Pachli App mentioned in builds that failed to reprodoce (Fdroid)

[robovoice1]

Pachli app is mentioned in this link as problematic:

https://verification.f-droid.org/failed.html

Posted on mastadon:
https://floss.social/@fdroidorg/113638672281687647

[nikclayton]

This is one of those things that I sort of care about, but not enough to commit time to a deep dive on fixing a multitude of problems, as I think there are higher priority issues to fix.

I think a user who's technical enough to assess the trustworthiness of a build can also account for odd differences caused by the build system.

• If you trust GitHub you can verify the downloads on the release page came from the release pipeline (if you don't trust GitHub then all bets are off).
• If you trust GitHub and Google Play you can verify the APK sent to Google Play from the release pipeline matches the one generated by the release pipeline
• If you trust GitHub and F-Droid's build infrastructure then you trust the APK they generate.

#1216 might help. There may be other issues that prevent the build from being 100% reproducible, and I'll cheerfully accept PRs that fix them. I'll leave this open for the moment and label it "help wanted" to flag it for people who might be able to contribute.

[nikclayton]

Note to self: at time of writing https://verification.f-droid.org/failed.html only shows builds from Jan 28, so it's missing the Pachli release that may have resolved this. Check back in a month and see if F-Droid have an updated build report.

[nikclayton]

Builds have been updated. Now showing differences in baseline profile.

https://verification.f-droid.org/app.pachli_28.apk.diffoscope.html

• https://issuetracker.google.com/issues/231837768
• https://gist.github.com/obfusk/61046e09cee352ae6dd109911534b12e

discuss possible fixes.

[nikclayton]

As of Pachli version code 31 no diffs are reported (https://verification.f-droid.org/app.pachli_31.apk.diffoscope.html), so I assume F-Droid now considers this reproducible.