Bluewallet: App from GooglePlay is not verifiable

[Giszmo]

Please check my findings on the wallet's verifiability and let me know when I should give it another try. We are already in touch but I'm pinging all the wallets we failed to verify, so here's an issue for this.

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the label bug to this issue, with a confidence of 0.77. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[ncoelho]

This setup is tested on macOS and Linux, if you are using other setup, please help us figure out what is missing on it.

Open an Android Emulator or Connect an Android device.

The run:
$ npm i && npm start
$ react-native run-android

similar issue being described here https://github.com/BlueWallet/BlueWallet/issues/759

[Overtorment]

Verifiability is important, we’ll definitely spend some time to make builds
verifiable. I’ll start with updating stand-alone build instructions, as atm
all builds are setup and automated on CI

On Sat, 14 Dec 2019 at 10:54, Nuno Coelho [e-mail] wrote:

This setup is tested on macOS and Linux, if you are using other setup,
please help us figure out what is missing on it.

Open an Android Emulator or Connect an Android device.

The run:
$ npm i && npm start
$ react-native run-android

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/BlueWallet/BlueWallet/issues/758?email_source=notifications&email_token=AAOTD6NSMJFJEPTW2V7SF4LQYS3NVA5CNFSM4J2YAVNKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEG376RY#issuecomment-565706567,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAOTD6NHTP4QMXJURTZNNSDQYS3NVANCNFSM4J2YAVNA
.

[Giszmo]

If you build on CI, you should be there already. The more it can be automated, the better. Just strip the signing part or provide a fallback dummy key. Signature is obviously ignored for the verification.

I have a few other open source wallets that reacted to my shout-out and I'll review all asap again.

Yes, verification is important. Any non-verified release might be the end of the project. As a release manager myself I certainly want every tempted criminal to understand that putting me under distress won't get them all our customers' coins.

[bolatovumar]

@Giszmo pls see this issue (#759) where I attempted to build the app for Android from scratch. I submitted a PR (https://github.com/BlueWallet/BlueWallet/pull/801) with updated instructions which was merged.

[Giszmo]

801 using npx react-native run-android doesn't sound like building an APK. The run-android commands are for development with live code reload I think. Also for build automation, clicking in AS is not an option. The build process cannot depend on AS and if it does, the version of AS should matter, should it not?

[bolatovumar]

@Giszmo you are right, this is not for building an APK, it's for local development only.

[Overtorment]

Can you try

$ cd android
$ ./gradlew bundleRelease

for me it builds this file : ./app/build/outputs/bundle/release/app.aab but I have some local gradle config, I don't remember really how things work here, we have builds setup on CI since like a year ago.
anyway here's a guide https://facebook.github.io/react-native/docs/signed-apk-android.html it should definately help

[marcosrdz]

I use assembleRelease instead of bundleRelease

[Giszmo]

I tried again to verify the build but

• there is no tag 4.9.1
• ./gradlew bundleRelease doesn't work
• ./gradlew assembleRelease doesn't work

Please provide tested and working build instructions on your main Readme.md.

---

Relevant part of review:

$ docker run -it --volume $PWD:/mnt --workdir /mnt --rm beevelop/cordova bash
root@93d42b33d091:/mnt# npm install
root@93d42b33d091:/mnt# cd android/
root@9b73bbcbb500:/mnt/android# yes | /opt/android/tools/bin/sdkmanager "build-tools;28.0.3"
root@93d42b33d091:/mnt/android# ./gradlew clean assembleRelease

but this also didn't succeed:

