Blockstream / Blockstream/gdk

Android release_0.77.6 tarball does not reproduce from documented GitLab CI recipe

Open
#225 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
202
Forks
73
PR merge metrics
No merged PRs in 30d

Description

Hi Blockstream team,

Following the suggestion from green_android issue [#297](https://github.com/Blockstream/green_android/issues/297), I tested the Android GDK release build directly in the GDK repo.

I am trying to reproduce the Android native library shipped in:

https://github.com/Blockstream/gdk/releases/download/release_0.77.6/gdk-release_0.77.6.tar.gz

Official tarball SHA256:

`e86f164b77e690472f4cbdaf552d76ca847db885ced4502a49b5b0dfc96c9b8c`

I used the public GitLab CI recipe from release_0.77.6.

**Source:**

release_0.77.6
fa2e267c511cc336aabc3350da56edfd4fa9b9a3

**Image:**

docker.io/blockstream/gdk-android-builder@sha256:e08f5a77cc5472c9539cd0a83ee376efffab02eff4e768eae2c16c243f587f1e

**Command:**

```
./tools/build.sh --ndk arm64-v8a --buildtype release --no-deps-rebuild --external-deps-dir /prebuild/android-arm64-v8a --parallel 16 --install gdk-android-jni
```

I ran this twice in fresh clones.

Both local builds produced the same result:

`b60ce8002dd7bb37d22809993a1e8a3a229a575f5e9c253b1a671fb84013bdf3` lib/arm64-v8a/libgreen_gdk_java.so

The official release tarball contains:

`13d4ba62e75bebc4f8a9a50e2770a20def0469b1c470d321baadcadd407f07e7` lib/arm64-v8a/libgreen_gdk_java.so

The files have the same size:

26521752 bytes

But they differ substantially:

cmp -l local official | wc -l
6188322

Build IDs also differ:

local: 4507fd08da6325fe9af180846ecc571ffb4d2638
official: 50217d48b9f66acb2ab9e448b047e1a0fa3c8edd

So the public recipe appears deterministic locally, but it does not reproduce the official release_0.77.6 Android GDK artifact.

## Question:

Was the official gdk-release_0.77.6.tar.gz built with this exact image digest and command?

If not, could you share the exact CI image/input that produced the published tarball?

This matters for Blockstream Green Android reproducibility because the app-layer build now reproduces, and the remaining blocking difference is `libgreen_gdk_java.so`.

This came from the Blockstream Green Android 5.5.1 WalletScrutiny verification:

https://walletscrutiny.com/mobile/com.greenaddress.greenbits_android_wallet/#verificationId=f61e6f43e7d4907fa94f3aa933f06ee7005e2e688435ec62d783550ed3dd34d3

For context, the F-Droid variant of Blockstream Green 5.5.1 is reproducible in our verification.

https://walletscrutiny.com/mobile/com.greenaddress.greenbits_android_wallet/#verificationId=18ea3b9ad35aec8dcebed8ed4dfe0463825219393895813bd6c3d8973ac03319

That build path compiles GDK from source and matches the official F-Droid APK.

So the issue appears specific to reproducing the prebuilt Android GDK release artifact used by the Play Store build, not to the Green Android application code in general.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.