NativeScript / NativeScript/android
buildMetaData task doesn't generate reproducible binaries
还没有人认领这个 Issue。
- 主要语言
- C++
- 星标
- 563
- 派生
- 144
- 平均合并
- 10 小时 46 分钟
- 30 天内合并 PR
- 14
描述
Environment
Provide version numbers for the following components (information can be retrieved by running tns info in your project folder or by inspecting the package.json of the project):
- CLI: 9.0.1
- Cross-platform modules:
- Android Runtime: 8.9.2 and 9.0.0
- iOS Runtime (if applicable): -
- Plugin(s): -
Describe the bug
buildMetaData task generates metadata binaries that are not deterministic and reproducible, Even with the same --compileSdk version set and exact Java, SDK, etc.. So, security checks will fail specially in opensource app stores like IzzyOnDroid and F-Droid.
The issue might be related to using methods like listFiles() without performing a sort on files or maybe different locale properties, I'm just guessing from my researches.
I've attached a diffoscope result to see the difference.
To Reproduce
- Generate an APK locally
- Generate the same APK using a docker/podman container or Github actions
- diff the results using any tool like diffoscope
Expected behavior
The metadata binaries should be exactly same for a specific compileSdk without considering which environment its running the buildMetaData task.
贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
调研方向
首先定位 Android runtime 中的 buildMetaData 任务,并在本地以及 Docker、Podman 或 GitHub Actions 环境中复现 APK 生成过程。使用 diffoscope 比较输出;对于相同的 compileSdk,无论环境如何,元数据二进制文件都逐字节完全一致即表示完成。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- android
- 领域
- build-system, mobile-dev
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 45/100