[rb-general] Reproducible Android apps: resources.arsc

[Chris Lamb]

Hi Torsten,

Thanks for your email. Please excuse my terse reply :)

> It would be nice, if more information would be provided here, but this
> is probably a topic for apktool upstream, right?

Possibly, but if .apk files are "just" .zip files then diffoscope
should really be able to handle them better.

Could you perhaps provide two .apk files in question, ideally in a
wishlist bug against diffoscope?
 
> We are aware of at least two other Android apps that are affected by
> this problem. So far, we are working around the issue by using
> disorderfs in stable sorting mode.

Eek! I must say this made me squirm IRl as disorderfs was intended to
locate, detect and ultimately fix non-determinism, not to work-around
it!  :'-(

> If anybody has other ideas for solving the issue, please let me know!

If disorderfs ""fixes"" the issue for you, then you at least know the
reason why. What tool, exactly, is creating these files?

> using diffoscope only zipinfo shows a difference in the resources.arsc'
> CRC value:

(As you imply that's almost certainly just a symptom, rather than the
actual underlying issue..)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby at debian.org / chris-lamb.co.uk
       `-