Reproducible builds #1055

ktecho · 2022-08-08T23:19:37Z

This started using #535 as base. The Dockerfile is a lot simpler because I'm using a reactnativecommunity/react-native-android image that has everything built in. Both .sh files are from the other PR and have several problems yet:

1- compile.sh and build.sh are almost the same, but build.sh has the IMAGETAG stuff removed because I wanted to make it work without it (see point 3).

2- This works just for Debug releases (assembleDebug), not Release (assembleRelease). This is because we need the same keystore used to build the releases. For Debug, it generates a new keystore, as we don't care if it's reproducible or not. But it builts the apk correctly.

3- It works just the first time. So if you don't have the container created yet, it creates it, uses it and it works. If it already exists, it may not work. For this, maybe the IMAGETAG stuff in compile.sh could be useful, but I don't think I made it work.

kaloudis · 2022-08-09T16:53:38Z

Wow, you're much further along than I thought! What we have to do now is remove the keysigning process from the assembleRelease process. That way users will generate the same exact binary minus the signature.

kaloudis · 2022-08-10T03:00:33Z

build.sh

+
+docker build . -t zeus_builder_image
+
+docker run --name zeus_builder_container -v `pwd`:$ZEUS_PATH zeus_builder_image bash -c \


need to include flag --platform linux/amd64 or you'll hit an error on M1 systems

google/cadvisor#2763

UGH, performance is terrible via emulation. Need to get them to publish an arm64 image

react-native-community/docker-android#166

Dockerfile

ktecho · 2022-08-10T08:57:49Z

Wow, you're much further along than I thought! What we have to do now is remove the keysigning process from the assembleRelease process. That way users will generate the same exact binary minus the signature.

But then people won't be able to compare the .apk from Playstore and get the same MD5, right? Not exactly sure how this works. It's been ages without me doing something Android related.

Edit: ok, not only Playstore, but the one you download from github or the webpage.

kaloudis · 2022-08-11T19:03:19Z

Wow, you're much further along than I thought! What we have to do now is remove the keysigning process from the assembleRelease process. That way users will generate the same exact binary minus the signature.

But then people won't be able to compare the .apk from Playstore and get the same MD5, right? Not exactly sure how this works. It's been ages without me doing something Android related.

Edit: ok, not only Playstore, but the one you download from github or the webpage.

There's tooling that separates the main package from the signed data on top of it. I believe apkdiff does this: https://github.com/daniellockyer/apkdiff

ktecho · 2022-08-12T17:28:08Z

I've simplified the process a lot so that it can also be used to compile a local version of the code (see README.md).

Right now it installs the node packages then it starts compile process, but it fails with:

2022-08-12T16:53:27.026+0000 [ERROR] [org.gradle.internal.buildevents.BuildExceptionReporter] FAILURE: Build failed with an exception.
2022-08-12T16:53:27.026+0000 [ERROR] [org.gradle.internal.buildevents.BuildExceptionReporter] 
2022-08-12T16:53:27.026+0000 [ERROR] [org.gradle.internal.buildevents.BuildExceptionReporter] * What went wrong:
2022-08-12T16:53:27.026+0000 [ERROR] [org.gradle.internal.buildevents.BuildExceptionReporter] Execution failed for task ':app:bundleReleaseJsAndAssets'.
2022-08-12T16:53:27.027+0000 [ERROR] [org.gradle.internal.buildevents.BuildExceptionReporter] > Process 'command 'node'' finished with non-zero exit value 1
2022-08-12T16:53:27.027+0000 [ERROR] [org.gradle.internal.buildevents.BuildExceptionReporter] 
2022-08-12T16:53:27.027+0000 [ERROR] [org.gradle.internal.buildevents.BuildExceptionReporter] * Try:
2022-08-12T16:53:27.027+0000 [ERROR] [org.gradle.internal.buildevents.BuildExceptionReporter] Run with --stacktrace option to get the stack trace.  Run with --scan to get full insights.

Will try again later, but probably I'll not advance too much until I get unlimited data and a faster computer.

If anybody wants to try to see where the problem is, you can try putting this at the line 13 in build.sh:

./gradlew --stacktrace --scan assembleRelease && \

Another thing I want to try, is using the previous docker image for the React builder, as a few months ago I tried this and it was working (latest image is from 15 days ago). For that, you would need to change the first line in Dockerfile to:

FROM reactnativecommunity/react-native-android:5.4

emanuelb · 2022-08-13T11:08:42Z

Comparing built APK to APK from provider can be done with:

unzip both APK in different folders and run diff --brief --recursive ./LocalBuild ./FromProvider
Then only files relates to signature should be shown.
running diffoscope https://diffoscope.org/ on both APK which will compare them and show the difference.
tool developed by f-droid used to compare APKs by omitting signature https://github.com/obfusk/apksigcopier

See related issue I opened a while ago with my RB attempts of Zeus wallet: #898 and another issue of diffs between the APK from f-droid to APK on github (the APK on f-droid is built using their build server) #463

ktecho · 2022-08-13T16:39:05Z

Thanks @emanuelb I'll have a look at it

ktecho · 2022-08-13T21:34:04Z

My mind is slow being on vacation... I forgot that I can test this in a remote server that I have with unlimited bandwidth...

