Bitcoin.org: What is missing for Mycelium to be considered deterministically buildable?

[Giszmo]

As the release manager at Mycelium I am surprised to see Mycelium to be marked as not deterministically buildable. What is the criteria for that? We rely heavily on build verification internally and wouldn't release an apk without having built it on a second engineer's machine and we also advertise the verifiability on our github.

Some builds had issues. A library was compiling non-deterministically in a way we had to compile up to 10 times to get the same result but that should be resolved.

How strict is this criteria?

[crwatkins]

As the release manager at Mycelium I am surprised to see Mycelium to be marked as not deterministically buildable.

@Giszmo Thanks for letting us know. There have been no updates submitted for Mycelium in four years.

What is the criteria for that?

The wallet should be able to be accurately described by the checkgoodtransparencydeterministictxt description which is

This wallet is open-source and built deterministically. This means any developer in the world can audit the code and make sure the final software isn't hiding any secrets.

I would recommend opening a PR (or request here that a PR be opened) to change the Mycelium listing to

  transparency: "checkgoodtransparencydeterministic"

It would be great if you could include a third party reference to a successful verification or request in the PR that someone verify it.

[Giszmo]

If it was last checked 4 years ago, the classification makes sense but it also calls in question the value of even looking at this if the wallets that are marked as verifiable are also only checked every 4 years.

I started a project around the issue and my assessment on Mycelium can be found here but being Mycelium's release manager, I'm hardly an independent source and as stated in the linked article, the verification did not go as smooth as it should.

I will provide a PR soon.

[schildbach]

I'll try to verify Mycelium.

[schildbach]

I just successfully manually verified the version tagged v3.2.0.11 by following the project's deterministic builds instructions:

--- mbw-prodnet-release.apk
+++ /tmp/mycelium-from-phone.apk
├── zipinfo /dev/stdin
│ @@ -1,11 +1,11 @@
│ -Zip file size: 15269734 bytes, number of entries: 1785
│ +Zip file size: 15269940 bytes, number of entries: 1785
│  -rw----     0.0 fat    36212 b- defN 80-000-00 00:00 AndroidManifest.xml
│  -rw----     2.4 fat    11376 b- defN 80-000-00 00:00 LICENSE-junit.txt
│ --rw----     2.4 fat     1214 b- defN 80-000-00 00:00 META-INF/CERT.RSA
│ +-rw----     2.4 fat     1283 b- defN 80-000-00 00:00 META-INF/CERT.RSA
│  -rw----     2.4 fat   209991 b- defN 80-000-00 00:00 META-INF/CERT.SF
│  -rw----     2.4 fat   209929 b- defN 80-000-00 00:00 META-INF/MANIFEST.MF
│  -rw----     2.4 fat        6 bx stor 80-000-00 00:00 META-INF/androidx.activity_activity.version
│  -rw----     2.4 fat        6 bx stor 80-000-00 00:00 META-INF/androidx.appcompat_appcompat-resources.version
│  -rw----     2.4 fat        6 bx stor 80-000-00 00:00 META-INF/androidx.appcompat_appcompat.version
│  -rw----     2.4 fat        6 b- stor 80-000-00 00:00 META-INF/androidx.arch.core_core-runtime.version
│  -rw----     2.4 fat        6 bx stor 80-000-00 00:00 META-INF/androidx.asynclayoutinflater_asynclayoutinflater.version
│ @@ -1780,8 +1780,8 @@
│  -rw----     0.0 fat     6704 b- defN 80-000-00 00:00 res/xml/preferences.xml
│  -rw----     0.0 fat      792 b- defN 80-000-00 00:00 res/xml/preferences_backup.xml
│  -rw----     0.0 fat      412 b- defN 80-000-00 00:00 res/xml/preferences_external_service.xml
│  -rw----     0.0 fat      784 b- defN 80-000-00 00:00 res/xml/preferences_notifications.xml
│  -rw----     0.0 fat     1056 b- defN 80-000-00 00:00 res/xml/preferences_pincode.xml
│  -rw----     0.0 fat      512 b- defN 80-000-00 00:00 res/xml/preferences_versions.xml
│  -rw----     0.0 fat  2250600 bx stor 80-000-00 00:00 resources.arsc
│ -1785 files, 32819984 bytes uncompressed, 14961408 bytes compressed:  54.4%
│ +1785 files, 32820053 bytes uncompressed, 14961432 bytes compressed:  54.4%

For automatic verification (aka "reproducible build") the issue with git authentication of the wallet-android-modularization-tools submodule would need to be fixed. See https://walletscrutiny.com/posts/2019/11/mycelium/ for details.

I should mention that I'm _not_ affiliated with mycelium.com or Mycelium Wallet.

[crwatkins]

Thanks much Andreas! I've created PR #3225.

Thanks @Giszmo