Skip to content

Fix APK reproducibility for F-Droid #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andre487 merged 1 commit into from
Sep 9, 2026
Merged

Fix APK reproducibility for F-Droid #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions app/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,8 @@ android {
applicationId = "life.andre.message487"
minSdk = 26
targetSdk = 36
versionCode = 3
versionName = "0.0.3"
versionCode = 4
versionName = "0.0.4"
buildConfigField("String", "GIT_COMMIT_HASH", "\"$gitCommitHash\"")
}
signingConfigs {
Expand Down Expand Up @@ -83,6 +83,10 @@ kotlin {
compilerOptions { jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17) }
}

tasks.configureEach {
if (name.contains("ArtProfile")) enabled = false
}

dependencies {
implementation(platform("androidx.compose:compose-bom:2025.01.01"))
implementation("androidx.activity:activity-compose:1.10.0")
Expand Down
5 changes: 5 additions & 0 deletions docs/en/releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,3 +92,8 @@ use JDK 21, and compare against the versioned GitHub release APK with the expect
signing certificate. Keep dependency metadata disabled for both APKs and bundles.
A successful GitHub build alone does not establish reproducibility: the F-Droid
build and binary comparison must pass before marking that verification complete.

Android baseline/startup profile tasks are disabled because AGP generated different
profile contents for identical DEX code in GitHub and F-Droid builds. Android still
optimizes the app through its normal runtime profiling; initial launches do not get
the bundled profile optimization. See the [F-Droid reproducibility guidance](https://f-droid.org/docs/Reproducible_Builds/#bug-baselineprof-not-deterministic).
5 changes: 5 additions & 0 deletions docs/ru/releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,3 +94,8 @@ Play не настроены. Архив нативных символов из
с проверкой ожидаемого сертификата подписи. Метаданные зависимостей должны оставаться
выключенными для APK и App Bundle. Успешной GitHub-сборки недостаточно для заявления
о воспроизводимости: должны пройти сборка F-Droid и сравнение бинарных файлов.

Генерация baseline/startup-профилей Android отключена: AGP создавал разное
содержимое профилей при одинаковом DEX-коде в сборках GitHub и F-Droid. Android
по-прежнему оптимизирует приложение по мере использования; первые запуски
не получают оптимизацию из встроенного профиля. См. [рекомендации F-Droid](https://f-droid.org/docs/Reproducible_Builds/#bug-baselineprof-not-deterministic).
1 change: 1 addition & 0 deletions fastlane/metadata/android/en-US/changelogs/4.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Make release APKs reproducible by disabling nondeterministic Android baseline profiles. App version, commit hash and privacy policy link remain available in the interface.
1 change: 1 addition & 0 deletions fastlane/metadata/android/ru-RU/changelogs/4.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Обеспечена воспроизводимость APK: отключены недетерминированные профили оптимизации Android. Версия, хеш коммита и ссылка на политику конфиденциальности доступны в интерфейсе.
Loading