Reproducibility issue

[keraliss]

Hi, keraliss from walletscrutiny here! i was trying to do a reproducibility test on your wallet. i was successfully able to build the wallet, but found some diff in the built apk and the downloaded official one. here is the list of diff -

Total differences (excluding META-INF signing): 1358
  - png/xml files (excluded from verdict):      1324
  - other files (used for verdict):             34

Significant differences:
Files /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/AndroidManifest.xml and /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/built_unzipped/AndroidManifest.xml differ
Files /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/assets/dexopt/baseline.prof and /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/built_unzipped/assets/dexopt/baseline.prof differ
Files /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/classes2.dex and /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/built_unzipped/classes2.dex differ
Files /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/classes3.dex and /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/built_unzipped/classes3.dex differ
Files /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/classes.dex and /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/built_unzipped/classes.dex differ
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/built_unzipped: lib
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/META-INF: app_googleRelease.kotlin_module
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/built_unzipped/META-INF: app_universalRelease.kotlin_module
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: anim
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: animator
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: anim-v21
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: drawable
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: drawable-v21
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: drawable-v23
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: drawable-v31
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: drawable-watch-v20
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: interpolator
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: layout
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: layout-v26
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: layout-v31
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: layout-v33
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: layout-watch-v20
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: mipmap-anydpi-v26
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: mipmap-anydpi-v33
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: mipmap-hdpi-v4
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: mipmap-mdpi-v4
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: mipmap-xhdpi-v4
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: mipmap-xxhdpi-v4
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: mipmap-xxxhdpi-v4
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/built_unzipped/res: QC.webp
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: xml
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/res: xml-v35
Files /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped/resources.arsc and /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/built_unzipped/resources.arsc differ
Only in /home/keraliss/ws_build/gem/gem-android-work_1.3.97_universal/official_unzipped: stamp-cert-sha256

would be great if you guys can look into it and resolve the issue. you can see the test details and my detailed review here - https://walletscrutiny.com/android/com.gemwallet.android/

[0xh3rman]

Hey @keraliss, thanks for the test, I hope you have read https://github.com/gemwalletcom/gem-android/tree/main/reproducible, we documented the process verifying it too

Regarding raised issues in the report:

1. GitHub Token requirement: this is because one of our dependency wallet core only officially hosted on GPR, we had problem to publish to F droid (similar issue: Sign the maven build artifacts trustwallet/wallet-core#4614), we have published our core lib to maven: https://central.sonatype.com/artifact/com.gemwallet.gemstone/gemstone and I hope they can do the same
2. Build flavor: Did you test build against Google Play? we need to verify universal builds on https://gemwallet.com/ or https://github.com/gemwalletcom/gem-android/releases/tag/1.3.97 for now
3. Because we have R8 enabled and pretty new Android toolchain (gradle, AGP), this is kinda like the known issue it's non deterministic and we have to patch the R8 id in our script.

We're trying hard to be reproducible without sacrificing development velocity.