NativeScript / NativeScript/android
buildMetaData task doesn't generate reproducible binaries
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 563
- Forks
- 144
- Avg merge
- 10h 46m
- Merged PRs (30d)
- 14
Description
Environment
Provide version numbers for the following components (information can be retrieved by running tns info in your project folder or by inspecting the package.json of the project):
- CLI: 9.0.1
- Cross-platform modules:
- Android Runtime: 8.9.2 and 9.0.0
- iOS Runtime (if applicable): -
- Plugin(s): -
Describe the bug
buildMetaData task generates metadata binaries that are not deterministic and reproducible, Even with the same --compileSdk version set and exact Java, SDK, etc.. So, security checks will fail specially in opensource app stores like IzzyOnDroid and F-Droid.
The issue might be related to using methods like listFiles() without performing a sort on files or maybe different locale properties, I'm just guessing from my researches.
I've attached a diffoscope result to see the difference.
To Reproduce
- Generate an APK locally
- Generate the same APK using a docker/podman container or Github actions
- diff the results using any tool like diffoscope
Expected behavior
The metadata binaries should be exactly same for a specific compileSdk without considering which environment its running the buildMetaData task.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the buildMetaData task in the Android runtime and reproduce the APK generation locally and in a Docker, Podman, or GitHub Actions environment. Compare the outputs with diffoscope; done means metadata binaries are byte-for-byte identical for the same compileSdk regardless of the environment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android
- Domain
- build-system, mobile-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100