Skip to content

fdroid: nuke self signing and make builds reproducible #20807

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
siddarthkay wants to merge 3 commits into
base: master
Choose a base branch
from
Open

fdroid: nuke self signing and make builds reproducible #20807

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
08c041d
fdroid: don't self sign fdroid build
siddarthkay May 8, 2026
f3f6548
fdroid: add build flags for reproducibility
siddarthkay May 8, 2026
1c4df41
fdroid: sign after build
siddarthkay May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions ci/Jenkinsfile.fdroid
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,45 @@ pipeline {
}
}

stage('Sign') {
steps {
script {
/* Auto-selects release keystore on release/nightly, PR keystore otherwise. */
def keystore = creds.androidKeystorePrefix()
withCredentials([
file(
credentialsId: "${keystore}-file",
variable: 'KEYSTORE_PATH'
),
string(
credentialsId: "${keystore}-pass",
variable: 'KEYSTORE_PASSWORD'
),
usernamePassword(
credentialsId: "${keystore}-key-pass",
usernameVariable: 'KEYSTORE_ALIAS',
passwordVariable: 'KEYSTORE_KEY_PASSWORD'
),
Comment on lines +100 to +114
Copy link
Copy Markdown
Member

@jakubgs jakubgs May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Try not to provide credentials in Jenkinsfiles. Use our jenkins lib for that.

Copy link
Copy Markdown
Member

@jakubgs jakubgs May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, why not use fdroid/generate-keystore.sh as we did before?

]) {
/* apksigner is provided by the fdroid agent image (fdroid/Dockerfile).
* The F-Droid build emits a zipaligned, unsigned APK, so signing
* in place is sufficient. Passwords are passed via env: provider
* to keep them off the process command line. */
sh '''
set +x
Comment on lines +116 to +121
Copy link
Copy Markdown
Member

@jakubgs jakubgs May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Or we could just wrap it into a script too. What was wrong with fdroid/sign-apk.sh?

Copy link
Copy Markdown
Contributor Author

@siddarthkay siddarthkay May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem with using a single use keystore is that Fdroid will use our signed apk as part of their releases ( if we enable reproducible builds as part of the manifest ).

If we regenerate keystore each time users won't be able to update the app since it would have been signed each time with different key.

Copy link
Copy Markdown
Member

@jakubgs jakubgs May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What? Surely that's wrong. F-Droid sign releases they build themselves with their own key. It wouldn't make sense otherwise.

Copy link
Copy Markdown
Contributor Author

@siddarthkay siddarthkay May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Incase you enable "reproducible builds" this is the new procedure I guess.
They just verify our signed apk with the signature we provide and use that instead of signing themseleves, and it seems like they prefer that way over signing themselves.

see comment by Lliacon : https://gitlab.com/fdroid/fdroiddata/-/merge_requests/32193#note_3351802215

apksigner sign \
--ks "${KEYSTORE_PATH}" \
--ks-pass "env:KEYSTORE_PASSWORD" \
--ks-key-alias "${KEYSTORE_ALIAS}" \
--key-pass "env:KEYSTORE_KEY_PASSWORD" \
"${STATUS_FDROID_APK}"
apksigner verify --verbose "${STATUS_FDROID_APK}"
'''
}
}
}
}

stage('Upload') {
steps {
script {
Expand Down
21 changes: 21 additions & 0 deletions fdroid/build-qt.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,23 @@ QT_VERSION="${QT_VERSION:-6.9.2}"
QT_MODULES=qtbase,qtdeclarative,qt5compat,qtmultimedia,qtshadertools,qtimageformats,qtwebview,qtscxml,qtsvg,qtconnectivity,qtwebsockets,qtpositioning,qtlottie,qtwebchannel
(cd "$QT_SRCDIR" && perl init-repository --module-subset="$QT_MODULES")

# Reproducibility:
# add_link_options: strips .note.gnu.build-id from every .so
# add_compile_options: make sure that paths dont leak into final build.
QT5_CMAKELISTS="$QT_SRCDIR/CMakeLists.txt"
if ! grep -q 'build-id=none' "$QT5_CMAKELISTS"; then
sed -i '/^project(Qt$/,/^)$/{/^)$/a\
add_link_options("LINKER:--build-id=none")\
add_compile_options("-ffile-prefix-map=${CMAKE_SOURCE_DIR}=.")\
add_compile_options("-ffile-prefix-map=${CMAKE_BINARY_DIR}=.")\
add_compile_options("-ffile-prefix-map=$ENV{HOME}=.")
}' "$QT5_CMAKELISTS"
fi

# Reproducibility: rewrite absolute build/install paths embedded in compiled
# objects (debug strings, __FILE__, etc.) so they match across rebuilders.
QT_REPRO_CFLAGS="-ffile-prefix-map=${QT_SRCDIR}=. -ffile-prefix-map=${BUILD_DIR}=. -ffile-prefix-map=${HOME}=."

# Build Qt for host (required as cross-compilation toolchain for Android)
mkdir -p build_qt_host && cd build_qt_host

Expand All @@ -18,6 +35,8 @@ mkdir -p build_qt_host && cd build_qt_host
-nomake tests \
-- \
-DCMAKE_BUILD_TYPE=Release \
-DCMAKE_C_FLAGS_INIT="$QT_REPRO_CFLAGS" \
-DCMAKE_CXX_FLAGS_INIT="$QT_REPRO_CFLAGS" \
-DCMAKE_MESSAGE_LOG_LEVEL=WARNING \
-Wno-dev

Expand Down Expand Up @@ -50,6 +69,8 @@ mkdir -p build_qt_android && cd build_qt_android
-DFFMPEG_DIR="$FFMPEG_DIR" \
-DFEATURE_ffmpeg=ON \
-DQT_DEFAULT_MEDIA_BACKEND=ffmpeg \
-DCMAKE_C_FLAGS_INIT="$QT_REPRO_CFLAGS" \
-DCMAKE_CXX_FLAGS_INIT="$QT_REPRO_CFLAGS" \
-DCMAKE_MESSAGE_LOG_LEVEL=WARNING \
-Wno-dev

Expand Down
36 changes: 0 additions & 36 deletions fdroid/generate-keystore.sh
View file
Open in desktop

This file was deleted.