It seems we're hitting this issue: browserify/pbkdf2#111

SyntaxError: /olympus/zeus/node_modules/parse-asn1/node_modules/pbkdf2/lib/default-encoding.js: Unexpected token (5:36)
error SyntaxError: /olympus/zeus/node_modules/parse-asn1/node_modules/pbkdf2/lib/default-encoding.js: Unexpected token (5:36)

  3 | if (global.process && global.process.browser) {
  4 |   defaultEncoding = 'utf-8'
> 5 | } else if (global.process && global."v16.16.0") {

    |                                     ^

But here someone states that it's more likely that the culprit is rn-nodeify: browserify/pbkdf2#97

@kaloudis I'm not sure why you were able to compile v0.6.5 without hitting this issue, but changing the version of the package from 10.2.0 to 10.3.0 as stated in the last link fixes the issue for this build environment.

ktecho · 2022-08-13T21:36:22Z

@kaloudis if you want me to create a PR to upgrade the version of the library, just tell me.

kaloudis · 2022-08-13T23:46:31Z

@ktecho you can include the library upgrade in this PR

kaloudis · 2022-08-14T00:02:59Z

Do you not have to remove the signing config block for assembleRelease to complete successfully?

https://github.com/ZeusLN/zeus/blob/master/android/app/build.gradle#L139

ktecho · 2022-08-14T07:49:27Z

Do you not have to remove the signing config block for assembleRelease to complete successfully?

https://github.com/ZeusLN/zeus/blob/master/android/app/build.gradle#L139

Yeah, probably you're right. I was trying to generate a self-signed certificate to be able to release, so the process is valid for the normal release and the apks only diff in the certificate.

I'm going to try and generate the release without the signing config block to finish this, and if it works fine, I'll let you or others accomodate the android part.

…build

ktecho · 2022-08-14T09:47:34Z

It's working! :)

I've tested the build for v.0.6.5 and it works. The only changes I had to make is updating the library I was refering before to the newer version without the issue, and commenting this line in build.gradle so it doesn't try to sign the apks:

    buildTypes {
        debug {
            signingConfig signingConfigs.debug
            if (nativeArchitectures) {
                ndk {
                    abiFilters nativeArchitectures.split(',')
                }
            }
        }
        release {
            shrinkResources true
            minifyEnabled enableProguardInReleaseBuilds
            proguardFiles getDefaultProguardFile("proguard-android.txt"), "proguard-rules.pro"
            //signingConfig signingConfigs.release
        }
    }

@kaloudis I don't know what you want to do with this signing stuff, because I think you need signing the apk that goes to the Play Store. Can we have another type of assemble, so we have assembleDebug, assembleRelease, assembleReleaseNoSign?

Another one: is there an easy way to change the app-universal-release-unsigned.apk to something like zeus-v0.6.5-unsigned.apk? Maybe the build script should rename the apks to this naming?

So for the comparison of the apks: I'll take a look at that later on which are the differences, but right now there is a big difference in size for the apks:

-rw-rw-r-- 1 ktecho ktecho  46M jun 22 19:16 zeus-v0.6.5.apk
-rw-r--r-- 1 ktecho ktecho  43M ago 14 11:40 app-universal-release-unsigned.apk

The tools that @emanuelb told me we could use pulls some 400 to 800 MB of dependencies in my debian testing environment. I'll have a look later on which one is the lighter one so we recomment it to people verifying the builds. Just so we start thinking about it: maybe the apk that can be downloaded from the page should be generated using this procedure so the diff is exact?

ktecho · 2022-08-14T13:37:24Z

More findings: apkdiff cannot be used because it reports both apks are equal, and they're not. It has a list of extensions ignored, so for example, we have different .so library sizes, but apkdiff is not reporting this difference. There are other differences in .xml files that apkdiff also is not detecting. I'll give a look to the other tools recommended in this thread.

@kaloudis I'm getting big differences in the size of this libsifir library for v0.6.5. I think this is related to the react-native-tor. I don't know if the size difference is because it's built on different computers. If so, that could be a problem for this reproducible builds stuff...

ktecho@host:~/devel/apks/065built/lib/arm64-v8a$ ls -larth libsifir*
-rw-rw-rw- 1 ktecho ktecho 4,7M ene  1  1981 libsifir_android.so
ktecho@host:~/devel/apks/065oficial/lib/arm64-v8a$ ls -larth libsifir*
-rw-rw-rw- 1 ktecho ktecho 7,8M ene  1  1981 libsifir_android.so

And also:

ktecho@ktecho-XPS-13-9350:~/devel/apks/065built/lib/arm64-v8a$ strings libsifir_android.so | grep "clang version"
Android (7155654, based on r399163b1) clang version 11.0.5 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d)
Android (6875598, based on r399163b) clang version 11.0.5 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d)

ktecho@ktecho-XPS-13-9350:~/devel/apks/065oficial/lib/arm64-v8a$ strings libsifir_android.so | grep "clang version"
Android (7155654, based on r399163b1) clang version 11.0.5 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d)
Android (6875598, based on r399163b) clang version 11.0.5 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d)
Android (6875598, based on r399163b) clang version 11.0.5 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d)

kaloudis · 2022-08-14T14:29:05Z

@kaloudis I don't know what you want to do with this signing stuff, because I think you need signing the apk that goes to the Play Store. Can we have another type of assemble, so we have assembleDebug, assembleRelease, assembleReleaseNoSign?

we could but we probably won't use the old assembleRelease process at all. What we're going to do is manually sign the binary after the fact.

kaloudis · 2022-08-14T14:31:01Z

More findings: apkdiff cannot be used because it reports both apks are equal, and they're not. It has a list of extensions ignored, so for example, we have different .so library sizes, but apkdiff is not reporting this difference. There are other differences in .xml files that apkdiff also is not detecting. I'll give a look to the other tools recommended in this thread.

