Reproducible Tor Browser for Android builds
Make sure the apks builds are reproducable.
Activity
added TorBrowserTeam201812R in Legacy / Trac component::applications/tor browser in Legacy / Trac owner::tbb-team in Legacy / Trac priority::very high in Legacy / Trac resolution::fixed in Legacy / Trac severity::normal in Legacy / Trac sponsor::8 in Legacy / Trac status::closed in Legacy / Trac tbb-mobile in Legacy / Trac type::enhancement in Legacy / Trac labels
Moving these to legacy/trac#5709 (moved), these aren't blockers anymore. We'll merge Orfox patches first, then audit everything as we move to m-c and work on TBA. (We should create more tickets as we find more items that need investigating/fixing)
Trac:
Parent: legacy/trac#19675 (moved) to legacy/trac#5709 (moved)
Trac:
Parent: legacy/trac#5709 (moved) to legacy/trac#26693 (moved)I've implemented building an Android apk with RBM at: https://github.com/sisbell/tor-browser-build/tree/android
I'll open a git project at torproject and import it over for further review and cleanup.
-
Replying to sisbell:
I've implemented building an Android apk with RBM at: https://github.com/sisbell/tor-browser-build/tree/android
This is good work. Thanks!
Here are a few quick comments:
- the main ticket for integrating the android build into tor-browser-build is not legacy/trac#25164 (moved) but legacy/trac#26693 (moved). This one is only for the reproducible part of it (checking that multiple builds on multiple machines create the same build).
- In the commit subject you should use
Bug XXXX:(even if the ticket is of typeenhancement). - to make it easier to review, you should split the commits in different commits. I think one for adding stretch to debootstrap-image, for adding android-toolchain, for adding the new platform definition to rbm.conf, for fixing the rust build, for fixing the firefox build.
- should we call the target in rbm.conf
torbrowser-android-armv7instead of justtorbrowser-android? -
var/compilershould be set toandroid-toolchaininstead ofgcc. -
ndk.zipshould be included inandroid-toolchainso that is not needed to download it fromprojects/firefox/config.
Apks from two builds are different, even building on same laptop. This is due to some differences in the classes.dex file.
When I do a dexdump of two different dex files, the dexdumps are exactly the same.
When I decompile and recompile the classes.dex file from two different builds, the resulting classes.dex are exactly the same.
This leads me to believe that the differences in the classes.dex file are only cosmetic (padding differences?)
I will need to build a quick program to output exactly what part of the dex file format is different and then go from there.
I've published first version of tool to help identify differences that we are seeing in the Android dex files.
The outputs will give us enough information to start drilling down when we need to. I'm going to pause further work for now and move on to other tickets.
