Unavailable releases/branches for reproducible builds

We are happy to answer your questions about the code or discuss technical ideas.

Please complete the following checklist (by adding [x]):

• I have searched open and closed issues for duplicates
• This isn't a feature request
• This is not a report about my app not working as expected

Related issues: #251, #129, #75

Hello,

After some trial and error, I used to successfully build proton-mail and proton-accounts web clients where the resulting files match the one in production on https://mail.proton.me and https://account.proton.me. I especially rely on the /assets/version.json files to retrieve build parameters and git info, however it doesn't work anymore.

At the time of writing, proton-accounts version.json is:

{
  "version": "5.0.63.0",
  "commit": "b3c54c5672aeaa370ca63eee18e920ee9ffcbe19",
  "branch": "proton-account@5.0.63.0",
  "date": "Thu, 26 Oct 2023 21:57:40 GMT",
  "mode": "sso"
}

However, there are:

• no release proton-account@5.0.63.0
• no commit b3c54c5672aeaa370ca63eee18e920ee9ffcbe19
• no branch proton-account@5.0.63.0

I encounter the same issue for proton-mail@5.0.30.8. In consequence, I fail at making Proton WebClients build reproducibly now.

Is there any reason why the public source code lags behind production releases? Issue #129 is related and marked as completed, but @vladimiry suggestions are still relevant IMHO.

For the context, I developed a (private) extension similar to Meta Code Verify for Proton, however it's useless without reproducible builds.

Thanks!

Start with the production assets/version.json examples for proton-accounts and proton-mail, then compare their commits, branches, and releases with the WebClients repository and related issues #251, #129, and #75. Determine how public sources should track production; done means the referenced source history is available and the documented build can reproduce the production files.