getAlby / getAlby/go

[Build] Reproducible build differences between EAS cloud and local Docker environment

Open
#350 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
57
Forks
21
Avg merge
2h 9m
Merged PRs (30d)
1

Description

## Summary

We've been working on reproducible build verification for Alby Go v1.14.1 as part of WalletScrutiny.com's process, and discovered some interesting differences between EAS cloud builds and local Docker reproduction attempts. Hoping to get your insights on the expected behavior.

## Build Environment

**Local Setup:**
- Docker container: Ubuntu 22.04, Node.js 22.x, Java 17, Android SDK API 34
- Build method: `npx expo prebuild` → `./gradlew bundleRelease`
- Source: GitHub tag `v1.14.1` (commit 34316fb)

## Key Differences Found

### Assets & Resources
- **Missing fonts**: Official APK includes 4 `.otf` font files in `res/raw/`, local build
doesn't
- **Missing navigation icons**: 4 React Navigation PNG assets missing in local build
- **JavaScript bundling**: Official has `index.android.bundle`, local uses runtime bundling

### Build Structure
- **DEX files**: Official has 9 DEX files, local build generates 21
- **Native libraries**: Different binary output for all `.so` files (expected)
- **APK sizes**: Notable difference in armeabi_v7a component (16MB official vs 34MB local)

### Configuration
- **Firebase config**: Had to use placeholder, official uses EAS secrets path
- **Sentry integration**: Had to exclude upload tasks due to authentication

## Questions

1. **Font embedding**: Should fonts be automatically embedded during the build, or is this an
EAS-specific optimization?

2. **Asset processing**: Are the missing navigation icons typically handled by EAS asset
pipeline vs local builds?

3. **DEX optimization**: Is the different DEX file count expected when building locally vs EAS
cloud?

4. **Recommended approach**: What would be the best way to achieve a local build that more
closely matches the EAS cloud output?

## Context

This is for WalletScrutiny.com reproducible build verification. The app's NWC architecture and
security model look solid - just trying to understand the build environment differences for
documentation purposes.

Thanks for any insights! Happy to provide more details or testing if helpful.

## Build Logs
[WalletScrutiny.com verification for Alby Go Mobile (android)](https://walletscrutiny.com/android/com.getalby.mobile/#verificationId=44ffac7b16dfe43db028b2a3332d4b31888fb089abb6b29fabcfca3deb8c7e89)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.