@kaloudis I'm getting big differences in the size of this libsifir library for v0.6.5. I think this is related to the react-native-tor. I don't know if the size difference is because it's built on different computers. If so, that could be a problem for this reproducible builds stuff...
ktecho@host:~/devel/apks/065built/lib/arm64-v8a$ ls -larth libsifir*
-rw-rw-rw- 1 ktecho ktecho 4,7M ene  1  1981 libsifir_android.so
ktecho@host:~/devel/apks/065oficial/lib/arm64-v8a$ ls -larth libsifir*
-rw-rw-rw- 1 ktecho ktecho 7,8M ene  1  1981 libsifir_android.so
And also:
ktecho@ktecho-XPS-13-9350:~/devel/apks/065built/lib/arm64-v8a$ strings libsifir_android.so | grep "clang version"
Android (7155654, based on r399163b1) clang version 11.0.5 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d)
Android (6875598, based on r399163b) clang version 11.0.5 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d)

ktecho@ktecho-XPS-13-9350:~/devel/apks/065oficial/lib/arm64-v8a$ strings libsifir_android.so | grep "clang version"
Android (7155654, based on r399163b1) clang version 11.0.5 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d)
Android (6875598, based on r399163b) clang version 11.0.5 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d)
Android (6875598, based on r399163b) clang version 11.0.5 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d)

doesn't seem like a big deal, as long as the Tor library is still working (decreasing the size of the binary is a good thing). we shouldn't be comparing the official binary anyway, let's start comparing the newly built images across different machines. Can you give us a hash of the newly built version on the v0.6.5 tag and I'll try to do the same on my machine?

kaloudis · 2022-08-14T14:31:57Z

please commit the build.gradle changes first. want to make sure we're building everything exactly the same

ktecho · 2022-08-14T15:00:47Z

please commit the build.gradle changes first. want to make sure we're building everything exactly the same

Done.

user@host:/home/user/devel/zeus# md5sum android/app/build/outputs/apk/release/app-universal-release-unsigned.apk 
91f02cb94b293bd3ef388fdb84654037  android/app/build/outputs/apk/release/app-universal-release-unsigned.apk

kaloudis · 2022-08-15T22:48:23Z

RE: testing

the Intel machine I got my hands on doesn't have enough RAM. I will get a VPS/cloud instance to test on in the coming days. I'm optimistic that the hashes will match.

ktecho · 2022-08-15T23:30:09Z

RE: testing

I'm optimistic that the hashes will match.

I think they won't, because of the different certificate :)

ktecho · 2022-08-16T15:35:10Z

Just pushed last version. I think we can give this as a first version of the reproducible builds feature. Right now it's ready to be tested. It builds all the 5 apks, create a new certificate and signs the apks with that certificate. Then lists the files so you know where they are, relative to your current directory.

The last part, showing the MD5 of all the apks, I think we could remove it because it will give a different checksum for each user, each time. Maybe the checksum could be the same before signging, but I don't think that's useful.

kaloudis · 2022-08-16T16:01:48Z

Just pushed last version. I think we can give this as a first version of the reproducible builds feature. Right now it's ready to be tested. It builds all the 5 apks, create a new certificate and signs the apks with that certificate. Then lists the files so you know where they are, relative to your current directory.

The last part, showing the MD5 of all the apks, I think we could remove it because it will give a different checksum for each user, each time. Maybe the checksum could be the same before signging, but I don't think that's useful.

I disagree with this approach: despite the fact that users should just be installing the official versions after verifying, this approach will cause the users to have to uninstall their old versions of apps each time because a new key is always generated, no?

RE: MD5 hashing, I think there might be value in getting the checksum before signing

You should be able to
1) Change the extension of your .apk to .zip
2) Open and remove the folder META-INF
3) Change the extension to .apk
And get the unsigned APK again.

We'll have to test this.

ktecho · 2022-08-16T22:56:26Z

I disagree with this approach: despite the fact that users should just be installing the official versions after verifying, this approach will cause the users to have to uninstall their old versions of apps each time because a new key is always generated, no?

Are you refering to the "official build" or the "reproducible build" that users will run?

kaloudis · 2022-08-16T23:34:15Z

I disagree with this approach: despite the fact that users should just be installing the official versions after verifying, this approach will cause the users to have to uninstall their old versions of apps each time because a new key is always generated, no?

Are you refering to the "official build" or the "reproducible build" that users will run?

Either way, I think the signing should be a separate step. Maybe we just include instructions on how to use apksigner in the reproducible instructions in the README

ktecho · 2022-08-20T09:25:32Z

This is ready to be tried. I removed the part that signs the apks, so now we all should be getting the same MD5s. Anybody willing to test it? :)

I leave home tomorrow again. If I have the time, I'll update the README.md with instructions on how to compare apks and how to sign them if one wants to install her own apk.

