Reproducible Builds

[IzzySoft]

Inclusion with IzzyOnDroid was requested here, and I'm just adding the app now. However, there are some open questions.

For one, why does the app require INTERNET? Just to load the GIF from Github? Is that really necessary? Asking because that causes the NonFreeNet anti-feature.

Next, I've tried to establish it as Reproducible Build (see: Reproducible Builds, special client support and more in our repo), but while I was able to successfully generate the APK using ./gradlew assembleRelease, the APK files were not identical. Was that APK really built from a clean tree at the commit the tag points to? If so, did I miss some build options? And if not, which commit was it?

Here's the APK diff:

-------------------------------
--- /dev/fd/63  2024-08-12 19:31:33.624832449 +0200
+++ /dev/fd/62  2024-08-12 19:31:33.624832449 +0200
@@ -3,11 +3,11 @@
   META-INF/version-control-info.textproto
   32-bit CRC value (hex):                         22383ae8
   assets/dexopt/baseline.prof
-  32-bit CRC value (hex):                         5454cff7
+  32-bit CRC value (hex):                         57d6dfbb
   assets/dexopt/baseline.profm
   32-bit CRC value (hex):                         688b5d12
   classes.dex
-  32-bit CRC value (hex):                         2be92cb8
+  32-bit CRC value (hex):                         be3ac998
   assets/monet_dark.attheme
   32-bit CRC value (hex):                         24e74c91
   assets/monet_light.attheme
@@ -17,9 +17,9 @@
   assets/monet_x_light.tgx-theme
   32-bit CRC value (hex):                         95453d11
   META-INF/services/a2.u
-  32-bit CRC value (hex):                         71dab404
+  32-bit CRC value (hex):                         fa3f68cb
   META-INF/services/b2.a
-  32-bit CRC value (hex):                         739c0a5d
+  32-bit CRC value (hex):                         d1123b08
   AndroidManifest.xml
   32-bit CRC value (hex):                         4a2d0398
   res/2K.9.png

And here the diff of the Dex:

--- /tmp/tmp.hH0ebiJgQ7 2024-08-12 19:32:15.768551332 +0200
+++ /tmp/tmp.XOYbrACavE 2024-08-12 19:32:15.908550400 +0200
@@ -1,10 +1,10 @@
-Processing '/tmp/tmp.M5n0fbZKEu'...
-Opened '/tmp/tmp.M5n0fbZKEu', DEX version '039'
+Processing '/tmp/tmp.OEdcl5lOTh'...
+Opened '/tmp/tmp.OEdcl5lOTh', DEX version '039'
 DEX file header:
 magic               : 'dex\n039\0'
-checksum            : 0f849aec
-signature           : 5e5a...f363
-file_size           : 1877556
+checksum            : 0367b546
+signature           : 47fa...ccf4
+file_size           : 1877560
 header_size         : 112
 link_size           : 0
 link_off            : 0 (0x000000)
@@ -20,7 +20,7 @@
 method_ids_off      : 161524 (0x0276f4)
 class_defs_size     : 2497
 class_defs_off      : 263796 (0x040674)
-data_size           : 1533856
+data_size           : 1533860
 data_off            : 343700 (0x053e94)

 access_flags        : 1025 (0x0401)
@@ -89288,7 +89288,7 @@
       registers     : 144
       ins           : 4
       outs          : 66
-      insns size    : 869 16-bit code units
+      insns size    : 871 16-bit code units
 | F1.c.a:(ZZLD/p;I)V
 |: move-object/from16 v0, v142
 |: move/from16 v1, v143
@@ -89320,7 +89320,7 @@
 |: invoke-virtual/range {v142}, LD/p;.M:()V
 |: move/from16 v2, v140
 |: move/from16 v1, v141
-|: goto/16 0355 // +031b
+|: goto/16 0357 // +031d
 |: invoke-virtual/range {v142}, LD/p;.O:()V
 |: and-int/lit8 v2, v1, #int 1 // #01
 |: if-eqz v2, 0055 // +0014
@@ -89692,12 +89692,13 @@
 |: sget-object v1, LF1/d;.a:LB/U0;
 |: shl-int/lit8 v3, v3, #int 3 // #03
 |: and-int/lit16 v3, v3, #int 7168 // #1c00
+|: or-int/lit16 v3, v3, #int 384 // #0180
 |: const/4 v4, #int 0 // #0
 |: invoke-static {v6, v4, v1, v0, v3}, LB/P;.e:(LB/H;LB/z0;LB/U0;LD/p;I)V
 |: move/from16 v1, v140
 |: invoke-virtual/range {v142}, LD/p;.t:()LD/s0;
 |: move-result-object v0
-|: if-eqz v0, 0364 // +000b
+|: if-eqz v0, 0366 // +000b
 |: new-instance v3, LF1/b;
 |: move/from16 v4, v143
 |: invoke-direct {v3, v4, v2, v1}, LF1/b;.<init>:(IZZ)V

We'd appreciate if you could help making your build reproducible. We've prepared some hints on reproducible builds for that.

Looking forward to your reply!