Release APK not fully reproducible: license metadata line endings + aboutlibraries index differ (v1.2.0 github flavor)

[kurt-croix]

Summary: Third-party unsigned rebuild of the v1.2.0 GitHub-flavor release APK (KeyGo-v1.2.0-github_with_exclusive_updater.apk, sha256 0f3b07953021a5966688d6b4d77a530f872ec4b6e69bce1e625b66fb735bb767) from the v1.2.0 tag produces a near-identical APK: classes.dex and all code resources are byte-identical.

Remaining diffs (3 files of 1204 common ZIP entries):

• assets/30k.txt and res/7Y (Apache license text): CRLF vs LF line endings — official build has CRLF, ours LF (or vice versa); line sets identical after normalization
• res/7Y/res/Hz (aboutlibraries artifacts): size:offset columns differ; official also includes a keemobile/kotpass license entry absent in our build

Environment: OpenJDK 21.0.2, Android SDK, ./gradlew assembleGithubRelease, Linux. Repo CI builds with JDK 22 per .github/workflows/android-release.yml.

Hypotheses: line-ending normalization differs by OS/git config (maintainer macOS vs our Linux), and aboutlibraries index generation ordering/environment.

Suggestion: pin license generation (e.g. commit generated files, or normalize line endings + sort deterministically) to make the release APK fully third-party reproducible. Happy to provide full diff details.

[OffRange]

Thanks for the detailed report. I was able to track down the root causes for all three diffs.

Line endings (assets/30k.txt, res/7Y)

Version 1.2.0 was built locally on a Windows machine. Git converted 30k.txt to CRLF on checkout, and the build included that converted file. Similarly, oss-licenses-plugin used the Windows System.getProperty("line.separator") to generate res/7Y and res/Hz.

The missing keemobile/kotpass entry

This is due to JitPack mutating artifacts. The plugin reads licenses directly from POMs. JitPack regenerated the kotpass POM without its <licenses> block at some point after my local build cache was populated.

(A quick correction: v1 used oss-licenses-plugin, not AboutLibraries. Dropping kotpass simply removes one line from the deduplicated offset table in res/Hz.)

Where this leaves things

Version 1 is deprecated, and Version 2 resolves most of this automatically: it ships no text assets, drops the license plugin, and distributes via Play Store AABs instead of direct APKs.

However, I am considering taking two actions based on your report:

1. Adding a .gitattributes file to pin * text eol=lf.
2. Investigating JitPack POM metadata issues in v2, as the same missing license issue is visible there. (v2's AboutLibraries seems to include the libs from JitPack, just with no license information)

If I resume publishing direct APKs, the next reproducibility step will be the Rust library. I plan to pin the NDK and apply other build configurations to ensure the compiled library is fully reproducible. Currently for F-Droid, the plan is to let them build everything from source (if that works with regard to the upcoming Goolge Restrictions, otherwise it is necessary to make the Rust library reproducible).

Let me know what you think about this. Thanks again for the great work!