This is my MD5 section so we can compare if everybody gets the same:

********************************
**** APKs and MD5
********************************

c5e66c22ff1cec9ffba9951a823f5a9a  android/app/build/outputs/apk/release/zeus-arm64-v8a.apk
f2b0acd499e17fe083b4ec4d038cbbcb  android/app/build/outputs/apk/release/zeus-armeabi-v7a.apk
91f02cb94b293bd3ef388fdb84654037  android/app/build/outputs/apk/release/zeus-universal.apk
de71ee8b5f333904ef5dc1d3e8b24a3f  android/app/build/outputs/apk/release/zeus-x86.apk
07bd40e240403b66737584be92a5a406  android/app/build/outputs/apk/release/zeus-x86_64.apk

build.sh

kaloudis · 2022-08-20T14:43:35Z

I got a match

c5e66c22ff1cec9ffba9951a823f5a9a  android/app/build/outputs/apk/release/zeus-arm64-v8a.apk
f2b0acd499e17fe083b4ec4d038cbbcb  android/app/build/outputs/apk/release/zeus-armeabi-v7a.apk
91f02cb94b293bd3ef388fdb84654037  android/app/build/outputs/apk/release/zeus-universal.apk
de71ee8b5f333904ef5dc1d3e8b24a3f  android/app/build/outputs/apk/release/zeus-x86.apk
07bd40e240403b66737584be92a5a406  android/app/build/outputs/apk/release/zeus-x86_64.apk

ktecho · 2022-08-20T15:31:36Z

I got a match

c5e66c22ff1cec9ffba9951a823f5a9a  android/app/build/outputs/apk/release/zeus-arm64-v8a.apk
f2b0acd499e17fe083b4ec4d038cbbcb  android/app/build/outputs/apk/release/zeus-armeabi-v7a.apk
91f02cb94b293bd3ef388fdb84654037  android/app/build/outputs/apk/release/zeus-universal.apk
de71ee8b5f333904ef5dc1d3e8b24a3f  android/app/build/outputs/apk/release/zeus-x86.apk
07bd40e240403b66737584be92a5a406  android/app/build/outputs/apk/release/zeus-x86_64.apk

That's very cool :)

ktecho · 2022-08-20T15:51:48Z

Instructions updated. Please, give it a look.

Is there any way to get the version number from the command line? I was thinking it would be better to have zeus-v0.6.5-universal.apk instead of just zeus-universal.apk. I gave a few tries with git last week but couldn't find it.

kaloudis · 2022-08-20T19:40:43Z

@ktecho check out https://stackoverflow.com/questions/18332474/how-to-set-versionname-in-apk-filename-using-gradle

kaloudis · 2022-08-20T19:48:45Z

Pushed some changes to the README notes. Nothing major, just some grammar nits. Still great English for a Spaniard :P

ktecho · 2022-08-20T20:49:21Z

@ktecho check out https://stackoverflow.com/questions/18332474/how-to-set-versionname-in-apk-filename-using-gradle

I'll be traveling tomorrow, so if nobody can give a look, I'll take care of it when I'm back after the Baltic Honeybadger

Pushed some changes to the README notes. Nothing major, just some grammar nits. Still great English for a Spaniard :P

No problem. I was in a bit of a hurry because of the travel thing, and then the spaniard thing :)

kaloudis · 2022-08-21T13:31:11Z

build.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+BUILDER_IMAGE="reactnativecommunity/react-native-android:latest"


Final steps, we should lock in a version of the build image instead of latest and see if we can build it deterministically

So docker images aren't binaries - they're not deterministic and the hashes also derive from build time

But the good news is I was able to build the images from scratch and get the same outputs for our builds:

Custom image built from reactnativecommunity/react-native-android v5.4 branch:

******************************** **** APKs and MD5 ******************************** 5b29390ba80b3cec1b6056c01a3ef666 android/app/build/outputs/apk/release/zeus-arm64-v8a.apk 30649c4dd7b5cc3e88c51bc46d657ec9 android/app/build/outputs/apk/release/zeus-armeabi-v7a.apk 582dabb062450c054522e0f397486b8a android/app/build/outputs/apk/release/zeus-universal.apk 2f0da60499591fbdd45633d6cc096bc2 android/app/build/outputs/apk/release/zeus-x86.apk 8e0941f62736a5218552fba52e07bd60 android/app/build/outputs/apk/release/zeus-x86_64.apk

Built with reactnativecommunity/react-native-android:5.4:

******************************** **** APKs and MD5 ******************************** 5b29390ba80b3cec1b6056c01a3ef666 android/app/build/outputs/apk/release/zeus-arm64-v8a.apk 30649c4dd7b5cc3e88c51bc46d657ec9 android/app/build/outputs/apk/release/zeus-armeabi-v7a.apk 582dabb062450c054522e0f397486b8a android/app/build/outputs/apk/release/zeus-universal.apk 2f0da60499591fbdd45633d6cc096bc2 android/app/build/outputs/apk/release/zeus-x86.apk 8e0941f62736a5218552fba52e07bd60 android/app/build/outputs/apk/release/zeus-x86_64.apk

Let's lock in the image here at 5.4 and get this merged in. Will be perfect to use for our v0.6.6 release.