44 changes: 0 additions & 44 deletions fdroid/sign-apk.sh
View file
Open in desktop

This file was deleted.

9 changes: 9 additions & 0 deletions mobile/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,11 @@ $(STATUS_GO_LIB):
@echo "Building status-go mobile library"
@mkdir -p $(LIB_PATH)
ifeq ($(OS),android)
# Reproducibility flags for status-go (GOFLAGS,CGO_CFLAGS,CGO_CXXFLAGS,GOMODCACHE):
GOFLAGS="-trimpath -buildvcs=false" \
GOMODCACHE="$(BUILD_PATH)/.gomodcache" \
CGO_CFLAGS="-ffile-prefix-map=$(HOME)=." \
CGO_CXXFLAGS="-ffile-prefix-map=$(HOME)=." \
CC="$(CC)" $(MAKE) -C ../vendor/status-go statusgo-android-library \
ARCH=$(ARCH) \
ANDROID_NDK_ROOT="$(ANDROID_NDK_ROOT)" \
Expand All @@ -43,6 +48,10 @@ ifeq ($(OS),android)
GO_GENERATE_CMD="go generate" \
SHELL=/bin/sh
else ifeq ($(OS),ios)
GOFLAGS="-trimpath -buildvcs=false" \
GOMODCACHE="$(BUILD_PATH)/.gomodcache" \
CGO_CFLAGS="-ffile-prefix-map=$(HOME)=." \
CGO_CXXFLAGS="-ffile-prefix-map=$(HOME)=." \
Comment on lines +51 to +54
Copy link
Copy Markdown
Member

@jakubgs jakubgs May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs comment too.

$(MAKE) -C ../vendor/status-go statusgo-ios-library \
ARCH=$(ARCH) \
IPHONE_SDK="$(IPHONE_SDK)" \
Expand Down
30 changes: 17 additions & 13 deletions mobile/scripts/buildApp.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,13 +48,21 @@ if [[ "${OS}" == "android" ]]; then
export BUILD_VARIANT
export BUNDLE_IDENTIFIER

if [[ "$GRADLE_TARGETS" == *"Fdroid"* ]]; then
# shellcheck source=../../fdroid/generate-keystore.sh
source "$REPO_ROOT/fdroid/generate-keystore.sh" "$REPO_ROOT/status-fdroid.keystore"
fi

# Reproducibility flags for fdroid rebuilds:
# --build-id=none drops the .note.gnu.build-id section
# -ffile-prefix-map remaps absolute source paths so they don't depend on $HOME or $BUILD_DIR.
QMAKE_REPRO_ARGS=(
"QMAKE_LFLAGS+=-Wl,--build-id=none"
"QMAKE_CFLAGS+=-ffile-prefix-map=${BUILD_DIR}=."
"QMAKE_CFLAGS+=-ffile-prefix-map=${REPO_ROOT}=."
"QMAKE_CFLAGS+=-ffile-prefix-map=${HOME}=."
"QMAKE_CXXFLAGS+=-ffile-prefix-map=${BUILD_DIR}=."
"QMAKE_CXXFLAGS+=-ffile-prefix-map=${REPO_ROOT}=."
"QMAKE_CXXFLAGS+=-ffile-prefix-map=${HOME}=."
)
"$QMAKE_BIN" "$CWD/../wrapperApp/Status.pro" "${QMAKE_CONFIG[@]}" -spec android-clang \
ANDROID_ABIS="${ANDROID_ABI:-arm64-v8a}" VERSION="$VERSION" "${QMAKE_DEFINES[@]}" -after
ANDROID_ABIS="${ANDROID_ABI:-arm64-v8a}" VERSION="$VERSION" "${QMAKE_DEFINES[@]}" \
-after "${QMAKE_REPRO_ARGS[@]}"

make -j"$(nproc)" apk_install_target

Expand Down Expand Up @@ -117,18 +125,14 @@ if [[ "${OS}" == "android" ]]; then
echo "APK outputs:"
find build/outputs/apk -name '*.apk' 2>/dev/null || echo "No APKs found"

# If Gradle produced an unsigned APK (e.g. fdroid build where signing configs
# are stripped by fdroid's remove_signing_keys), sign it via the dedicated script.
if [[ ! -f "$APK_OUT" && -f "$APK_OUT_UNSIGNED" && -n "${FDROID_STORE_FILE:-}" ]]; then
echo "Signing unsigned APK..."
"$REPO_ROOT/fdroid/sign-apk.sh"
fi

# Copy whichever artifacts were built
BUILT=""
if [[ -f "$APK_OUT" ]]; then
cp "$APK_OUT" "$BIN_DIR/${OUTPUT_NAME}.apk"
BUILT="$BIN_DIR/${OUTPUT_NAME}.apk"
elif [[ -f "$APK_OUT_UNSIGNED" ]]; then
cp "$APK_OUT_UNSIGNED" "$BIN_DIR/${OUTPUT_NAME}.apk"
BUILT="$BIN_DIR/${OUTPUT_NAME}.apk"
fi
if [[ -f "$AAB_OUT" ]]; then
cp "$AAB_OUT" "$BIN_DIR/${OUTPUT_NAME}.aab"
Expand Down
Loading