From 2aa6920fb1568249d2466fa1b13760d1a51c0e8f Mon Sep 17 00:00:00 2001 From: Lena Date: Wed, 1 Jul 2026 00:00:00 +0000 Subject: ci: pin toolchains and verify release artifacts Checksum-pin every downloaded toolchain archive. Before publishing, verify the APK was built from HEAD, the tag matches versionName, apksigner passes, and the tree is clean; publish a sha256 sidecar and treat published assets as immutable. Compare full unsigned APKs in verify-repro and run the Android unit tests in CI. --- metadata/reproducible-builds.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'metadata') diff --git a/metadata/reproducible-builds.md b/metadata/reproducible-builds.md index 91b34f6..6885aa7 100644 --- a/metadata/reproducible-builds.md +++ b/metadata/reproducible-builds.md @@ -5,11 +5,11 @@ How rsend stays reproducible and what F-Droid needs to build it. Pinning ------- -Every tool and source version lives in ./versions: the rsync source and its -sha256, the Go version, the JDK release, the Android NDK, SDK platform, -build-tools, Gradle, the Android Gradle Plugin, and Kotlin. The build never -floats a version. The gradle files and go.mod repeat some pins because gradle -cannot source a shell file; ci/test.sh fails if they drift from ./versions. +Every tool and source version lives in ./versions: the rsync source, Go, JDK, +Android NDK, SDK platform, build-tools, command-line tools, Gradle, the Android +Gradle Plugin, and Kotlin. Directly downloaded archives have repository-owned +checksums. The gradle files and go.mod repeat some pins because gradle cannot +source a shell file; ci/test.sh fails if they drift from ./versions. Determinism @@ -22,7 +22,8 @@ Determinism - APK: no code shrinking (minifyEnabled false), the Google dependency-metadata block is dropped (dependenciesInfo off), and native libs use legacy packaging. -Verify locally by building twice and diffing the native libs: +Verify locally by building the complete unsigned APK twice and comparing it +byte for byte: make verify-repro -- cgit v1.2.3