Add instructions for release APK reproducibiltiy #7901

kl · 2025-03-26T15:09:00Z

This change is

linear · 2025-03-26T15:09:05Z

DROID-1847 Document how to verify that a release APK is reproducible

albin-mullvad

Reviewed 1 of 1 files at r1, all commit messages.
Reviewable status: all files reviewed, 5 unresolved discussions

android/BuildInstructions.md line 270 at r1 (raw file):

## Verifying that an official release is reproducible:

1. Obtain the release APK (2025.2-beta1 or newer) from [GitHub releases](https://github.com/mullvad/mullvadvpn-app/releases) or [releases.mullvad.net](https://releases.mullvad.net/android/)

I suggest we skip this part since it's not something we promote. However we can mention our website instead.

Code quote:

 or [releases.mullvad.net](https://releases.mullvad.net/android/)

android/BuildInstructions.md line 271 at r1 (raw file):

1. Obtain the release APK (2025.2-beta1 or newer) from [GitHub releases](https://github.com/mullvad/mullvadvpn-app/releases) or [releases.mullvad.net](https://releases.mullvad.net/android/)
2. Setup your environment so that you can build a [release build ](#release-build) of the app.

I believe we can use 1. for all list entries and let the markdown parser figure the index out, like we do here:

mullvadvpn-app/BuildInstructions.md

Line 261 in df51289

1. On Windows, build the C++ libraries:

Could be nice to do that for in the rest of the document as well

Code quote:

2.

android/BuildInstructions.md line 272 at r1 (raw file):

1. Obtain the release APK (2025.2-beta1 or newer) from [GitHub releases](https://github.com/mullvad/mullvadvpn-app/releases) or [releases.mullvad.net](https://releases.mullvad.net/android/)
2. Setup your environment so that you can build a [release build ](#release-build) of the app.
3. Make sure you have fetched all tags: `git fetch --tags`

We can skip this fetch step since we can rely on the user/developer following this to figure that out

android/BuildInstructions.md line 274 at r1 (raw file):

3. Make sure you have fetched all tags: `git fetch --tags`
4. Checkout the release tag: `git checkout android/<version>`
5. Build the APK using the containerized script: `../building/containerized-build.sh android`, alternatively build without the container: `./build.sh`. The resuling file is located at `app/build/outputs/apk/ossProd/release/app-oss-prod-release.apk`.

Can we shorten this step a bit? Maybe we can just refer to our build instructions since it's quite likely that they will have to also set up the signing stuff to proceed. For example we can just say: Build a release build using our [build instructions](...).

android/BuildInstructions.md line 275 at r1 (raw file):

4. Checkout the release tag: `git checkout android/<version>`
5. Build the APK using the containerized script: `../building/containerized-build.sh android`, alternatively build without the container: `./build.sh`. The resuling file is located at `app/build/outputs/apk/ossProd/release/app-oss-prod-release.apk`.
6. Delete the signatures from the two APKs by running `zip -d app-oss-prod-release.apk "META-INF/*"` and `new zip -d MullvadVPN-<version>.apk "META-INF/*"`

typo: remove "new"?

Code quote:

 and `new zip

MrChocolatine · 2025-03-26T16:03:44Z

android/BuildInstructions.md

-4. Compare the checksums of the two APKs: `md5sum fdroid-container.apk app/build/outputs/apk/ossProd/fdroid/app-oss-prod-fdroid-unsigned.apk`
+4. Compare the checksums of the two APKs: `sha256sum fdroid-container.apk app/build/outputs/apk/ossProd/fdroid/app-oss-prod-fdroid-unsigned.apk`
+
+## Verifying that an official release is reproducible:


Nitpicking but other headings do not end with : .

Suggested change

## Verifying that an official release is reproducible:

## Verifying that an official release is reproducible

MrChocolatine · 2025-03-26T16:06:14Z

android/BuildInstructions.md

+1. Obtain the release APK (2025.2-beta1 or newer) from [GitHub releases](https://github.com/mullvad/mullvadvpn-app/releases) or [releases.mullvad.net](https://releases.mullvad.net/android/)
+2. Setup your environment so that you can build a [release build ](#release-build) of the app.
+3. Make sure you have fetched all tags: `git fetch --tags`
+4. Checkout the release tag: `git checkout android/<version>`
+5. Build the APK using the containerized script: `../building/containerized-build.sh android`, alternatively build without the container: `./build.sh`. The resuling file is located at `app/build/outputs/apk/ossProd/release/app-oss-prod-release.apk`.
+6. Delete the signatures from the two APKs by running `zip -d app-oss-prod-release.apk "META-INF/*"` and `new zip -d MullvadVPN-<version>.apk "META-INF/*"`
+7. Compare the checksums of the two APKs: `sha256sum app-oss-prod-release.apk MullvadVPN-<version>.apk`. If the checksums are equal the build is reproducible.


Suggested change

1. Obtain the release APK (2025.2-beta1 or newer) from [GitHub releases](https://github.com/mullvad/mullvadvpn-app/releases) or [releases.mullvad.net](https://releases.mullvad.net/android/)

2. Setup your environment so that you can build a [release build ](#release-build) of the app.

3. Make sure you have fetched all tags: `git fetch --tags`

4. Checkout the release tag: `git checkout android/<version>`

5. Build the APK using the containerized script: `../building/containerized-build.sh android`, alternatively build without the container: `./build.sh`. The resuling file is located at `app/build/outputs/apk/ossProd/release/app-oss-prod-release.apk`.

6. Delete the signatures from the two APKs by running `zip -d app-oss-prod-release.apk "META-INF/*"` and `new zip -d MullvadVPN-<version>.apk "META-INF/*"`

7. Compare the checksums of the two APKs: `sha256sum app-oss-prod-release.apk MullvadVPN-<version>.apk`. If the checksums are equal the build is reproducible.

1. Obtain the release APK (`2025.2-beta1` or newer) from [GitHub releases](https://github.com/mullvad/mullvadvpn-app/releases) or [releases.mullvad.net](https://releases.mullvad.net/android/)

2. Set up your environment so that you can build a [release build ](#release-build) of the app.

3. Make sure you have fetched all tags: `git fetch --tags`

4. Checkout the release tag: `git checkout android/<version>`

5. Build the APK using the containerized script: `../building/containerized-build.sh android`, alternatively build without the container: `./build.sh`. The resuling file is located at `app/build/outputs/apk/ossProd/release/app-oss-prod-release.apk`.

6. Delete the signatures from the two APKs by running `zip -d app-oss-prod-release.apk "META-INF/*"` and `new zip -d MullvadVPN-<version>.apk "META-INF/*"`

7. Compare the checksums of the two APKs: `sha256sum app-oss-prod-release.apk MullvadVPN-<version>.apk`. If the checksums are equal the build is reproducible.

MrChocolatine · 2025-03-26T16:06:23Z

android/BuildInstructions.md


 ### Troubleshooting reproducibility

 If two APKs built from the same commit have different checksums the build is not reproducible. This could be because of either:

 1. A build dependency on the local system has the wrong version.
 2. There is a bug that breaks the build reproducibility.
+3. The APK built is a version prior to 2025.2-beta1, which is the first version that supports reproducible builds.


Suggested change

3. The APK built is a version prior to 2025.2-beta1, which is the first version that supports reproducible builds.

3. The APK built is a version prior to `2025.2-beta1`, which is the first version that supports reproducible builds.

kl

Reviewable status: all files reviewed, 4 unresolved discussions (waiting on @albin-mullvad and @MrChocolatine)

android/BuildInstructions.md line 270 at r1 (raw file):

Previously, albin-mullvad wrote…

I suggest we skip this part since it's not something we promote. However we can mention our website instead.

Done.

android/BuildInstructions.md line 271 at r1 (raw file):

Previously, albin-mullvad wrote…

I believe we can use 1. for all list entries and let the markdown parser figure the index out, like we do here:

mullvadvpn-app/BuildInstructions.md

Line 261 in df51289

1. On Windows, build the C++ libraries:

Could be nice to do that for in the rest of the document as well

The more you know! Fixed

kl · 2025-03-26T16:48:59Z

android/BuildInstructions.md

-4. Compare the checksums of the two APKs: `md5sum fdroid-container.apk app/build/outputs/apk/ossProd/fdroid/app-oss-prod-fdroid-unsigned.apk`
+4. Compare the checksums of the two APKs: `sha256sum fdroid-container.apk app/build/outputs/apk/ossProd/fdroid/app-oss-prod-fdroid-unsigned.apk`
+
+## Verifying that an official release is reproducible:


