Android release_0.77.6 tarball does not reproduce from documented GitLab CI recipe
- Dominant language
- C++
- Stars
- 202
- Forks
- 73
- PR merge metrics
- No merged PRs in 30d
Description
Hi Blockstream team,
Following the suggestion from green_android issue [#297](https://github.com/Blockstream/green_android/issues/297), I tested the Android GDK release build directly in the GDK repo.
I am trying to reproduce the Android native library shipped in:
https://github.com/Blockstream/gdk/releases/download/release_0.77.6/gdk-release_0.77.6.tar.gz
Official tarball SHA256:
`e86f164b77e690472f4cbdaf552d76ca847db885ced4502a49b5b0dfc96c9b8c`
I used the public GitLab CI recipe from release_0.77.6.
**Source:**
release_0.77.6
fa2e267c511cc336aabc3350da56edfd4fa9b9a3
**Image:**
docker.io/blockstream/gdk-android-builder@sha256:e08f5a77cc5472c9539cd0a83ee376efffab02eff4e768eae2c16c243f587f1e
**Command:**
```
./tools/build.sh --ndk arm64-v8a --buildtype release --no-deps-rebuild --external-deps-dir /prebuild/android-arm64-v8a --parallel 16 --install gdk-android-jni
```
I ran this twice in fresh clones.
Both local builds produced the same result:
`b60ce8002dd7bb37d22809993a1e8a3a229a575f5e9c253b1a671fb84013bdf3` lib/arm64-v8a/libgreen_gdk_java.so
The official release tarball contains:
`13d4ba62e75bebc4f8a9a50e2770a20def0469b1c470d321baadcadd407f07e7` lib/arm64-v8a/libgreen_gdk_java.so
The files have the same size:
26521752 bytes
But they differ substantially:
cmp -l local official | wc -l
6188322
Build IDs also differ:
local: 4507fd08da6325fe9af180846ecc571ffb4d2638
official: 50217d48b9f66acb2ab9e448b047e1a0fa3c8edd
So the public recipe appears deterministic locally, but it does not reproduce the official release_0.77.6 Android GDK artifact.
## Question:
Was the official gdk-release_0.77.6.tar.gz built with this exact image digest and command?
If not, could you share the exact CI image/input that produced the published tarball?
This matters for Blockstream Green Android reproducibility because the app-layer build now reproduces, and the remaining blocking difference is `libgreen_gdk_java.so`.
This came from the Blockstream Green Android 5.5.1 WalletScrutiny verification:
https://walletscrutiny.com/mobile/com.greenaddress.greenbits_android_wallet/#verificationId=f61e6f43e7d4907fa94f3aa933f06ee7005e2e688435ec62d783550ed3dd34d3
For context, the F-Droid variant of Blockstream Green 5.5.1 is reproducible in our verification.
https://walletscrutiny.com/mobile/com.greenaddress.greenbits_android_wallet/#verificationId=18ea3b9ad35aec8dcebed8ed4dfe0463825219393895813bd6c3d8973ac03319
That build path compiles GDK from source and matches the official F-Droid APK.
So the issue appears specific to reproducing the prebuilt Android GDK release artifact used by the Play Store build, not to the Green Android application code in general.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.