metadata/reproducible-builds.md b/metadata/reproducible-builds.md index 91b34f6..6885aa7 100644 --- a/metadata/reproducible-builds.md +++ b/metadata/reproducible-builds.md @@ -5,11 +5,11 @@ How rsend stays reproducible and what F-Droid needs to build it. Pinning ------- -Every tool and source version lives in ./versions: the rsync source and its -sha256, the Go version, the JDK release, the Android NDK, SDK platform, -build-tools, Gradle, the Android Gradle Plugin, and Kotlin. The build never -floats a version. The gradle files and go.mod repeat some pins because gradle -cannot source a shell file; ci/test.sh fails if they drift from ./versions. +Every tool and source version lives in ./versions: the rsync source, Go, JDK, +Android NDK, SDK platform, build-tools, command-line tools, Gradle, the Android +Gradle Plugin, and Kotlin. Directly downloaded archives have repository-owned +checksums. The gradle files and go.mod repeat some pins because gradle cannot +source a shell file; ci/test.sh fails if they drift from ./versions. Determinism @@ -22,7 +22,8 @@ Determinism - APK: no code shrinking (minifyEnabled false), the Google dependency-metadata block is dropped (dependenciesInfo off), and native libs use legacy packaging. -Verify locally by building twice and diffing the native libs: +Verify locally by building the complete unsigned APK twice and comparing it +byte for byte: make verify-repro |