reactnativecommunity/react-native-android:5.4

* OnchainSwippeableRow: fix animation render for receive and send actions depends on supportsCoinControl and not supportsRouting * SwipeableRow: fix animation width for middle action if supported The actual value of 100 does not match with any other width animated value. The value should be 200 because if present, the width of others is 200. * SwipeableRow: add opacity transition for actions Since the routing and coins width animations are correct, the button can appear on the right at the beginning of the swap. Adding opacity transition hide this buttons. * GitHub Actions: add prettier * GitHub Actions: add lint * GitHub Actions: Remove old main workflow * Fix branches * Add checks:write permission * Fix link to 'Zeus over Tor guide for RaspiBolt' * AndroidManifest.xml: Don't make NFC a requirement Existing config leads to Google Play prevented users without NFC from being able to download the app * Update README.md w/ new node solution Add link to Citadel (https://runcitadel.space/) to Full Node Solutions * Add lint workflow * Update prettier workflow * Bug fix: Custom block explorer url force prefixed with https:/ (#1053) * attempted fix of issue 1051 #1051 if a custom instance of mempool.space is used 'block-height' -> 'block' translation will fail! could we hint in the url, that it must happen? * Handle <schema>://<ip>:<port>#mempool.space We can now hint in a custom url to use mempool.space type path convention. Anything behind the first # will get cut off from host, and any other value than mempool.space gets ignored. * Handle <scheme>://<ip>:<port>#mempool.space fix typo: schema -> scheme * Clarifying url host convention hint behavior Translate 'block-height' to 'block' if: a) host is 'mempool.space' b) host is in url form ending in convention hint '#mempool.space' Everything from the first '#' is stripped from host, other convention hints are currently completely ignored * after prettier * UrlUtils.ts: remove inferred type Co-authored-by: Evan Kaloudis <[email protected]> * Update Mortals display (#1058) * Update splash images (#1057) * Android: new splash screen * Update intro splash image * Bump nth-check and react-native-svg Bumps [nth-check](https://github.com/fb55/nth-check) and [react-native-svg](https://github.com/react-native-community/react-native-svg). These dependencies needed to be updated together. Updates `nth-check` from 1.0.2 to 2.1.1 - [Release notes](https://github.com/fb55/nth-check/releases) - [Commits](fb55/nth-check@v1.0.2...v2.1.1) Updates `react-native-svg` from 9.13.6 to 13.0.0 - [Release notes](https://github.com/react-native-community/react-native-svg/releases) - [Commits](software-mansion/react-native-svg@v9.13.6...v13.0.0) --- updated-dependencies: - dependency-name: nth-check dependency-type: indirect - dependency-name: react-native-svg dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * Reproducible builds (#1055) * Simplre reproducible builds * clone the branch you're reproducing * fix branch/tag argument taking + use master as default * be able to execute build.sh more than once * Simplifiying process * Updating rn-nodeify to 10.3.0 to avoid issue * Deleting compile and Dockerfile as they're not used anymore * Updated simplified build script and README file with instructions to build * Simplify / beautify build script * Commenting out the singning process for release in build.gradle * Build and sign every apk * Cut apk location up to current location for easy location of files * Remove signing code * Delete unused variables * Updated instructions * README: update reproducible instructions * build.sh: lock in Docker image version reactnativecommunity/react-native-android:5.4 Co-authored-by: Evan Kaloudis <[email protected]> * Version bump: v0.6.6 (#1060) * package.json: version bump to v0.6.6 * Android: version bump to v0.6.6 * iOS: version bump to v0.6.6 * package-lock.json: update (#1061) * F-Droid: update metadata (#1062) * F-Droid: update metadata * Update featureGraphic * Locales: v0.6.6 (#1063) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Louis Aussedat <[email protected]> Co-authored-by: Andrei <[email protected]> Co-authored-by: sz3k <[email protected]> Co-authored-by: moonsettler <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luis Miguel <[email protected]>

* LNDHub: transactions call fix * Add missing `BITCOIN:` url scheme for iOS * Updated versions in bug template * Taproot: send and receive * Taproot: add new locale strings * Linking fixes * Spark fixes * handle LNURL-auth when node doesn't support it * Lint: Security * Spark: fix address generation * Main pane: fix display of Tor onion * Make sure max parts options only appear for implentations that support MPP/AMP * Version bump: v0.6.5 * Taproot: new style for Address type selection * LND: handle commas when setting channel fees * Make sure Taproot support can be assessed when setting Address types * Remove default LNDHub host * v0.6.5: bump iOS build to 2 * CLN: createInvoice: expiry fix * ErrorUtils: user friendly error messages * Address select modal QA. * Lint fix. * Added quality assurance to PR template * Android: NFC intent * handleAnything: don't throw alert when filling out Send form * Update React: 18.1.0, React Native: 0.68.2 * Remove unused react-native-animated * OpenChannel: Remove private var as it is restricted * OpenChannel: don't announce channels by default * Android: set up NFC app linking * AndroidManifest: Remove redundant NFC config * PaymentRequest: enhance UI * MobileTools: add credit to source * PaymentRequest: clear store values on navigation back * AddEditNode: add Spark QR scanner * Locales: v0.6.5 * bump version to v0.6.5-rc1 * v0.6.5: bump iOS build to 3 * Roll back RN to 0.67.2 * v0.6.5: bump iOS build to 4 * Revert "Roll back RN to 0.67.2" * SparkQRScanner: add React import * v0.6.5: bump iOS build to 5 * CollapsedQR: fix color of icon on Hide/Show button * SparkQRScanner: fix imports to include implementation * Fix typo * Add lndhub.io as the first custodial lndhub It seems that BlueWallet is connecting to lndhub.io by default and by looking at https://lndhub.io and https://lndhub.herokuapp.com it seems these two are using the same backend * About: add new sponsor tiers * Locales: v0.6.5-rc2 * Version bump: v0.6.5-rc2 * Add c-lightning-REST QR scanner * xcodeproj: v0.6.5: bump project version to 7 * Android 12: remove top margin hack * Version bump: v0.6.5-rc3 * Update README.md * OnchainSwippeableRow: fix animation render for receive and send actions depends on supportsCoinControl and not supportsRouting * SwipeableRow: fix animation width for middle action if supported The actual value of 100 does not match with any other width animated value. The value should be 200 because if present, the width of others is 200. * SwipeableRow: add opacity transition for actions Since the routing and coins width animations are correct, the button can appear on the right at the beginning of the swap. Adding opacity transition hide this buttons. * Wallet: only enable event listeners after unlock * Locales: Missing translation labels in Help menu * Locales: v0.6.5-rc4 * Version bump: v0.6.5-rc4 * Version bump: v0.6.5 * GitHub Actions: add prettier * GitHub Actions: add lint * GitHub Actions: Remove old main workflow * Fix branches * Add checks:write permission * Fix link to 'Zeus over Tor guide for RaspiBolt' * AndroidManifest.xml: Don't make NFC a requirement Existing config leads to Google Play prevented users without NFC from being able to download the app * Update README.md w/ new node solution Add link to Citadel (https://runcitadel.space/) to Full Node Solutions * Add lint workflow * Update prettier workflow * Bug fix: Custom block explorer url force prefixed with https:/ (#1053) * attempted fix of issue 1051 #1051 if a custom instance of mempool.space is used 'block-height' -> 'block' translation will fail! could we hint in the url, that it must happen? * Handle <schema>://<ip>:<port>#mempool.space We can now hint in a custom url to use mempool.space type path convention. Anything behind the first # will get cut off from host, and any other value than mempool.space gets ignored. * Handle <scheme>://<ip>:<port>#mempool.space fix typo: schema -> scheme * Clarifying url host convention hint behavior Translate 'block-height' to 'block' if: a) host is 'mempool.space' b) host is in url form ending in convention hint '#mempool.space' Everything from the first '#' is stripped from host, other convention hints are currently completely ignored * after prettier * UrlUtils.ts: remove inferred type Co-authored-by: Evan Kaloudis <[email protected]> * Update Mortals display (#1058) * Update splash images (#1057) * Android: new splash screen * Update intro splash image * Bump nth-check and react-native-svg Bumps [nth-check](https://github.com/fb55/nth-check) and [react-native-svg](https://github.com/react-native-community/react-native-svg). These dependencies needed to be updated together. Updates `nth-check` from 1.0.2 to 2.1.1 - [Release notes](https://github.com/fb55/nth-check/releases) - [Commits](fb55/nth-check@v1.0.2...v2.1.1) Updates `react-native-svg` from 9.13.6 to 13.0.0 - [Release notes](https://github.com/react-native-community/react-native-svg/releases) - [Commits](software-mansion/react-native-svg@v9.13.6...v13.0.0) --- updated-dependencies: - dependency-name: nth-check dependency-type: indirect - dependency-name: react-native-svg dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * Reproducible builds (#1055) * Simplre reproducible builds * clone the branch you're reproducing * fix branch/tag argument taking + use master as default * be able to execute build.sh more than once * Simplifiying process * Updating rn-nodeify to 10.3.0 to avoid issue * Deleting compile and Dockerfile as they're not used anymore * Updated simplified build script and README file with instructions to build * Simplify / beautify build script * Commenting out the singning process for release in build.gradle * Build and sign every apk * Cut apk location up to current location for easy location of files * Remove signing code * Delete unused variables * Updated instructions * README: update reproducible instructions * build.sh: lock in Docker image version reactnativecommunity/react-native-android:5.4 Co-authored-by: Evan Kaloudis <[email protected]> * Version bump: v0.6.6 (#1060) * package.json: version bump to v0.6.6 * Android: version bump to v0.6.6 * iOS: version bump to v0.6.6 * package-lock.json: update (#1061) * F-Droid: update metadata (#1062) * F-Droid: update metadata * Update featureGraphic * Locales: v0.6.6 (#1063) * README: update F-Droid link * Update bug_report.yml Add v0.6.5 + v0.6.6 * remove fallbackResource for react native 0.68 upgrade (#1066) * style pinpad to avoid overlap on smaller screens (#1067) * Sponsors: fix display on iPod Touch (#1070) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: benthecarman <[email protected]> Co-authored-by: bosch <[email protected]> Co-authored-by: bosch <[email protected]> Co-authored-by: Pavol Rusnak <[email protected]> Co-authored-by: Louis Aussedat <[email protected]> Co-authored-by: Andrei <[email protected]> Co-authored-by: sz3k <[email protected]> Co-authored-by: moonsettler <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luis Miguel <[email protected]> Co-authored-by: deregs <[email protected]>