* What went wrong:
Execution failed for task ':@remobile_react-native-qrcode-local-image:verifyReleaseResources'.
> 1 exception was raised by workers:
  com.android.builder.internal.aapt.v2.Aapt2Exception: Android resource linking failed
  error: resource android:style/TextAppearance.Material.Widget.Button.Borderless.Colored not found.
  error: resource android:style/TextAppearance.Material.Widget.Button.Colored not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values-v26/values-v26.xml:7: error: resource android:attr/colorError not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values-v26/values-v26.xml:11: error: resource android:attr/colorError not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values-v26/values-v26.xml:15: error: style attribute 'android:attr/keyboardNavigationCluster' not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values-v28/values-v28.xml:7: error: resource android:attr/dialogCornerRadius not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values-v28/values-v28.xml:11: error: resource android:attr/dialogCornerRadius not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values/values.xml:2734: error: resource android:attr/fontStyle not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values/values.xml:2735: error: resource android:attr/font not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values/values.xml:2736: error: resource android:attr/fontWeight not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values/values.xml:2737: error: resource android:attr/fontVariationSettings not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values/values.xml:2738: error: resource android:attr/ttcIndex not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values/values.xml:2902: error: resource android:attr/startX not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values/values.xml:2905: error: resource android:attr/startY not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values/values.xml:2908: error: resource android:attr/endX not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values/values.xml:2911: error: resource android:attr/endY not found.
  /mnt/node_modules/@remobile/react-native-qrcode-local-image/android/build/intermediates/res/merged/release/values/values.xml:2919: error: resource android:attr/offset not found.
  error: failed linking references.



* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

* Get more help at https://help.gradle.org

Deprecated Gradle features were used in this build, making it incompatible with Gradle 6.0.
Use '--warning-mode all' to show the individual deprecation warnings.
See https://docs.gradle.org/5.4.1/userguide/command_line_interface.html#sec:command_line_warnings

BUILD FAILED in 4m 29s
120 actionable tasks: 97 executed, 23 up-to-date

Different but same for ./gradlew clean bundleRelease:

...
Error: Unable to resolve module `../../release-notes` from `/mnt/screen/settings/releasenotes.js`: The module `../../release-notes` could not be found from `/mnt/screen/settings/releasenotes.js`. Indeed, none of these files exist:
  * `/mnt/release-notes(.native||.android.js|.native.js|.js|.android.json|.native.json|.json|.android.ts|.native.ts|.ts|.android.tsx|.native.tsx|.tsx)`
  * `/mnt/release-notes/index(.native||.android.js|.native.js|.js|.android.json|.native.json|.json|.android.ts|.native.ts|.ts|.android.tsx|.native.tsx|.tsx)`
    at ModuleResolver.resolveDependency (/mnt/node_modules/metro/src/node-haste/DependencyGraph/ModuleResolution.js:163:15)
    at ResolutionRequest.resolveDependency (/mnt/node_modules/metro/src/node-haste/DependencyGraph/ResolutionRequest.js:52:18)
    at DependencyGraph.resolveDependency (/mnt/node_modules/metro/src/node-haste/DependencyGraph.js:283:16)
    at Object.resolve (/mnt/node_modules/metro/src/lib/transformHelpers.js:264:42)
    at dependencies.map.result (/mnt/node_modules/metro/src/DeltaBundler/traverseDependencies.js:399:31)
    at Array.map (<anonymous>)
    at resolveDependencies (/mnt/node_modules/metro/src/DeltaBundler/traverseDependencies.js:396:18)
    at /mnt/node_modules/metro/src/DeltaBundler/traverseDependencies.js:269:33
    at Generator.next (<anonymous>)
    at asyncGeneratorStep (/mnt/node_modules/metro/src/DeltaBundler/traverseDependencies.js:87:24)

> Task :app:bundleReleaseJsAndAssets FAILED

> Task :app:bundleReleaseJsAndAssets_SentryUpload FAILED
Processing react-native sourcemaps for Sentry upload.
error:> Analyzing 2 sources
 No such file or directory (os error 2)

Add --log-level=[info|debug] or export SENTRY_LOG_LEVEL=[info|debug] to see more output.
Please attach the full debug log to all bug reports.

FAILURE: Build completed with 2 failures.

1: Task failed with an exception.
-----------
* What went wrong:
Execution failed for task ':app:bundleReleaseJsAndAssets'.
> Process 'command 'node'' finished with non-zero exit value 1

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.
==============================================================================

2: Task failed with an exception.
-----------
* What went wrong:
Execution failed for task ':app:bundleReleaseJsAndAssets_SentryUpload'.
> Process 'command 'node_modules/@sentry/cli/bin/sentry-cli'' finished with non-zero exit value 1

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.
==============================================================================

* Get more help at https://help.gradle.org

Deprecated Gradle features were used in this build, making it incompatible with Gradle 6.0.
Use '--warning-mode all' to show the individual deprecation warnings.
See https://docs.gradle.org/5.4.1/userguide/command_line_interface.html#sec:command_line_warnings

BUILD FAILED in 33s

[Overtorment]

well fuck me. I'll have to get myself a clean system and setup builds from scratch writing down every step I make. stay tuned...

