[Help wanted] How to create a reproducible build (FairEmail)

@Licaon_Kter

`* What went wrong:
Execution failed for task ‘:app:stripFullReleaseDebugSymbols’.

Requested NDK version 21.0.6113669 did not match the version 12.1.2977051 requested by ndk.dir at /home/vagrant/android-ndk/r12b

  • Try:
    Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

  • Get more help at https://help.gradle.org

BUILD FAILED in 1m 34s`

https://f-droid.org/wiki/page/eu.faircode.email/lastbuild_993

Using NDK 12 while I use NDK 21 will likely not result in a reproducible build …

Also, NDK 12 is very old (June 2016) and should really not be used anymore.

I have tried to figure this out on my own, but I have zero experience with reproducible builds, so I need help on this. What should I as developer do to make this happen?

first, find the diffs between builds. diffoscope is the tool for
that. You can just run the build twice on your own machine to start
with. Then take it from there.

I understand what you say, but:

  • diffoscope on F-Droid seems to be broken (see earlier)
  • diffoscope crashed on my device
  • There was no result on diffoscope.org because it took to long
  • I have no suitable hardware to install an F-Droid build environment

IMHO it should just work if the build environments are aligned. I will make the necessary changes in the gradle scripts, but I need to know what to change.

tl;dr; I can’t do this alone.

1 Like

Yeah, saw the log, will check asap.

Opps, my bad, I’ve pushed the updated metadata without the ndk line commit, it’s fixed now :neutral_face:

1 Like

Reproducible builds are not easy anywhere, as you’ve already seen. To make it a thing, we need people like you to work through these difficulties. I don’t know of a better tool than diffoscope for this. They do welcome bug reports and are responsive, so please do report troubles to their issue tracker.

1 Like

I prefer to put time into actual development, so I am not going to pursue this any further. If F-Droid want reproducible builds, F-Droid should put effort into this IMHO, not developers.

1 Like

We have put a ton of effort into reproducible builds, and it will only happen if more people get involved. Sorry I don’t have clear answers, but they don’t yet exist. So its great that you dove in as much as you did, it would be quite helpful if you could post your experience to the various related bug trackers. For example, here are the diffoscope issues: https://bugs.debian.org/diffoscope, search for “apk” on that page and you’ll find relevant issues that you could post to.

The good news is that @bubu got some grant funding to work on reproducible builds, so we should see improvements this year.

1 Like

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

I contacted @M66B (the developer of FairEmail) regarding this and got an answer:

I asked F-Droid already quite some time ago in an issue what they need for a reproducible build, but they didn’t give an answer.

tl;dr; you need to contact F-Droid about this. In any case, I am happy to make this happy, and if that’s needed, I’ll make changes in the build scripts.

Could someone from the F-Droid team help make this happen?

We’re 2 years later and >200 reproducible apps, we’ve learned a lot and tooling has been fixed too.

I’ll retry to see at least what sources of non-determinism there still are present.

2 Likes

@M66B while the release template text still says " You might need to expand the Assets section below to download the APK file, which can be installed as an update." you stopped publishing APKs back in Jul '22

Can you publish one for the fdroid flavor for the next release so we can diff?

@Licaon_Kter I’ve never stopped publishing APK files, so I don’t understand your remark. Check here:

I can’t build the F-Droid version because I don’t have the signing key. I can build an F-Droid version signed with my key for you if you wish, just contact me, but to prevent confusion, I don’t want to make it public.

1 Like

wat? Release 1.2113 Vallibonavenatrix · M66B/FairEmail · GitHub :slight_smile: and I’ve gone page by page until July 2022, all these releases between 1.1940 and 1.2113 do not have APKs attached. Either that or Github is hiding them from me specifically :person_shrugging:

I said “gradle flavor” not “F-Droid version” yes :stuck_out_tongue_winking_eye:

You can PM me the APK here :slight_smile:

1 Like

I think @M66B removes outdated apk files and only provides the apk for the latest release. (Just a guess.)

1 Like

This is correct, only the latest version is supported, and available for download.
I’ve wasted enough time because people were using old versions with known bugs.

that’s good, but (when repro is ready :slight_smile:) we’d need for it to be available a bit longer so F-Droid can build and download it to verify

I hope you are aware that the GitHub and FDroid version are not the same.