App on Google Play can't be verified #1748
Comments
|
3.5 months later ... how is it going? No plan to make your wallet secure against the release manager being put under duress? |
|
+1 for making the wallet fully open source and build-able on Android. This will allow people to verify the code to ensure it is truely a private wallet and this can allow the app to be added onto F-Droid! |
|
@trymeouteh Thanks for the kudos. Much appreciated |
|
@Giszmo Can you more precisely specify what you are requesting with respect to the app being verifiable? |
|
The app was reviewed more than a year ago and back then, the complaint was basically the lack of clear build instructions. If you claim the binary from Google Play can be rebuilt from the public source code, I'll happily look into this again. Just as a quick check, I compared the version from Google Play (1.19.0) with tags here in the repo and can't find a higher tag than 1.17.5, so that to me looks like "not reproducible" is still the right verdict. |
Closed
|
Currently use Line 37 in 6de5ffa just need to ensure it's found by the script when it's called. build: FROM frolvlad/alpine-glibc
RUN set -ex; \
apk update; \
apk add --no-cache \
git \
npm \
yarn \
openjdk8; \
adduser -D appuser;
USER appuser
ENV NODE_ENV="development" \
ANDROID_SDK_ROOT="/home/appuser/app/sdk/" \
ANDROID_HOME="/home/appuser/app/sdk/"
RUN set -ex; \
mkdir -p "/home/appuser/app/sdk/licenses" "/home/appuser/app/edge" "/home/appuser/app/edgeUpstreamAPK"; \
printf "\n24333f8a63b6825ea9c5514f83c2829b004d1fee" > "/home/appuser/app/sdk/licenses/android-sdk-license"; \
cd /home/appuser/app/edgeUpstreamAPK; \
wget https://edge.app/app; \
unzip app; \
cd /home/appuser/app/edge/; \
wget https://github.com/EdgeApp/edge-react-gui/archive/refs/tags/v.2.0.13.zip; \
sha256sum v.2.0.13.zip; \
unzip v.2.0.13.zip; \
rm v.2.0.13.zip; \
git clone https://github.com/EdgeApp/edge-react-gui/; \
cd /home/appuser/app/edge/edge-react-gui/;
WORKDIR /home/appuser/app/edge/
RUN set -ex; \
cd edge-react-gui-v.2.0.13; \
sed -i 's/bin\/bash/bin\/sh/g' ./postinstall.sh; \
yarn install --frozen-lockfile --ignore-optional --ignore-scripts; \
yarn postinstall; \
yarn prepare; \
cp /home/appuser/app/edgeUpstreamAPK/res/raw/env.json ./env.json; \
cd android; \
./gradlew assembleReleasecompared to APK from: https://edge.app/app a diffoscope should be run on both files to see what the diffs are. |
|
Latest version v2.12.0 can be built with Containerfile below: FROM frolvlad/alpine-glibc
RUN set -ex; \
apk update; \
apk add --no-cache \
git \
npm \
yarn \
openjdk11; \
adduser -D appuser;
USER appuser
ENV NODE_ENV="development" \
ANDROID_SDK_ROOT="/home/appuser/app/sdk/" \
ANDROID_HOME="/home/appuser/app/sdk/"
RUN set -ex; \
mkdir -p "/home/appuser/app/sdk/licenses" "/home/appuser/app/edge" "/home/appuser/app/edgeUpstreamAPK"; \
printf "\n24333f8a63b6825ea9c5514f83c2829b004d1fee" > "/home/appuser/app/sdk/licenses/android-sdk-license"; \
cd /home/appuser/app/edgeUpstreamAPK; \
wget https://edge.app/app; \
unzip app; \
cd /home/appuser/app/edge/; \
git clone https://github.com/EdgeApp/edge-react-gui/; \
cd /home/appuser/app/edge/edge-react-gui/;
WORKDIR /home/appuser/app/edge/
RUN set -ex; \
cd edge-react-gui; \
git checkout v2.12.0; \
yarnpkg install --frozen-lockfile --ignore-optional --ignore-scripts; \
yarnpkg prepare; \
cp /home/appuser/app/edgeUpstreamAPK/res/raw/env.json ./env.json; \
cd android; \
./gradlew assembleReleasecompared to APK from: https://edge.app/app |
|
I tried for the latest release - 2.25.0 and failed to build from source. I used this container file: (same as Emanuel's but without the download of the app and with updated version) and got this build error: |
