How can I verify the app on Google Play was built from this source code? #2544
Comments
|
@Giszmo Thanks for your interest and apologies you couldn’t build the project. Regarding verifying the play store apk, we do all our release builds in appcentre which is configured with the build steps and environment information, it also pushes our builds for publishing to Play Store. I can add you to our AppCentre team and you will be able to build the app the same way the play store apk is built. You will also be able to review the build process in detail. Please let me know if this seems like a viable option. If that doesn’t work for you we can look to provide you with information to build the app. |
The point is public auditability. Is there not a way to share the build script in the scope of general build instructions? |
|
@Giszmo I checked our build config the dev flavour of our app can be built in debug mode. The build script to create a release apk of our production version is not in the project. I will add this to the project and add instructions on how to build it. I can’t specify a ETA for this right now but it will be done soon. On a side note, I did 2 builds one after the other on AppCentre to see if they are the same. using Android APK analyser I could still see some differences; very tiny differences in a couple of auto generated files. I am keen to understand if you will be using APK analyser to verify builds or will it be a straight |
No rush. Just make sure to update this issue here so I get a notification. You can also open an issue on WalletScrutiny's GitLab but please only if I don't react within 2 days.
I use apktool but am thinking of just unzipping the apk from my build and from Google Play. Then I do a folder diff. This diff may only contain signature related files. Look at this wallet's Analysis to see an acceptable diff. |
This was referenced Jan 22, 2021
|
#2566 is outstanding. |
cakesoft-swati
added
Infra
|
Is this issue still unresolved? It's been a while since last activity. |
|
Opened issue regarding pod error (which can be ignored) at: #5911 Containerfile was based on some changes made in not merged PR: compiling latest version with: FROM debian:sid-slim
RUN set -ex; \
apt-get update; \
DEBIAN_FRONTEND=noninteractive apt-get install --yes -o APT::Install-Suggests=false --no-install-recommends \
git \
yarnpkg \
node-gyp \
openjdk-11-jdk ; \
rm -rf /var/lib/apt/lists/*; \
useradd -ms /bin/bash appuser;
USER appuser
ENV ANDROID_SDK_ROOT="/home/appuser/app/sdk" \
ANDROID_HOME="/home/appuser/app/sdk" \
NODE_ENV="development"
RUN set -ex; \
mkdir -p "/home/appuser/app/sdk/licenses" "/home/appuser/app/hexa2/"; \
printf "\n24333f8a63b6825ea9c5514f83c2829b004d1fee" > "/home/appuser/app/sdk/licenses/android-sdk-license"; \
cd /home/appuser/app/hexa2/; \
git clone https://github.com/bithyve/hexa.git; \
cd hexa; \
git checkout v2.0.80;
WORKDIR /home/appuser/app/hexa2/hexa/in container: Commands to run in container: (ignore the yarnpkg install;
cd android;then add below code at bottom of subprojects {
afterEvaluate {project ->
if (project.hasProperty("android")) {
android {
compileSdkVersion 30
buildToolsVersion "30.0.1"
}
}
}
}Then run command NODE_OPTIONS=--openssl-legacy-provider ./gradlew assembleReleasewhich will generate APK at: comparing it to APK on github at https://github.com/bithyve/hexa/releases/download/v2.0.80/Hexa_Wallet_2.0_Android_v2.0.80.apk with |
|
Any updates on this? |
|
Hello, it's 2024, just thought I'd re-open this for re-verification. |
|
Heyy, keraliss here from walletscrutiny. I tried to build the wallet, and faced some error. I made this dockerfile Which resulted in this error - you can check the steps i took and the issues i faced detailed here would be extremely helpful if you can guide on how to build the apk , or share your build process, or provide a dockerfile to build the apk! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I tried to rebuild the app from Google Play but failed to do so. My write-up as it also can be found on WalletScrutiny:
So it's "Non Custodial Bitcoin Wallet". There is also a link to their Github and while not equipped with a FOSS license, it is public source code of a wallet.
So the build instructions looked lacking from the start as there is no word about building the apk but only about running the app, we tried it nevertheless:
and as the above is only the good guesses out of 35 commands typed so far, this is where we give up and consider the app not verifiable due to lacking build instructions.
The text was updated successfully, but these errors were encountered: