Repository navigation
Conversation
Gradle's Zip, Jar and Tar tasks store file mtimes and use filesystem order, so their output differs between builds. p4a normalises the tars it writes itself, but sets nothing on the gradle side. Under AGP 8.11 no shipped artifact changes: the apk and aab are not built by archive tasks, and the service_library aar task already gets both flags from AGP. The point is the default, so an archive task added later by a newer AGP or by a plugin from --gradle-dependency is reproducible too. Refs kivy#3066, kivy#3069. Upstreamed from https://github.com/spesmilo/python-for-android
Nothing verifies the gradle distribution we download. Adding distributionSha256Sum alone would not fix that: the checked-in gradle-wrapper.jar is from Gradle 2.1 (2014), which predates distribution verification and silently ignores the key. That is worse than omitting it, because the download then only looks verified. So the jar has to be replaced for the pin to mean anything. The new jar is the one Gradle publishes as gradle-8.14.3-wrapper.jar, sha256 7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172. The pinned value is Gradle's published checksum for gradle-8.14.3-all.zip; the -bin.zip one is different. Checked with this repo's own gradlew: a wrong checksum now aborts the build, the pinned one downloads, verifies and runs 8.14.3. The first build after this re-downloads the archive, because the new wrapper names its cache directory differently. Version bumps have to move distributionUrl and distributionSha256Sum together. Upstreamed from https://github.com/spesmilo/python-for-android
|
coverage: 63.278%. remained the same — f321x:202610_gradle_reproducible_archives into kivy:develop |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstreamed changes for build reproducibility from https://github.com/spesmilo/python-for-android.
See individual commits.