[Giszmo]

staying tuned ...

[Overtorment]

thanks for your patience!
I recently automated builds on travisCI for end-to-end testing with detox.
that's one step closer to verifiable builds. I'll get back to this once I sort some other important tickets.

[Overtorment]

ok, I adapted our travisCI scenario to build apk. works on clean ubuntu 18, tested it on cheap digitalocean vps. don't run as root. here's the script:

sudo apt-get update -y
sudo apt-get upgrade -y
sudo apt-get install unzip git npm -y
sudo npm i n -g
sudo n stable
echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p

export COMPILE_API=29
export ANDROID_BUILD_TOOLS=29.0.2
export ABI=x86_64
export ADB_INSTALL_TIMEOUT=8
export ANDROID_HOME=${HOME}/android-sdk
export ANDROID_TOOLS_URL="https://dl.google.com/android/repository/sdk-tools-linux-4333796.zip"
export EMU_FLAVOR=default # use google_apis flavor if no default flavor emulator
export GRAVIS="https://raw.githubusercontent.com/DanySK/Gravis-CI/master/"
export JDK="1.8"
export TOOLS=${ANDROID_HOME}/tools
export PATH=${ANDROID_HOME}:${ANDROID_HOME}/emulator:${TOOLS}:${TOOLS}/bin:${ANDROID_HOME}/platform-tools:${PATH}
export API=28
export TRAVIS_OS_NAME="linux"


# Set up JDK 8 for Android SDK
curl "${GRAVIS}.install-jdk-travis.sh" --output ~/.install-jdk-travis.sh
export TARGET_JDK="${JDK}"
source ~/.install-jdk-travis.sh

# Set up Android SDK
wget -q "${ANDROID_TOOLS_URL}" -O android-sdk-tools.zip
unzip -q android-sdk-tools.zip -d ${ANDROID_HOME}
rm android-sdk-tools.zip
mkdir ~/.android # avoid harmless sdkmanager warning
echo 'count=0' > ~/.android/repositories.cfg # avoid harmless sdkmanager warning
yes | sdkmanager --licenses >/dev/null # accept all sdkmanager warnings
echo y | sdkmanager --no_https "platform-tools" >/dev/null
echo y | sdkmanager --no_https "tools" >/dev/null # A second time per Travis docs, gets latest versions
echo y | sdkmanager --no_https "build-tools;${ANDROID_BUILD_TOOLS}" >/dev/null # Implicit gradle dependency - gradle drives changes
echo y | sdkmanager --no_https "platforms;android-${COMPILE_API}" >/dev/null # We need the API of the current compileSdkVersion from gradle.properties




git clone https://github.com/BlueWallet/BlueWallet
cd BlueWallet
npm i
cd android
./gradlew assembleRelease

keytool -genkeypair -v -keystore detox.keystore -alias detox  -keyalg RSA -keysize 2048 -validity 10000 -storepass 123456 -keypass 123456 -dname  'cn=Unknown, ou=Unknown, o=Unknown, c=Unknown'
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore detox.keystore ./app/build/outputs/apk/release/app-release-unsigned.apk  detox -storepass 123456

it should build APK and sign it with random key.
Im sure there's easier way to do this. maybe someone will make a dockerfile out of it.

let me know how is it going

[Overtorment]

if script works for you I will include it in repo under scripts/

[junderw]

https://github.com/junderw/BlueWallet/tree/dockerBuildAndroid/scripts/docker

This works.

To change the version you need to do the following before running the docker run again:

1. Modify startup.sh
2. build image again (so the COPY step will pull in the new startup.sh)

If anyone wants to clean up that docker so it will work more deterministically (hard because that Gravis-CI stuff can be changed on a whim) cool.

I tested the apk. It works fine.