* New default view * Default view: use noUppercase for all buttons * Home: center pin pad * [v0.7.0] update branch (#1074) * LNDHub: transactions call fix * Add missing `BITCOIN:` url scheme for iOS * Updated versions in bug template * Taproot: send and receive * Taproot: add new locale strings * Linking fixes * Spark fixes * handle LNURL-auth when node doesn't support it * Lint: Security * Spark: fix address generation * Main pane: fix display of Tor onion * Make sure max parts options only appear for implentations that support MPP/AMP * Version bump: v0.6.5 * Taproot: new style for Address type selection * LND: handle commas when setting channel fees * Make sure Taproot support can be assessed when setting Address types * Remove default LNDHub host * v0.6.5: bump iOS build to 2 * CLN: createInvoice: expiry fix * ErrorUtils: user friendly error messages * Address select modal QA. * Lint fix. * Added quality assurance to PR template * Android: NFC intent * handleAnything: don't throw alert when filling out Send form * Update React: 18.1.0, React Native: 0.68.2 * Remove unused react-native-animated * OpenChannel: Remove private var as it is restricted * OpenChannel: don't announce channels by default * Android: set up NFC app linking * AndroidManifest: Remove redundant NFC config * PaymentRequest: enhance UI * MobileTools: add credit to source * PaymentRequest: clear store values on navigation back * AddEditNode: add Spark QR scanner * Locales: v0.6.5 * bump version to v0.6.5-rc1 * v0.6.5: bump iOS build to 3 * Roll back RN to 0.67.2 * v0.6.5: bump iOS build to 4 * Revert "Roll back RN to 0.67.2" * SparkQRScanner: add React import * v0.6.5: bump iOS build to 5 * CollapsedQR: fix color of icon on Hide/Show button * SparkQRScanner: fix imports to include implementation * Fix typo * Add lndhub.io as the first custodial lndhub It seems that BlueWallet is connecting to lndhub.io by default and by looking at https://lndhub.io and https://lndhub.herokuapp.com it seems these two are using the same backend * About: add new sponsor tiers * Locales: v0.6.5-rc2 * Version bump: v0.6.5-rc2 * Add c-lightning-REST QR scanner * xcodeproj: v0.6.5: bump project version to 7 * Android 12: remove top margin hack * Version bump: v0.6.5-rc3 * Update README.md * OnchainSwippeableRow: fix animation render for receive and send actions depends on supportsCoinControl and not supportsRouting * SwipeableRow: fix animation width for middle action if supported The actual value of 100 does not match with any other width animated value. The value should be 200 because if present, the width of others is 200. * SwipeableRow: add opacity transition for actions Since the routing and coins width animations are correct, the button can appear on the right at the beginning of the swap. Adding opacity transition hide this buttons. * Wallet: only enable event listeners after unlock * Locales: Missing translation labels in Help menu * Locales: v0.6.5-rc4 * Version bump: v0.6.5-rc4 * Version bump: v0.6.5 * GitHub Actions: add prettier * GitHub Actions: add lint * GitHub Actions: Remove old main workflow * Fix branches * Add checks:write permission * Fix link to 'Zeus over Tor guide for RaspiBolt' * AndroidManifest.xml: Don't make NFC a requirement Existing config leads to Google Play prevented users without NFC from being able to download the app * Update README.md w/ new node solution Add link to Citadel (https://runcitadel.space/) to Full Node Solutions * Add lint workflow * Update prettier workflow * Bug fix: Custom block explorer url force prefixed with https:/ (#1053) * attempted fix of issue 1051 #1051 if a custom instance of mempool.space is used 'block-height' -> 'block' translation will fail! could we hint in the url, that it must happen? * Handle <schema>://<ip>:<port>#mempool.space We can now hint in a custom url to use mempool.space type path convention. Anything behind the first # will get cut off from host, and any other value than mempool.space gets ignored. * Handle <scheme>://<ip>:<port>#mempool.space fix typo: schema -> scheme * Clarifying url host convention hint behavior Translate 'block-height' to 'block' if: a) host is 'mempool.space' b) host is in url form ending in convention hint '#mempool.space' Everything from the first '#' is stripped from host, other convention hints are currently completely ignored * after prettier * UrlUtils.ts: remove inferred type Co-authored-by: Evan Kaloudis <[email protected]> * Update Mortals display (#1058) * Update splash images (#1057) * Android: new splash screen * Update intro splash image * Bump nth-check and react-native-svg Bumps [nth-check](https://github.com/fb55/nth-check) and [react-native-svg](https://github.com/react-native-community/react-native-svg). These dependencies needed to be updated together. Updates `nth-check` from 1.0.2 to 2.1.1 - [Release notes](https://github.com/fb55/nth-check/releases) - [Commits](fb55/nth-check@v1.0.2...v2.1.1) Updates `react-native-svg` from 9.13.6 to 13.0.0 - [Release notes](https://github.com/react-native-community/react-native-svg/releases) - [Commits](software-mansion/react-native-svg@v9.13.6...v13.0.0) --- updated-dependencies: - dependency-name: nth-check dependency-type: indirect - dependency-name: react-native-svg dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * Reproducible builds (#1055) * Simplre reproducible builds * clone the branch you're reproducing * fix branch/tag argument taking + use master as default * be able to execute build.sh more than once * Simplifiying process * Updating rn-nodeify to 10.3.0 to avoid issue * Deleting compile and Dockerfile as they're not used anymore * Updated simplified build script and README file with instructions to build * Simplify / beautify build script * Commenting out the singning process for release in build.gradle * Build and sign every apk * Cut apk location up to current location for easy location of files * Remove signing code * Delete unused variables * Updated instructions * README: update reproducible instructions * build.sh: lock in Docker image version reactnativecommunity/react-native-android:5.4 Co-authored-by: Evan Kaloudis <[email protected]> * Version bump: v0.6.6 (#1060) * package.json: version bump to v0.6.6 * Android: version bump to v0.6.6 * iOS: version bump to v0.6.6 * package-lock.json: update (#1061) * F-Droid: update metadata (#1062) * F-Droid: update metadata * Update featureGraphic * Locales: v0.6.6 (#1063) * README: update F-Droid link * Update bug_report.yml Add v0.6.5 + v0.6.6 * remove fallbackResource for react native 0.68 upgrade (#1066) * style pinpad to avoid overlap on smaller screens (#1067) * Sponsors: fix display on iPod Touch (#1070) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: benthecarman <[email protected]> Co-authored-by: bosch <[email protected]> Co-authored-by: bosch <[email protected]> Co-authored-by: Pavol Rusnak <[email protected]> Co-authored-by: Louis Aussedat <[email protected]> Co-authored-by: Andrei <[email protected]> Co-authored-by: sz3k <[email protected]> Co-authored-by: moonsettler <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luis Miguel <[email protected]> Co-authored-by: deregs <[email protected]> * Fix styling for lower resolution devices * DefaultPane: clear amount on unit change * DefaultPane: limit decimal places based on units + add shake animation * DefaultPane: add text color animation Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: benthecarman <[email protected]> Co-authored-by: bosch <[email protected]> Co-authored-by: bosch <[email protected]> Co-authored-by: Pavol Rusnak <[email protected]> Co-authored-by: Louis Aussedat <[email protected]> Co-authored-by: Andrei <[email protected]> Co-authored-by: sz3k <[email protected]> Co-authored-by: moonsettler <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Luis Miguel <[email protected]> Co-authored-by: deregs <[email protected]>

kaloudis · 2022-10-11T07:23:29Z

It probably needs a signature Aug 14, 2022, 11:12 by ***@***.***:

