F-Droid reproducible build failed

[linsui]

https://gitlab.com/fdroid/fdroiddata/-/jobs/9383066809 The apk was built from fe4b0d4adc72c6e49cd5e5c0191395b17d4e6f86. Could you please rebuild it from the tag? See https://f-droid.org/docs/Reproducible_Builds/#vcs-info. Thanks!

[IzzySoft]

@linsui How was that with replacing what has already been distributed? Not to do, right? 😉 A new tag would do (aka "maintenance release"). For the current one, just add to your recipe:

reproducible-apk-tools/inplace-fix.py --internal --zipalign fix-files "$OUT" 'sed s/26163924fb78bf9a87ec6f1c6a2b4f5af36653ba/fe4b0d4adc72c6e49cd5e5c0191395b17d4e6f86/' 'META-INF/version-control-info.textproto'

[linsui]

Ah, I didn't know that this is in your repo. I'll wait for a proper fix. :)

[IzzySoft]

But while I'm here:

SigningBlock blobs:
-------------------
0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

@DeweyReed please add to your build.gradle:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains. More details can be found e.g. here: Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.

[IzzySoft]

Ah, I didn't know that this is in your repo.

Just returning today, so you couldn't know. Was just added to staging (so goes live with the next sync). I just ran into the very same issue when establishing RB at IoD, which is how I found yours here 😉

As pointed out, that one-liner would fix it for you as well (and your recipe already has repro-apk as srclib, for the newline fixes). The sed would only affect this release, as the next one will have a different hash – but yeah, I get why you prefer to wait, ackack 😜

[DeweyReed]

Thank you for telling me! I'll fix the problem and create a new release.

The commit fe4b0d4adc72c6e49cd5e5c0191395b17d4e6f86 doesn't even exist in this repo. Quite weird.🤔

[IzzySoft]

The commit fe4b0d4adc72c6e49cd5e5c0191395b17d4e6f86 doesn't even exist in this repo. Quite weird.🤔

I guess something like "code => commit => build => squash => tag"? Did you build from a branch that was later merged before you tagged the commit? Or built from a local branch that was never pushed? That's usually how this happens.

[DeweyReed]

@IzzySoft Although I can't remember what happened, you're probably right. Anyway, this issue teaches me how to build appropriately.😄

[IzzySoft]

If you want some more "interesting details", be welcome to take a look at our hints on reproducible builds 😉

[DeweyReed]

@IzzySoft I'm glad to know how complicated RB is. I'll find some time in the future to build the APK with CI to solve these kinds of issues for good.

I've created a new release that fixes the issues above.

[licaon-kter]

thanks, confirmed

[linsui]

Thanks!

[IzzySoft]

Confirming the BLOB being gone. Our scanners here at IzzyOnDroid just complained about:

! repo/io.github.deweyreed.timer.other_7060100.apk declares sensitive permission(s):
  android.permission.READ_EXTERNAL_STORAGE android.permission.READ_MEDIA_AUDIO
  android.permission.READ_PHONE_STATE android.permission.SYSTEM_ALERT_WINDOW

With minimum supported Android version of 6 I'm not sure why you need the legacy READ/WRITE storage permissions (you're using Storage Access Framework, don't you?). READ_MEDIA_AUDIO is clear (to pick music for reminders), so I've added that to the green list already. Leaves READ_PHONE_STATE and SYSTEM_ALERT_WINDOW, could you please clarify them, @DeweyReed?

Oh: And RB confirmed on our end, too. Btw, be welcome to add the IoD badge back to your Readme (you can pick one here) 😉

[DeweyReed]

@IzzySoft I'm glad that the problem is fixed!

SAF doesn't support music picking, so READ_EXTERNAL_STORAGE is the backward-compatible permission for READ_MEDIA_AUDIO. The app uses READ_PHONE_STATE to pause timers during phone calls since recent Android releases and SYSTEM_ALERT_WINDOW to show floating timer windows.

There's some usage for permissions in Manifest.xml.