[Giszmo]

I gave it another try and while sort of following @Overtorment's code yielded a compile error, maybe because I deviated from the script, @junderw's docker did compile fine but the result differs a lot from the apk I got from Google Play.

My attempt at running the commands mostly in some (kind of random) docker container. Should have used ubuntu:18.04.

$ git clone https://github.com/BlueWallet/BlueWallet.git
$ cd BlueWallet/
$ git tag | grep 5.3.7
v5.3.7
leo@codex:/tmp/BlueWallet$ git checkout v5.3.7
$ docker run -it --volume $PWD:/mnt --workdir /mnt --rm beevelop/cordova bash
root@200b459d6058:/mnt# apt update -y && apt upgrade -y && apt install unzip git npm -y
root@200b459d6058:/mnt# npm i n -g
root@200b459d6058:/mnt# n stable
root@200b459d6058:/mnt# echo fs.inotify.max_user_watches=524288 | tee -a /etc/sysctl.conf && sysctl -p
root@200b459d6058:/mnt# export COMPILE_API=29
root@200b459d6058:/mnt# export ANDROID_BUILD_TOOLS=29.0.2
root@200b459d6058:/mnt# export ABI=x86_64
root@200b459d6058:/mnt# export ADB_INSTALL_TIMEOUT=8
root@200b459d6058:/mnt# export ANDROID_HOME=${HOME}/android-sdk
root@200b459d6058:/mnt# export ANDROID_TOOLS_URL="https://dl.google.com/android/repository/sdk-tools-linux-4333796.zip"
root@200b459d6058:/mnt# export EMU_FLAVOR=default # use google_apis flavor if no default flavor emulator
root@200b459d6058:/mnt# export GRAVIS="https://raw.githubusercontent.com/DanySK/Gravis-CI/master/"
root@200b459d6058:/mnt# export JDK="1.8"
root@200b459d6058:/mnt# export TOOLS=${ANDROID_HOME}/tools
root@200b459d6058:/mnt# export PATH=${ANDROID_HOME}:${ANDROID_HOME}/emulator:${TOOLS}:${TOOLS}/bin:${ANDROID_HOME}/platform-tools:${PATH}
root@200b459d6058:/mnt# export API=28
root@200b459d6058:/mnt# export TRAVIS_OS_NAME="linux"
root@200b459d6058:/mnt# curl "${GRAVIS}.install-jdk-travis.sh" --output ~/.install-jdk-travis.sh
root@200b459d6058:/mnt# export TARGET_JDK="${JDK}"
root@200b459d6058:/mnt# source ~/.install-jdk-travis.sh
root@200b459d6058:/mnt# wget -q "${ANDROID_TOOLS_URL}" -O android-sdk-tools.zip
root@200b459d6058:/mnt# unzip -q android-sdk-tools.zip -d ${ANDROID_HOME}
root@200b459d6058:/mnt# rm android-sdk-tools.zip
root@200b459d6058:/mnt# mkdir ~/.android # avoid harmless sdkmanager warning
root@200b459d6058:/mnt# echo 'count=0' > ~/.android/repositories.cfg # avoid harmless sdkmanager warning
root@200b459d6058:/mnt# yes | sdkmanager --licenses >/dev/null # accept all sdkmanager warnings
root@200b459d6058:/mnt# echo y | sdkmanager --no_https "platform-tools" >/dev/null
root@200b459d6058:/mnt# echo y | sdkmanager --no_https "tools" >/dev/null # A second time per Travis docs, gets latest versions
root@200b459d6058:/mnt# echo y | sdkmanager --no_https "build-tools;${ANDROID_BUILD_TOOLS}" >/dev/null # Implicit gradle dependency - gradle drives changes
root@200b459d6058:/mnt# echo y | sdkmanager --no_https "platforms;android-${COMPILE_API}" >/dev/null # We need the API of the current compileSdkVersion from gradle.properties
root@200b459d6058:/mnt# npm i
root@200b459d6058:/mnt# cd android
root@200b459d6058:/mnt/android# ./gradlew assembleRelease

...

Error: Unable to resolve module `../../release-notes` from `screen/settings/releasenotes.js`: 

None of these files exist:
  * release-notes(.native|.android.js|.native.js|.js|.android.json|.native.json|.json|.android.ts|.native.ts|.ts|.android.tsx|.native.tsx|.tsx)
  * release-notes/index(.native|.android.js|.native.js|.js|.android.json|.native.json|.json|.android.ts|.native.ts|.ts|.android.tsx|.native.tsx|.tsx)
    at ModuleResolver.resolveDependency (/mnt/node_modules/metro/src/node-haste/DependencyGraph/ModuleResolution.js:163:15)
    at ResolutionRequest.resolveDependency (/mnt/node_modules/metro/src/node-haste/DependencyGraph/ResolutionRequest.js:52:18)
    at DependencyGraph.resolveDependency (/mnt/node_modules/metro/src/node-haste/DependencyGraph.js:282:16)
    at Object.resolve (/mnt/node_modules/metro/src/lib/transformHelpers.js:267:42)
    at /mnt/node_modules/metro/src/DeltaBundler/traverseDependencies.js:426:31
    at Array.map (<anonymous>)
    at resolveDependencies (/mnt/node_modules/metro/src/DeltaBundler/traverseDependencies.js:423:18)
    at /mnt/node_modules/metro/src/DeltaBundler/traverseDependencies.js:275:33
    at Generator.next (<anonymous>)
    at asyncGeneratorStep (/mnt/node_modules/metro/src/DeltaBundler/traverseDependencies.js:87:24)

> Task :app:bundleReleaseJsAndAssets FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':app:bundleReleaseJsAndAssets'.
> Process 'command 'npx'' finished with non-zero exit value 1

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

* Get more help at https://help.gradle.org

Deprecated Gradle features were used in this build, making it incompatible with Gradle 7.0.
Use '--warning-mode all' to show the individual deprecation warnings.
See https://docs.gradle.org/6.0/userguide/command_line_interface.html#sec:command_line_warnings

BUILD FAILED in 5m 51s
58 actionable tasks: 58 executed

Running the docker:

$ git clone https://github.com/junderw/BlueWallet
$ cd BlueWallet/
$ git checkout dockerBuildAndroid 
$ docker build scripts/docker/ -t bluewalletbuilder
$ cd scripts/docker/
$ docker run --name builder -v $(pwd)/output:/data bluewalletbuilder
$ diffoscope "/path/to/BlueWallet 5.3.7 (io.bluewallet.bluewallet).apk" output/app-release-unsigned.apk | wc -l
8523006

The Dockerfile works to compile the apk but it should require a revision/tag as command line parameter and not require the user to edit a script for that.

---

Edit: As the line with diffoscope might not be clear if you don't know the tool: apk tools necessarily are not bit by bit reproducible, as the verifier cannot reproduce the release signature, which is part of the apk. Therefore build verification requires to unpack the apk. This can be done with unzip or with apktool but the following result means the binary on google play is not reproducible:

