Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

manually use aapt singleCrunch for reproducible builds #252

Merged
merged 1 commit into from Oct 7, 2019
Merged

manually use aapt singleCrunch for reproducible builds #252

merged 1 commit into from Oct 7, 2019

Conversation

Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants
@eighthave @n8fr8
@eighthave
Copy link
Member

@eighthave eighthave commented Sep 5, 2019

PNG crunching is not a deterministic process, especially the way aapt does it. This makes the builds not reproducible. The easy solution to this is to pre-crunch the PNGs and commit them to git. This also uses exiftool to strip any metadata from the PNG. This then disables running the crunch as part of the gradle build process.

https://medium.com/@duhroach/smaller-pngs-and-android-s-aapt-tool-4ce38a24019d
@eighthave
manually use `aapt singleCrunch` for reproducible builds
30cdfa9 
PNG crunching is not a deterministic process, especially the way aapt does
it.  This makes the builds not reproducible.  The easy solution to this is
to pre-crunch the PNGs and commit them to git.  This also uses exiftool to
strip any metadata from the PNG.  This then disables running the crunch as
part of the gradle build process.

https://medium.com/@duhroach/smaller-pngs-and-android-s-aapt-tool-4ce38a24019d
@eighthave
Copy link
Member Author

@eighthave eighthave commented Sep 5, 2019

submitted here also https://trac.torproject.org/projects/tor/ticket/31650

@eighthave
Copy link
Member Author

@eighthave eighthave commented Sep 10, 2019

The PNG changes should be quite low risk, I've run this process on a bunch of apps already with no troubles so far. It does also disable aapt crunching in build.gradle, that's been safe so far in my experience on the apps where I've added that.

@n8fr8 n8fr8 merged commit 4d4020a into guardianproject:master Oct 7, 2019
@eighthave eighthave deleted the png-repro-build branch Oct 7, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment