[GH-ISSUE #185] Reproducible builds

bsakaguchi commented

2026-10-29 12:16:39 +00:00

Owner

Originally created by @IzzySoft on GitHub (May 6, 2025).
Original GitHub issue: https://github.com/cylonid/NativeAlphaForAndroid/issues/185

Continuing from https://gitlab.com/IzzyOnDroid/repo/-/issues/160 as discussed:

We still cannot reproduce the builds – neither using JDK 17 nor 21. Here are the diffs: diff_jdk17.zip & diff_jdk21.zip

Differences are in classes.dex. Using JDK 21, the diff seems to indicate our build has additional annotations – which usually means "the other APK" was built with JDK 17 (it's quite typical that 21 has additional annotations). However, using JDK 17 we have a lot of "identical differences" in com/cylonid/nativealpha/__WebViewActivity, mostly addresses not matching. This could mean a "flaky" (aka "non-deterministic) build – or a "dirty build" on your end (i.e. the APK not being built from a clean tree: local changes or, more likely from how the diff looks, artifacts remaining from a previous build).

So first questions would be:

which JDK are you using?
did you run clean before you built your APK?

We tried last with v1.5.1, and that's where above diffs come from.

Originally created by @IzzySoft on GitHub (May 6, 2025). Original GitHub issue: https://github.com/cylonid/NativeAlphaForAndroid/issues/185 Continuing from https://gitlab.com/IzzyOnDroid/repo/-/issues/160 as discussed: We still cannot reproduce the builds – neither using JDK 17 nor 21. Here are the diffs: [diff_jdk17.zip](https://github.com/user-attachments/files/20068484/diff_jdk17.zip) & [diff_jdk21.zip](https://github.com/user-attachments/files/20068483/diff_jdk21.zip) Differences are in `classes.dex`. Using JDK 21, the diff seems to indicate our build has additional annotations – which usually means "the other APK" was built with JDK 17 (it's quite typical that 21 has additional annotations). However, using JDK 17 we have a lot of "identical differences" in `com/cylonid/nativealpha/__WebViewActivity`, mostly addresses not matching. This could mean a "flaky" (aka "non-deterministic) build – or a "dirty build" on your end (i.e. the APK not being built from a clean tree: local changes or, more likely from how the diff looks, artifacts remaining from a previous build). So first questions would be: * which JDK are you using? * did you run `clean` before you built your APK? We tried last with v1.5.1, and that's where above diffs come from.

bsakaguchi commented

2026-10-29 12:16:40 +00:00

Author

Owner

@cylonid commented on GitHub (May 8, 2025):

JDK
Oracle OpenJDK 17.0.6 => unlikely to be the culprit.

Cleaning
I did run make clean over the Android Studio UI, but as I read in your wiki that may just not be clean enough 😅

If the build with extended options over commandline does not fix the issue, I have another suspicion, explicitly because __WebViewActivity is involved.

These files are generated on the fly during build by duplicating the existing "WebViewActivity" class file. (see build.gradle:164 et seq.). This is a necessity for the sandbox feature, so multiple (identical except for the name) WebViewActivities can be run in parallel in separate processes. The only other way would be to hardcode multiple identical files (also in AndroidManifest) which I wanted to avoid for obvious reasons.

Imo, this does not necessarily mean it gets flaky (for all my understanding, I would not know why) but it might a clue because it surely is a highly unusual behaviour for an Android build.

@cylonid commented on GitHub (May 8, 2025): **JDK** Oracle OpenJDK 17.0.6 => unlikely to be the culprit. **Cleaning** I did run `make clean` over the Android Studio UI, but as I read [in your wiki](https://gitlab.com/IzzyOnDroid/repo/-/wikis/Reproducible-Builds/RB-Hints-for-Developers) that may just not be clean enough 😅 If the build with extended options over commandline does not fix the issue, I have another suspicion, explicitly because `__WebViewActivity` is involved. These files are generated on the fly during build by duplicating the existing "WebViewActivity" class file. (see [build.gradle:164 et seq.](https://github.com/cylonid/NativeAlphaForAndroid/blob/dev/app/build.gradle)). This is a necessity for the sandbox feature, so multiple (identical except for the name) WebViewActivities can be run in parallel in separate processes. The only other way would be to hardcode multiple identical files (also in _AndroidManifest_) which I wanted to avoid for obvious reasons. Imo, this does not _necessarily_ mean it gets flaky (for all my understanding, I would not know why) but it might a clue because it surely is a highly unusual behaviour for an Android build.

bsakaguchi commented

2026-10-29 12:16:40 +00:00

Author

Owner

@IzzySoft commented on GitHub (May 8, 2025):

Fun fact is that those __WebViewActivity are only with JDK 17. What we could try is that you build an APK with JDK 21, and I check against that, also using JDK 21. You could attach the APK here (just rename it to *.zip so Github accepts it) and name the commit you built from (can be the last tag, as the only thing changed would be the JDK, not the code).