$ unzip "/path/to/BlueWallet 5.3.7 (io.bluewallet.bluewallet).apk" -d zipGoogle
$ unzip output/app-release-unsigned.apk -d zipDocker
$ diff --recursive --brief zip*
Files zipDocker/AndroidManifest.xml and zipGoogle/AndroidManifest.xml differ
Files zipDocker/assets/index.android.bundle and zipGoogle/assets/index.android.bundle differ
Files zipDocker/classes2.dex and zipGoogle/classes2.dex differ
Files zipDocker/classes.dex and zipGoogle/classes.dex differ
Files zipDocker/lib/arm64-v8a/libimagepipeline.so and zipGoogle/lib/arm64-v8a/libimagepipeline.so differ
Files zipDocker/lib/arm64-v8a/libjsc.so and zipGoogle/lib/arm64-v8a/libjsc.so differ
Files zipDocker/lib/arm64-v8a/libnative-filters.so and zipGoogle/lib/arm64-v8a/libnative-filters.so differ
Files zipDocker/lib/arm64-v8a/libnative-imagetranscoder.so and zipGoogle/lib/arm64-v8a/libnative-imagetranscoder.so differ
Files zipDocker/lib/arm64-v8a/librsjni_androidx.so and zipGoogle/lib/arm64-v8a/librsjni_androidx.so differ
Files zipDocker/lib/armeabi-v7a/libimagepipeline.so and zipGoogle/lib/armeabi-v7a/libimagepipeline.so differ
Files zipDocker/lib/armeabi-v7a/libjsc.so and zipGoogle/lib/armeabi-v7a/libjsc.so differ
Files zipDocker/lib/armeabi-v7a/libnative-filters.so and zipGoogle/lib/armeabi-v7a/libnative-filters.so differ
Files zipDocker/lib/armeabi-v7a/libnative-imagetranscoder.so and zipGoogle/lib/armeabi-v7a/libnative-imagetranscoder.so differ
Files zipDocker/lib/armeabi-v7a/librsjni_androidx.so and zipGoogle/lib/armeabi-v7a/librsjni_androidx.so differ
Files zipDocker/lib/x86/libimagepipeline.so and zipGoogle/lib/x86/libimagepipeline.so differ
Files zipDocker/lib/x86/libjsc.so and zipGoogle/lib/x86/libjsc.so differ
Files zipDocker/lib/x86/libnative-filters.so and zipGoogle/lib/x86/libnative-filters.so differ
Files zipDocker/lib/x86/libnative-imagetranscoder.so and zipGoogle/lib/x86/libnative-imagetranscoder.so differ
Files zipDocker/lib/x86/librsjni_androidx.so and zipGoogle/lib/x86/librsjni_androidx.so differ
Files zipDocker/lib/x86_64/libimagepipeline.so and zipGoogle/lib/x86_64/libimagepipeline.so differ
Files zipDocker/lib/x86_64/libjsc.so and zipGoogle/lib/x86_64/libjsc.so differ
Files zipDocker/lib/x86_64/libnative-filters.so and zipGoogle/lib/x86_64/libnative-filters.so differ
Files zipDocker/lib/x86_64/libnative-imagetranscoder.so and zipGoogle/lib/x86_64/libnative-imagetranscoder.so differ
Files zipDocker/lib/x86_64/librsjni_androidx.so and zipGoogle/lib/x86_64/librsjni_androidx.so differ
Only in zipDocker/META-INF: DETOX.RSA
Only in zipDocker/META-INF: DETOX.SF
Only in zipGoogle/META-INF: GOOGPLAY.RSA
Only in zipGoogle/META-INF: GOOGPLAY.SF
Files zipDocker/META-INF/MANIFEST.MF and zipGoogle/META-INF/MANIFEST.MF differ
Files zipDocker/res/raw/node_modules_bigi_package.json and zipGoogle/res/raw/node_modules_bigi_package.json differ
Files zipDocker/res/raw/node_modules_elliptic_package.json and zipGoogle/res/raw/node_modules_elliptic_package.json differ

---

Edit 2: The file compiled with docker does run on my AVD and looks complete but the diff in the files is also very significant, looking at the file size:

$ ll "/path/to/BlueWallet 5.3.7 (io.bluewallet.bluewallet).apk" output/app-release-unsigned.apk
-rw-rw-r-- 1 leo leo 27M May 26 17:02 '/path/to/BlueWallet 5.3.7 (io.bluewallet.bluewallet).apk'
-rw-r--r-- 1 leo leo 29M May 26 16:58  output/app-release-unsigned.apk

[Overtorment]

Error: Unable to resolve module ../../release-notes - something went wrong with npm i, this file is generated postinstall with list of changes since last tag.
dockerfile and my script are very much identical, so whichever works for you.

The Dockerfile works to compile the apk but it should require a revision/tag as command line parameter and not require the user to edit a script for that.

we can work on that later, when we move dockerfile to repo.

ok my guess is that by default npm i installs dev dependencies as well ,that's why diff is so big. from documentation:

By default, npm install will install all modules listed as dependencies in package. json . With the --production flag (or when the NODE_ENV environment variable is set to production ), npm will not install modules listed in devDependencies .

can you try rerunning but with --production in npm install command? Ill do some experiments on my end as well.

[junderw]

might also want to do npm ci instead, since any patches for react dependencies would get pulled in if we had any ^ dependencies

[Overtorment]

we do not have any ^ dependencies for production. some devDependencies do have ^

[Giszmo]

$ cat startup.sh | grep production
npm --production i
$ docker run --name builder --rm -v $(pwd)/output:/data bluewalletbuilder
...
BUILD SUCCESSFUL in 6m 18s
...
$ ll output/app-release-unsigned.apk /path/to/BlueWallet\ 5.3.7.apk 
-rw-rw-r-- 1 leo leo 27M May 26 17:02 '/path/to/BlueWallet 5.3.7.apk'
-rw-r--r-- 1 leo leo 29M May 28 00:43  output/app-release-unsigned.apk

[Overtorment]

also, i noticed that our nodejs ver on CI is set to 10.x
anyway, will try to mess around builds some more

[Overtorment]

got some progress.

bad news, is that the size difference is there. when you build from docker its ~29 Mb, and builds that we get from our CI/CD (appcenter.ms) is ~27 Mb.
good news is that I was able to isolate the difference to bundled libjsc.so binaries.

a bit in-depth... so, you can unzip apk and see its contents. i started examining apk from docker and apk from appcenter. the main executable is assets/index.android.bundle which is minified javascript. i did diff on them and the difference was only 3k - I peeked and it was some difference in paths (on the machine it was built on) and readme/release notes. so that's good news.
all other files in apk are the same, except several libjsc.so - per each target architecture (armeabi-v7a, x86_64 etc) there's its own libjsc.so and they are the ones that contribute to apk files difference, 1-2 megabytes per architecture.

quick googling showed that this is javascriptcore binaries that are used to actually bootstrap javascript https://github.com/react-native-community/jsc-android-buildscripts
Ill try to dig more into this, maybe will ask questions on StackOverflow or appcenter support. maybe Ill even dust off my mad reverse engineering skillz and disassemble those binaries with IDA to see whats going on inside and where the difference comes from.

[Overtorment]

https://github.com/react-native-community/jsc-android-buildscripts/issues/135

[Overtorment]

some progress, found out specific versions of build container on appcenter:

https://github.com/actions/virtual-environments/blob/master/images/macos/macos-10.15-Readme.md
https://docs.microsoft.com/en-us/appcenter/build/macos-10.15-software (same doc)

@junderw how hard it is you think to bake those specific versions in our docker? Im looking into Azure containers atm

[junderw]

Very hard...

Not to mention it looks like appcenter is macOS, and iirc there are no macOS docker containers.....???

[Giszmo]

no macOS docker containers.....???

To my understanding of how Docker works, you can't have a macOS container as Docker is using the host's kernel which would not be the same on macOS. So if there was a macOS container, it would only run on macOS.

On the other hand I'm very confused right now. Docker is still magic to me and due to it not being as flexible as virtual machines and not designed to provide security, I am considering to switch away from docker to VMWare or whatever. Please let me know if that would be necessary or helpful in your case.

[Overtorment]

@Giszmo would that be an option for you to use appcenter to setup your _own_ CI for BW to make at least 1 build to compare and count that as verifiable?

otherwise, I have some thoughts on renting https://www.macincloud.com to install specified software versions and try to do a verifiable build there.

[Giszmo]

It's probably much work that would be obsolete with the next release.

If you build this on a Mac and it can only be reproduced on a Mac, I would prefer to get neutral, trusted reproducers to join the project and rebuild it on their infrastructure but ideally somebody would figure out how to do this with a VM. I never ran a MacOS VM but I assume that's possible. No idea if that would require a license or if there is some more accessible way of doing this.

[Overtorment]

I occasionally rent a Mac on macincloud to do some dev work, works pretty
good

On Fri, 19 Jun 2020 at 02:37, Leo Wandersleb [e-mail]
wrote:

It's probably much work that would be obsolete with the next release.

If you build this on a Mac and it can only be reproduced on a Mac, I would
prefer to get neutral, trusted reproducers to join the project and rebuild
it on their infrastructure but ideally somebody would figure out how to do
this with a VM. I never ran a MacOS VM but I assume that's possible. No
idea if that would require a license or if there is some more accessible
way of doing this.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/BlueWallet/BlueWallet/issues/758#issuecomment-646387287,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAOTD6I7DBGOSKHVBG6V6A3RXK6NTANCNFSM4J2YAVNA
.