|
There is a Jenkinsfile in repo that likely can be used to build the app (also looks like it used to generate the apk) https://github.com/EdgeApp/edge-react-gui/blob/67e9597452cac52aa7062126d4f2713a3120fe22/Jenkinsfile Also app latest version 3.6.0 can be compiled with Containerfile below: FROM frolvlad/alpine-glibc
RUN set -ex; \
apk update; \
apk add --no-cache \
git \
npm \
yarn \
openjdk11; \
adduser -D appuser; \
mkdir -p "/Users/jenkins/.jenkins/workspace/Edge_edge-react-gui_master/"; \
chown -R appuser:appuser /Users/;
USER appuser
ENV NODE_ENV="development" \
ANDROID_SDK_ROOT="/home/appuser/sdk/" \
ANDROID_HOME="/home/appuser/sdk/" \
AIRBITZ_API_KEY="74591cbad4a4938e0049c9d90d4e24091e0d4070" \
BUGSNAG_API_KEY="5aca2dbe708503471d8137625e092675" \
NODE_OPTIONS=--openssl-legacy-provider
RUN set -ex; \
mkdir -p "/home/appuser/sdk/licenses"; \
printf "\n24333f8a63b6825ea9c5514f83c2829b004d1fee" > "/home/appuser/sdk/licenses/android-sdk-license"; \
cd /Users/jenkins/.jenkins/workspace/Edge_edge-react-gui_master/; \
git clone --branch v3.6.0 --depth 1 --no-tags --single-branch https://github.com/EdgeApp/edge-react-gui/ . ;
WORKDIR /Users/jenkins/.jenkins/workspace/Edge_edge-react-gui_master/
RUN set -ex; \
sed -i "s/versionCode 21000000/versionCode 23032902/g" android/app/build.gradle; \
sed -i 's/versionName "99.99.99"/versionName "3.6.0"/g' android/app/build.gradle; \
sed -i "s/uploadReactNativeMappings = true/uploadReactNativeMappings = false/g" android/app/build.gradle; \
sed -i '/^\s*<\/application>\s*/i <meta-data android:name="com.bugsnag.android.BUILD_UUID" android:value="fd7bc623-0f99-40f8-b23d-527c1483d077"/>' android/app/src/main/AndroidManifest.xml; \
sed -i 's/BUGSNAG_API_KEY/5aca2dbe708503471d8137625e092675/g' android/app/src/main/AndroidManifest.xml; \
yarnpkg install --frozen-lockfile --ignore-scripts; \
yarnpkg prepare;
sed -i 's/AIRBITZ_API_KEY": "/AIRBITZ_API_KEY": "74591cbad4a4938e0049c9d90d4e24091e0d4070/g' env.json; \
sed -i 's/BUGSNAG_API_KEY": "/BUGSNAG_API_KEY": "5aca2dbe708503471d8137625e092675/g' env.json; \
RUN set -ex; \
cd /Users/jenkins/.jenkins/workspace/Edge_edge-react-gui_master/android/;
./gradlew packageReleaseUniversalApkOpened issues from comparing it to apk from website:
There more investigation that need to be done on the diff to figure what should be changed in the build script. |
|
I just tried to reproduce version 3.20.0 and got a huge diff. The bugsnag api key is needed when using the build instructions for an Android release with The api keys kind of floating around like they do while the app is not reproducible is unfortunate and I would really appreciate if you could provide a non-default branch for reproducibility that actually contains the api keys. |
|
Hello team Edge. Danny here from @WalletScrutiny I was able to build the app version 4.8.0 using this dockerfile: Further notes on how I did it exactly could be found in the walletscrutiny MR Unfortunately, I found app version 4.8.0 nonverifiable due to the following diffs: |
|
Hi, keraliss from walletscrutiny here. we tested the reproducability of your wallet and found this - there were also 500+ lines of diff including json, xml and png files. would be great if you can look into it! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
At the time of writing this article your app was not verifiable. Please help make your app verifiable for outside developers and let me know when you think it's worth reviewing your wallet again!
The text was updated successfully, but these errors were encountered: