Please enable deterministic builds about airgap-vault HOT 6 CLOSED

Thanks for updating your review.

We'll look into how we can optimise the docker image and let you know about our findings as soon as possible.

from airgap-vault.

Hi, thank you for reaching out to us and taking the time to review our wallet. We agree with you that verifiability is very important for a wallet, which is the reason why we completely open sourced AirGap.

The reason you ran into issues is because our wallet is not yet compatible with cordova 9. In order to build it, you will have to use cordova 8.

We build the apk in docker as well. You can check the Dockerfile here.

The iOS build is done on a mac without docker, the instructions can be found in the build_ios stage here.

I'm sure you'll be able to build it using our Dockerfile, but I'm not sure whether or not the apk is deterministic (maybe there are different timestamps or something like that). We'll look into this in the next couple of days and report back what we find and also add more instructions to our readme.

from airgap-vault.

Thank you. I re-opened our ticket for your wallet on this. I noticed there was a Dockerfile but saw no instructions, so I had ignored it at the time.

from airgap-vault.

So I just finished doing some tests. After checking out the project, these are the commands you need to create a build using docker:

sed -i -e "s/version=\"0.0.0\"/version=\"3.0.0\"/g" config.xml
docker build -f build/android/Dockerfile -t airgap-vault --build-arg BUILD_NR="14555" --build-arg VERSION="3.0.0" .
docker run --name "airgap-vault-build" airgap-vault echo "container ran."
docker cp airgap-vault-build:/app/android-release-unsigned.apk airgap-vault-release-unsigned.apk

Version 3.0.0 and Build Number 14555 have to be replaced with the actual version and build number. 14555 and 3.0.0 are the values of the current version.

I then used the apktool to extract the locally built airgap-vault-release-unsigned.apk and the apk from the play store.

$ diff -qr fromGoogle/ fromLocal/
Files fromGoogle/apktool.yml and fromLocal/apktool.yml differ
Files fromGoogle/original/META-INF/MANIFEST.MF and fromLocal/original/META-INF/MANIFEST.MF differ
Only in fromGoogle/original/META-INF: PAPERS.RSA
Only in fromGoogle/original/META-INF: PAPERS.SF

So it looks like the builds are deterministic and only the signatures differ. But I'm sure you won't take my word for it and test it out yourself. 😄

Let me know if you run into any issues. We'll also add these instructions to our readme in the future to make it easier for people to verify. Thanks again for reaching out and keep up the good work!

from airgap-vault.

The instructions include basically to edit the project?

sed -i -e "s/version=\"0.0.0\"/version=\"3.0.0\"/g" config.xml

looks like config.xml should have the correct version instead of the one compiling it having to edit a versioned file?

Where does BUILD_NR="14555" come from?

docker build -f build/android/Dockerfile -t airgap-vault --build-arg BUILD_NR="14555" --build-arg VERSION="3.0.0" .

... so I need a new Docker image for every build??

This image is the biggest of all my 26 images with 6.24GB. Could we also do something about that? All the other build verification (attempts) were done with much smaller images and didn't require to build a new image for every version. I would normally mount a host system folder into the docker and move the build result there if it doesn't end up being in that folder anyway.

Why not:

• Have one image that gets rarely changed and usually just works to build the app
• Have all relevant data checked in.
• Use docker with --rm to delete all the Docker stuff after the build and --volume=$PWD:/mnt (for convenience, --workdir /mnt) to save the compile results in the local system.

Either way, I updated our review to "verifiable" but we have to find a way to make the build verification smoother aka automated.

I leave this issue open as the build number part will render the app not reproducible with the next release absent more generic build instructions

from airgap-vault.

I think this issue can be closed as in theory reproducibility was delivered at some point. I created a new issue #23 for specific difficulties rebuilding version 3.3.0. I suspect the build step changed slightly.

from airgap-vault.