Skip to content

Commit 948abe8

Browse files
Pururunalbin-mullvad
Pururun
and
albin-mullvad
committed
Add workflow to ensure reproducibility
Co-Authored-By: Albin <albin@mullvad.net>
1 parent 2143479 commit 948abe8

File tree

3 files changed

+176
-1
lines changed

3 files changed

+176
-1
lines changed

‎.github/workflows/android-reproducible-builds.yml

+116
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
---
2+
name: Android - Ensure reproducibility
3+
on:
4+
schedule:
5+
# At 04:20 UTC every monday.
6+
# Notifications for scheduled workflows are sent to the user who last modified the cron
7+
# syntax in the workflow file. If you update this you must have notifications for
8+
# Github Actions enabled, so these don't go unnoticed.
9+
# https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/notifications-for-workflow-runs
10+
- cron: '20 6 * * 1'
11+
push:
12+
workflow_dispatch:
13+
14+
permissions: {}
15+
16+
jobs:
17+
build-fdroid-app:
18+
name: Build fdroid container
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@v4
23+
with:
24+
submodules: true
25+
26+
- name: Upload repro yaml file
27+
uses: actions/upload-artifact@v4
28+
with:
29+
name: net.mullvad.mullvadvpn
30+
path: android/fdroid-build/metadata/net.mullvad.mullvadvpn.yml
31+
if-no-files-found: error
32+
retention-days: 7
33+
34+
- name: Build app
35+
run: ./building/containerized-build.sh android --fdroid
36+
37+
- name: Rename apk
38+
run: |
39+
cd dist
40+
for file in *.apk; do mv "$file" "app-oss-prod-fdroid-container.apk"; done
41+
cd ..
42+
43+
- name: Upload apks
44+
uses: actions/upload-artifact@v4
45+
with:
46+
name: apks
47+
path: dist
48+
if-no-files-found: error
49+
retention-days: 7
50+
51+
build-fdroid-app-server:
52+
name: Build fdroid with fdroid server
53+
runs-on: ubuntu-latest
54+
steps:
55+
- name: Install fdroidserver
56+
run: sudo apt-get install fdroidserver
57+
58+
- name: Install gradle
59+
run: |
60+
sudo apt-get remove gradle
61+
mkdir /opt/gradle
62+
curl -sfLo /opt/gradle/gradle-8.13-bin.zip https\://services.gradle.org/distributions/gradle-8.13-bin.zip
63+
unzip -d /opt/gradle /opt/gradle/gradle-8.13-bin.zip
64+
65+
# These are equivalent to the sudo section of the metadata file
66+
- name: Install dependencies
67+
run: |
68+
sudo apt-get update
69+
sudo apt-get install -y build-essential protobuf-compiler libprotobuf-dev
70+
71+
- name: Create empty repo
72+
run: mkdir fdroid-repo && cd fdroid-repo && mkdir metadata
73+
74+
- name: Init
75+
run: fdroid init
76+
77+
- uses: actions/download-artifact@v4
78+
with:
79+
name: net.mullvad.mullvadvpn
80+
path: metadata
81+
82+
- name: Update metadata
83+
run: sed -i 's/commit-hash/${{ github.sha }}/' metadata/net.mullvad.mullvadvpn.yml
84+
85+
- name: Build app
86+
run: |
87+
export PATH=$PATH:/opt/gradle/gradle-8.13/bin
88+
fdroid build net.mullvad.mullvadvpn:24090099 -v
89+
90+
- name: Upload apks
91+
uses: actions/upload-artifact@v4
92+
with:
93+
name: app-oss-prod-fdroid-unsigned
94+
path: build/net\.mullvad\.mullvadvpn/android/app/build/outputs/apk/ossProd/fdroid/app-oss-prod-fdroid-unsigned.apk
95+
if-no-files-found: error
96+
retention-days: 7
97+
98+
compare-builds:
99+
name: Check builds
100+
runs-on: ubuntu-latest
101+
needs: [build-fdroid-app, build-fdroid-app-server]
102+
steps:
103+
- name: Download container apk
104+
uses: actions/download-artifact@v4
105+
with:
106+
name: apks
107+
path: apks
108+
109+
- name: Download server apk
110+
uses: actions/download-artifact@v4
111+
with:
112+
name: app-oss-prod-fdroid-unsigned
113+
path: apks
114+
115+
- name: Compare files
116+
run: if [[ "$(md5sum app-oss-prod-fdroid-container.apk)" = "$(md5sum app-oss-prod-fdroid-unsigned.apk)" ]] then echo "Equal checksums"; else exit 1; fi

‎android/fdroid-build/env.sh

+4-1
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,13 @@
55
# shellcheck source=/dev/null
66
source "$HOME/.cargo/env"
77

8-
# Ensure Go compiler is accessible
8+
# Ensure Go compiler is accessible (needs to be removed if building locally)
99
export GOROOT="$HOME/go"
1010
export PATH="$GOROOT/bin:$PATH"
1111

12+
# Set up python3 path for the rust gradle plugin
13+
export RUST_ANDROID_GRADLE_PYTHON_COMMAND=/usr/bin/python3
14+
1215
# Ensure Rust crates know which tools to use for cross-compilation
1316
export NDK_TOOLCHAIN_DIR="$NDK_PATH/toolchains/llvm/prebuilt/linux-x86_64/bin"
1417

‎android/fdroid-build/metadata/net.mullvad.mullvadvpn.yml

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
AntiFeatures:
2+
NonFreeNet:
3+
en-US: Depends on the Mullvad VPN service.
4+
Categories:
5+
- Connectivity
6+
- Internet
7+
- Security
8+
- System
9+
License: GPL-3.0-or-later
10+
WebSite: https://mullvad.net
11+
SourceCode: https://github.com/mullvad/mullvadvpn-app
12+
IssueTracker: https://github.com/mullvad/mullvadvpn-app/issues
13+
Translation: https://github.com/mullvad/mullvadvpn-app/blob/HEAD/CONTRIBUTING.md#localization--translations
14+
Changelog: https://github.com/mullvad/mullvadvpn-app/blob/HEAD/android/CHANGELOG.md
15+
16+
AutoName: Mullvad VPN
17+
18+
RepoType: git
19+
Repo: https://github.com/mullvad/mullvadvpn-app.git
20+
21+
Builds:
22+
- versionName: '2024.9'
23+
versionCode: 24090099
24+
commit: commit-hash
25+
timeout: 10800
26+
subdir: android/app
27+
sudo:
28+
- apt-get update
29+
- apt-get install -y build-essential protobuf-compiler libprotobuf-dev
30+
init: NDK_PATH="$$NDK$$" ../fdroid-build/init.sh
31+
output: build/outputs/apk/ossProd/fdroid/app-oss-prod-fdroid-unsigned.apk
32+
rm:
33+
- desktop
34+
- graphics
35+
- ios
36+
- windows
37+
- building/sigstore
38+
- android/lib/billing
39+
prebuild:
40+
- git -C ../.. submodule update --init --recursive --depth=1 wireguard-go-rs
41+
- sed -i -e 's|Repositories.GradlePlugins|"https://plugins.gradle.org/m2/"|'
42+
../build.gradle.kts
43+
- sed -i '/\"desktop\//d' ../../Cargo.toml
44+
- sed -i '/^android-billingclient/d' ../gradle/libs.versions.toml
45+
build:
46+
- NDK_PATH="$$NDK$$" source ../fdroid-build/env.sh
47+
- cargo install --force cbindgen --version "0.26.0" --locked
48+
- echo $NDK_TOOLCHAIN_DIR "$$NDK$$"
49+
- ../build.sh --fdroid
50+
ndk: 27.2.12479018
51+
52+
AutoUpdateMode: Version
53+
UpdateCheckMode: Tags ^android/[0-9]{4}\.[0-9]+$
54+
UpdateCheckData: dist-assets/android-version-code.txt|(\d+)|dist-assets/android-version-name.txt|(.+)
55+
CurrentVersion: '2024.9'
56+
CurrentVersionCode: 24090099

0 commit comments

Comments
 (0)