kl · 2025-03-26T16:49:00Z

android/BuildInstructions.md

+1. Obtain the release APK (2025.2-beta1 or newer) from [GitHub releases](https://github.com/mullvad/mullvadvpn-app/releases) or [releases.mullvad.net](https://releases.mullvad.net/android/)
+2. Setup your environment so that you can build a [release build ](#release-build) of the app.
+3. Make sure you have fetched all tags: `git fetch --tags`
+4. Checkout the release tag: `git checkout android/<version>`
+5. Build the APK using the containerized script: `../building/containerized-build.sh android`, alternatively build without the container: `./build.sh`. The resuling file is located at `app/build/outputs/apk/ossProd/release/app-oss-prod-release.apk`.
+6. Delete the signatures from the two APKs by running `zip -d app-oss-prod-release.apk "META-INF/*"` and `new zip -d MullvadVPN-<version>.apk "META-INF/*"`
+7. Compare the checksums of the two APKs: `sha256sum app-oss-prod-release.apk MullvadVPN-<version>.apk`. If the checksums are equal the build is reproducible.


kl · 2025-03-26T16:49:03Z

android/BuildInstructions.md


 ### Troubleshooting reproducibility

 If two APKs built from the same commit have different checksums the build is not reproducible. This could be because of either:

 1. A build dependency on the local system has the wrong version.
 2. There is a bug that breaks the build reproducibility.
+3. The APK built is a version prior to 2025.2-beta1, which is the first version that supports reproducible builds.


albin-mullvad

Reviewed 1 of 1 files at r2, all commit messages.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on @MrChocolatine)

Pururun

Reviewed all commit messages.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on @MrChocolatine)

kl added the Android Issues related to Android label Mar 26, 2025

albin-mullvad requested changes Mar 26, 2025

View reviewed changes

MrChocolatine reviewed Mar 26, 2025

View reviewed changes

kl force-pushed the document-how-to-verify-that-a-release-apk-is-reproducible-droid-1847 branch from b8d0731 to d3b8482 Compare March 26, 2025 16:49

kl commented Mar 26, 2025

View reviewed changes

albin-mullvad approved these changes Mar 27, 2025

View reviewed changes

Pururun approved these changes Mar 27, 2025

View reviewed changes

Add instructions for release APK reproducibiltiy

216e599

albin-mullvad force-pushed the document-how-to-verify-that-a-release-apk-is-reproducible-droid-1847 branch from d3b8482 to 216e599 Compare March 27, 2025 08:04

albin-mullvad merged commit 2f92582 into main Mar 27, 2025
16 of 17 checks passed

albin-mullvad deleted the document-how-to-verify-that-a-release-apk-is-reproducible-droid-1847 branch March 27, 2025 08:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add instructions for release APK reproducibiltiy #7901

Add instructions for release APK reproducibiltiy #7901

kl commented Mar 26, 2025 •

edited by rasputnin

Loading

linear bot commented Mar 26, 2025

albin-mullvad left a comment

MrChocolatine Mar 26, 2025

kl Mar 26, 2025

MrChocolatine Mar 26, 2025

kl Mar 26, 2025

MrChocolatine Mar 26, 2025

kl Mar 26, 2025

kl left a comment

kl Mar 26, 2025

kl Mar 26, 2025

kl Mar 26, 2025

albin-mullvad left a comment

Pururun left a comment

	## Verifying that an official release is reproducible:
	## Verifying that an official release is reproducible

	3. The APK built is a version prior to 2025.2-beta1, which is the first version that supports reproducible builds.
	3. The APK built is a version prior to `2025.2-beta1`, which is the first version that supports reproducible builds.

Add instructions for release APK reproducibiltiy #7901

Add instructions for release APK reproducibiltiy #7901

Conversation

kl commented Mar 26, 2025 • edited by rasputnin Loading

linear bot commented Mar 26, 2025

albin-mullvad left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kl left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

albin-mullvad left a comment

Choose a reason for hiding this comment

Pururun left a comment

Choose a reason for hiding this comment

kl commented Mar 26, 2025 •

edited by rasputnin

Loading