…

@kaloudis <https://github.com/kaloudis>> I just tried installing the apk in my smartphone and it says that the package is not valid, so it seems that more tests will be needed... — Reply to this email directly, > view it on GitHub <#1055 (comment)>> , or > unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOKUXNRR4BB3HN7SATOWPTVZEEFBANCNFSM556ZMBKA>> . You are receiving this because you were mentioned.> Message ID: > <ZeusLN/zeus/pull/1055/c1214398477> @> github> .> com>

Simplre reproducible builds

789510f

kaloudis reviewed Aug 10, 2022

View reviewed changes

Dockerfile Outdated Show resolved Hide resolved

ktecho added 3 commits August 10, 2022 11:52

clone the branch you're reproducing

85316b7

fix branch/tag argument taking + use master as default

c19b6c9

be able to execute build.sh more than once

a551eed

emanuelb mentioned this pull request Aug 11, 2022

APK is not reproducible #898

Closed

Simplifiying process

d6cf6a1

Updating rn-nodeify to 10.3.0 to avoid issue

5f48925

ktecho added 2 commits August 14, 2022 10:15

Deleting compile and Dockerfile as they're not used anymore

e4681cf

Updated simplified build script and README file with instructions to …

754d2c4

…build

Simplify / beautify build script

f4029cf

Commenting out the singning process for release in build.gradle

afd1231

ktecho added 2 commits August 16, 2022 17:23

Build and sign every apk

4d2d497

Cut apk location up to current location for easy location of files

a757741

Remove signing code

b2af296

kaloudis reviewed Aug 20, 2022

View reviewed changes

build.sh Outdated Show resolved Hide resolved

Delete unused variables

6a453f4

Updated instructions

69220ce

README: update reproducible instructions

7c43d0d

kaloudis reviewed Aug 21, 2022

View reviewed changes

kaloudis mentioned this pull request Aug 22, 2022

WIP: Reproducible Builds #535

Closed

build.sh: lock in Docker image version

347fa29

reactnativecommunity/react-native-android:5.4

kaloudis changed the title ~~WIP: Simple reproducible builds~~ Reproducible builds Aug 24, 2022

kaloudis merged commit 924f424 into ZeusLN:master Aug 24, 2022

TonyGiorgio mentioned this pull request Aug 28, 2022

Reproducible Builds BitcoinDevShop/pln#74

Open


		docker build . -t zeus_builder_image

		docker run --name zeus_builder_container -v `pwd`:$ZEUS_PATH zeus_builder_image bash -c \

		@@ -0,0 +1,20 @@
		#!/bin/bash
		BUILDER_IMAGE="reactnativecommunity/react-native-android:latest"

Reproducible builds #1055

Reproducible builds #1055

Conversation

ktecho commented Aug 8, 2022

kaloudis commented Aug 9, 2022

kaloudis Aug 10, 2022

Choose a reason for hiding this comment

kaloudis Aug 10, 2022

Choose a reason for hiding this comment

kaloudis Aug 10, 2022

Choose a reason for hiding this comment

ktecho commented Aug 10, 2022 • edited Loading

kaloudis commented Aug 11, 2022

ktecho commented Aug 12, 2022

emanuelb commented Aug 13, 2022 • edited Loading

ktecho commented Aug 13, 2022

ktecho commented Aug 13, 2022

ktecho commented Aug 13, 2022

kaloudis commented Aug 13, 2022

kaloudis commented Aug 14, 2022

ktecho commented Aug 14, 2022

ktecho commented Aug 14, 2022 • edited Loading

ktecho commented Aug 14, 2022 • edited Loading

kaloudis commented Aug 14, 2022

kaloudis commented Aug 14, 2022

kaloudis commented Aug 14, 2022

ktecho commented Aug 14, 2022

kaloudis commented Aug 15, 2022

ktecho commented Aug 15, 2022

ktecho commented Aug 16, 2022

kaloudis commented Aug 16, 2022

ktecho commented Aug 16, 2022

kaloudis commented Aug 16, 2022

ktecho commented Aug 20, 2022

kaloudis commented Aug 20, 2022

ktecho commented Aug 20, 2022

ktecho commented Aug 20, 2022 • edited Loading

kaloudis commented Aug 20, 2022

kaloudis commented Aug 20, 2022

ktecho commented Aug 20, 2022

kaloudis Aug 21, 2022

Choose a reason for hiding this comment

kaloudis Aug 24, 2022 • edited Loading

Choose a reason for hiding this comment

kaloudis commented Oct 11, 2022 via email

ktecho commented Aug 10, 2022 •

edited

Loading

emanuelb commented Aug 13, 2022 •

edited

Loading

ktecho commented Aug 14, 2022 •

edited

Loading

ktecho commented Aug 14, 2022 •

edited

Loading

ktecho commented Aug 20, 2022 •

edited

Loading

kaloudis Aug 24, 2022 •

edited

Loading