Reproducible Builds

[xrviv]

Greetings,

I'm Danny and I am writing for WalletScrutiny.com. I would like to request for instructions on how to build your app via a Docker container. I saw that you have an F-Droid entry, and would love to test this out.

Kind Regards,

[xrviv]

Hello.

[xrviv]

I tried again to build your app from source, and this is the result:

Use a bare Ubuntu docker container

# Use the official Ubuntu base image
FROM ubuntu:20.04

# Prevent interactive prompts during package installation
ENV DEBIAN_FRONTEND=noninteractive

# Update package list and install basic tools
RUN apt-get update && apt-get install -y \
    curl \
    wget \
    unzip \
    git \
    vim \
    sudo

# Clean up
RUN apt-get clean && rm -rf /var/lib/apt/lists/*

# Set working directory
WORKDIR /root

Then run

docker run -it --name swissbitcoinpay-setup ubuntu-bare /bin/bash

Restarting and Reconfiguring the Container

Start a new container from your base Ubuntu image:

docker run -it --name swissbitcoinpay-setup ubuntu-bare /bin/bash

Reinstall the necessary dependencies within the container:

Update package list and install basic tools

apt-get update && apt-get install -y \
    curl \
    wget \
    unzip \
    git \
    vim \
    sudo

Install Node.js and npm

curl -sL https://deb.nodesource.com/setup_18.x | sudo -E bash -
sudo apt-get install -y nodejs

Install Yarn

npm install -g yarn

Install React Native CLI

npm install -g react-native-cli

Install JDK

apt-get install -y openjdk-17-jdk

Set JAVA_HOME

export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
export PATH=$JAVA_HOME/bin:$PATH

Download and unzip the Android SDK command-line tools

wget https://dl.google.com/android/repository/commandlinetools-linux-8092744_latest.zip -O android-sdk.zip
mkdir -p /usr/lib/android-sdk/cmdline-tools
unzip android-sdk.zip -d /usr/lib/android-sdk/cmdline-tools
mv /usr/lib/android-sdk/cmdline-tools/cmdline-tools /usr/lib/android-sdk/cmdline-tools/latest
rm android-sdk.zip

Set environment variables and update PATH

export ANDROID_HOME=/usr/lib/android-sdk
export PATH=$PATH:$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools

Install the Android SDK packages

yes | sdkmanager --licenses
sdkmanager "platforms;android-33" "build-tools;33.0.2"

Clone the project repository and install project dependencies:

git clone https://github.com/SwissBitcoinPay/app /root/swissbitcoinpay
cd /root/swissbitcoinpay
yarn install

Build the APK:

cd android
./gradlew assembleRelease

Results (The tail end)

> Task :app:stripReleaseDebugSymbols
Unable to strip the following libraries, packaging them as they are: libconceal.so.

> Task :react-native-vision-camera:compileReleaseKotlin
w: file:///root/swissbitcoinpay/node_modules/react-native-vision-camera/android/src/main/java/com/mrousavy/camera/core/utils/CamcorderProfileUtils.kt:66:42 'get(Int, Int): CamcorderProfile!' is deprecated. Deprecated in Java
w: file:///root/swissbitcoinpay/node_modules/react-native-vision-camera/android/src/main/java/com/mrousavy/camera/core/utils/CamcorderProfileUtils.kt:90:42 'get(Int, Int): CamcorderProfile!' is deprecated. Deprecated in Java
w: file:///root/swissbitcoinpay/node_modules/react-native-vision-camera/android/src/main/java/com/mrousavy/camera/react/CameraViewModule.kt:13:46 'ReactModule' is deprecated. Deprecated in Java
w: file:///root/swissbitcoinpay/node_modules/react-native-vision-camera/android/src/main/java/com/mrousavy/camera/react/CameraViewModule.kt:37:2 'ReactModule' is deprecated. Deprecated in Java

> Task :react-native-barcode-zxing-scan:verifyReleaseResources FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':react-native-barcode-zxing-scan:verifyReleaseResources'.
> A failure occurred while executing com.android.build.gradle.tasks.VerifyLibraryResourcesTask$Action
   > Android resource linking failed
     ERROR: /root/swissbitcoinpay/node_modules/react-native-barcode-zxing-scan/android/build/intermediates/merged_res/release/values/values.xml:2759: AAPT: error: resource android:attr/lStar not found.
         

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.

Deprecated Gradle features were used in this build, making it incompatible with Gradle 9.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

For more on this, please refer to https://docs.gradle.org/8.3/userguide/command_line_interface.html#sec:command_line_warnings in the Gradle documentation.

BUILD FAILED in 1m 46s
842 actionable tasks: 681 executed, 161 up-to-date

[SwissBitcoinPay]

Hello @xrviv, and sorry for the long delay!

We have just added a convenient Dockerfile in the repo, just can reproduce an Android build by simply running:

docker build -t sbp-builder . -o sbp-output
(requires around 8.12 GB of storage)

sbp-output is the name of your folder where the built apk will be put

Please note that this Dockerfile generate a release build, with a new keystore generated on each build. Therefore, direct updates are not possible. (you need to uninstall the app and install it again).

Please reopen an issue if you face errors or have any other questions, and feel free to purpose a PR to improve the system.

[xrviv]

Thank you. Now testing.

-- @SwissBitcoinPay The build came out:

danny@lw10:~/work/builds/ch.swissbitcoinpay.checkout/380/build$ aapt dump badging app-release.apk | grep version*
package: name='ch.swissbitcoinpay.checkout' versionCode='380' versionName='2.1.1' compileSdkVersion='34' compileSdkVersionCodename='14'
danny@lw10:~/work/builds/ch.swissbitcoinpay.checkout/380/build$ aapt dump badging ../official/*.apk | grep version*
package: name='ch.swissbitcoinpay.checkout' versionCode='380' versionName='2.1.0' compileSdkVersion='34' compileSdkVersionCodename='14'

2.1.0 is the apk we took from our phone.

~ ### Edit: The asciicast of the build

https://asciinema.org/a/672635

• Edit 2: Since the the built artifact and the official differ in version names, the huge diff is expected.

diff-build-official.txt

I think, I will wait until the official release is updated in Google Play.

Second item: Swissbitcoin Pay also seems to be built using AABs, which means split apks. I will try to work it out if the Dockerfile can address this.