[rb-general] Reproducible Android apps: resources.arsc

[Hans-Christoph Steiner]

Chris Lamb:
> Hi _hc,
> 
>> I think the F-Droid buildserver should include disorderfs
> 
> I'm afraid I can't put into words how much I dislike this. :(
> 
> The ideal, "permanent" solution is not to locate options to regular
> filesystems to force them to sort entries (which don't exist alas…),
> but to fix the build tool and begin the admittedly arduous and tortuous
> (!) journey of getting that upstream.
> 
> (Or at least to attempt to fix the build tool; to jump straight into
> "applying" disorderfs to the solution seems highly premature.)

Best case scenario, Google fixes this bug today, and releases it ASAP.
It will literally be a couple of years before the majority of app builds
use that version of the build tools.  Most app devs do not often update
the versions of the build tools they are using.

The F-Droid scenario is very different than the distro scenario because
F-Droid cannot enforce which versions of tools are used in build
process.  In Android, the model is that the developer is responsible for
the whole build/release cycle, and the "distro" just moves binaries around.

We'd like to be shipping reproducible builds now, rather than waiting a
couple more years to see this take effect.

.hc