@IzzySoft commented on GitHub (May 8, 2025): Fun fact is that those `__WebViewActivity` are only with JDK 17. What we _could_ try is that you build an APK with JDK 21, and I check against that, also using JDK 21. You could attach the APK here (just rename it to `*.zip` so Github accepts it) and name the commit you built from (can be the last tag, as the only thing changed would be the JDK, not the code).

bsakaguchi commented

2026-10-29 12:16:40 +00:00

Author

Owner

@cylonid commented on GitHub (May 19, 2025):

@IzzySoft I resetted any cache I could find before this build, could you check again for the newest release (still JDK 17)?

If there are still issues I might have to switch to an Ubuntu VM for building...

@cylonid commented on GitHub (May 19, 2025): @IzzySoft I resetted any cache I could find before this build, could you check again for the newest release (still JDK 17)? If there are still issues I might have to switch to an Ubuntu VM for building...

bsakaguchi commented

2026-10-29 12:16:40 +00:00

Author

Owner

@IzzySoft commented on GitHub (May 19, 2025):

Looks like you might need to. This one was clearly built on Windows:

  -rw-r--r--  0.0 unx      120 b-      117 defN 1981-01-01 01:01:02 0d9d4506 META-INF/version-control-info.textproto
- -rw-r--r--  0.0 unx     4584 b-     4584 stor 1981-01-01 01:01:02 9a2d19fb assets/dexopt/baseline.prof
+ -rw-r--r--  0.0 unx     4585 b-     4585 stor 1981-01-01 01:01:02 79ff34f9 assets/dexopt/baseline.prof
  -rw-r--r--  0.0 unx      337 b-      337 stor 1981-01-01 01:01:02 1ba8c0e1 assets/dexopt/baseline.profm
- -rw-r--r--  0.0 unx  9820200 b-  9820200 stor 1981-01-01 01:01:02 580a0b9b classes.dex
+ -rw-r--r--  0.0 unx  9820240 b-  9820240 stor 1981-01-01 01:01:02 138de962 classes.dex
  -rw-r--r--  0.0 unx  4488140 b-  4488140 stor 1981-01-01 01:01:02 5837f86a classes2.dex
  -rw-r--r--  0.0 unx  1480904 b-  1480904 stor 1981-01-01 01:01:02 78e1d852 lib/arm64-v8a/libadblock-client.so
  -rw-r--r--  0.0 unx   822636 b-   822636 stor 1981-01-01 01:01:02 a32ce806 lib/armeabi-v7a/libadblock-client.so
@@ -15,9 +15,9 @@
  -rw-r--r--  0.0 unx      310 b-      212 defN 1981-01-01 01:01:02 b3526137 assets/errorSite/error_en.html
  -rw-r--r--  0.0 unx     8415 b-     8415 stor 1981-01-01 01:01:02 acc39bed assets/logo.png
  -rw-r--r--  0.0 unx     2150 b-      957 defN 1981-01-01 01:01:02 7567eb22 assets/logo.svg
- -rw-r--r--  0.0 unx     3264 b-     1598 defN 1981-01-01 01:01:02 094d6b14 assets/news/latestUpdate_de.html
- -rw-r--r--  0.0 unx     2940 b-     1412 defN 1981-01-01 01:01:02 2f90f906 assets/news/latestUpdate_en.html
- -rw-r--r--  0.0 unx     1801 b-      667 defN 1981-01-01 01:01:02 4a22f286 assets/news/news.css
+ -rw-r--r--  0.0 unx     3200 b-     1591 defN 1981-01-01 01:01:02 1c9c5f52 assets/news/latestUpdate_de.html
+ -rw-r--r--  0.0 unx     2875 b-     1406 defN 1981-01-01 01:01:02 8a591643 assets/news/latestUpdate_en.html
+ -rw-r--r--  0.0 unx     1690 b-      657 defN 1981-01-01 01:01:02 b88cd1f4 assets/news/news.css
  -rw----     2.4 fat     1733 b-      780 defN 1981-01-01 01:01:02 5b5d6064 DebugProbesKt.bin

The differences in asset/news/* we can most likely fix on our end if needed (Windows line endings). But the classes.dex rather not…

diff.zip

@IzzySoft commented on GitHub (May 19, 2025): Looks like you might need to. This one was clearly built on Windows: ```diff -rw-r--r-- 0.0 unx 120 b- 117 defN 1981-01-01 01:01:02 0d9d4506 META-INF/version-control-info.textproto - -rw-r--r-- 0.0 unx 4584 b- 4584 stor 1981-01-01 01:01:02 9a2d19fb assets/dexopt/baseline.prof + -rw-r--r-- 0.0 unx 4585 b- 4585 stor 1981-01-01 01:01:02 79ff34f9 assets/dexopt/baseline.prof -rw-r--r-- 0.0 unx 337 b- 337 stor 1981-01-01 01:01:02 1ba8c0e1 assets/dexopt/baseline.profm - -rw-r--r-- 0.0 unx 9820200 b- 9820200 stor 1981-01-01 01:01:02 580a0b9b classes.dex + -rw-r--r-- 0.0 unx 9820240 b- 9820240 stor 1981-01-01 01:01:02 138de962 classes.dex -rw-r--r-- 0.0 unx 4488140 b- 4488140 stor 1981-01-01 01:01:02 5837f86a classes2.dex -rw-r--r-- 0.0 unx 1480904 b- 1480904 stor 1981-01-01 01:01:02 78e1d852 lib/arm64-v8a/libadblock-client.so -rw-r--r-- 0.0 unx 822636 b- 822636 stor 1981-01-01 01:01:02 a32ce806 lib/armeabi-v7a/libadblock-client.so @@ -15,9 +15,9 @@ -rw-r--r-- 0.0 unx 310 b- 212 defN 1981-01-01 01:01:02 b3526137 assets/errorSite/error_en.html -rw-r--r-- 0.0 unx 8415 b- 8415 stor 1981-01-01 01:01:02 acc39bed assets/logo.png -rw-r--r-- 0.0 unx 2150 b- 957 defN 1981-01-01 01:01:02 7567eb22 assets/logo.svg - -rw-r--r-- 0.0 unx 3264 b- 1598 defN 1981-01-01 01:01:02 094d6b14 assets/news/latestUpdate_de.html - -rw-r--r-- 0.0 unx 2940 b- 1412 defN 1981-01-01 01:01:02 2f90f906 assets/news/latestUpdate_en.html - -rw-r--r-- 0.0 unx 1801 b- 667 defN 1981-01-01 01:01:02 4a22f286 assets/news/news.css + -rw-r--r-- 0.0 unx 3200 b- 1591 defN 1981-01-01 01:01:02 1c9c5f52 assets/news/latestUpdate_de.html + -rw-r--r-- 0.0 unx 2875 b- 1406 defN 1981-01-01 01:01:02 8a591643 assets/news/latestUpdate_en.html + -rw-r--r-- 0.0 unx 1690 b- 657 defN 1981-01-01 01:01:02 b88cd1f4 assets/news/news.css -rw---- 2.4 fat 1733 b- 780 defN 1981-01-01 01:01:02 5b5d6064 DebugProbesKt.bin ``` The differences in `asset/news/*` we can most likely fix on our end if needed (Windows line endings). But the `classes.dex` rather not… [diff.zip](https://github.com/user-attachments/files/20303460/diff.zip)

bsakaguchi commented

2026-10-29 12:16:41 +00:00

Author

Owner

@cylonid commented on GitHub (May 21, 2025):

Okay @IzzySoft, will have a closer look before the next release, didn't spend much time on it up until now.

Apart from that, how come the new update is not detected by IzzyOnDroid yet?

@cylonid commented on GitHub (May 21, 2025): Okay @IzzySoft, will have a closer look before the next release, didn't spend much time on it up until now. Apart from that, how come the new update is not detected by IzzyOnDroid yet?

bsakaguchi commented

2026-10-29 12:16:41 +00:00

Author

Owner

@IzzySoft commented on GitHub (May 21, 2025):

will have a closer look before the next release, didn't spend much time on it up until now.

Thanks! Looking forward to that.

Apart from that, how come the new update is not detected by IzzyOnDroid yet?

Maybe because you did not yet release it?

Which "new" update do you mean? The one to your browser cache maybe? 😉

@IzzySoft commented on GitHub (May 21, 2025): > will have a closer look before the next release, didn't spend much time on it up until now. Thanks! Looking forward to that. > Apart from that, how come the new update is not detected by IzzyOnDroid yet? Maybe because you did not yet release it? ![Image](https://github.com/user-attachments/assets/5a6e2873-2d81-4b79-aebf-266403bd9793) ![Image](https://github.com/user-attachments/assets/743cc241-f1ec-4b20-8fa0-eebeec22d7ec) Which "new" update do you mean? The one to your browser cache maybe? 😉

Rows
Columns

[GH-ISSUE #185] Reproducible builds #169