PlayStore app is not verifiable. reproducible/deterministic build for Android

[Giszmo]

At the time of writing this article we were not able to verify the build on GooglePlay to match the published code.

I know there is no claim otherwise but this is a huge security issue and should be given priority as it also means that even the other team members cannot verify what the release manager is doing and he might be in distress ...

[SomberNight]

Yes, indeed, reproducible builds would be highly desired for all platforms.

Unfortunately, I expect it would be difficult to accomplish with the toolchain we use. (python-for-android / buildozer)
I guess a good first step would be to try to find another project that uses the same toolchain and has succeeded in reproducibility. I don't know of any... :/

Like it says in the relevant README, help would be welcome, as we are already stretched thin as-is.

[Giszmo]

A good start would be to make it build without release key at all. For my project I allow certain diffs. If file timestamps differ, it's ok and probably will stay ok forever. If PNGs remain being PNGs with same size but some bits flipped, that's ok. If I can read the diff to not be an exploit, it's kind of ok for now.

The above criteria are the basic requirements for team members to approve an APK. If the wallet does not comply with those, I have to assume that a gun to the release manager's head might be worth millions of dollars and that is not ok.

[Giszmo]

How is progress on this? 3.5 months passed ...

[SomberNight]

Unless someone steps up to work on this, it will not happen in the near term.
The priority now is Lightning.

We know that reproducibility is very important. It is. However, resources are limited, and for keeping the project alive long term, Lightning is even more important.

[Giszmo]

Lightning works now I heard?

[SomberNight]

promising developments on the kivy side: kivy/python-for-android#2390

[SomberNight]

Now with #7263 merged, the next release (4.1.3) should be reproducible.

EDIT: I'll try to remember to add another comment here when that is released.

[SomberNight]

4.1.3 is out and ThomasV and I have managed to build "matching" binaries (according to apkdiff.py) :)
Right now, the apks are only on the website; hopefully they are soon available on the Google Play Store too ("under review" there atm).

[Giszmo]

Thanks guys! Can confirm that 4.1.4 is reproducible and updated the listing accordingly. I mentioned some details but overall it's usable as is.