[tor-bugs] #31564 [Applications/Tor Browser]: Android bundles based on ESR 68 are not built reproducibly anymore

[Tor Bug Tracker & Wiki]

#31564: Android bundles based on ESR 68 are not built reproducibly anymore
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:  new
 Priority:  Very High                            |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-9.0-must-nightly,                |  Actual Points:
  TorBrowserTeam201908, GeorgKoppen201908        |
Parent ID:  #30324                               |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by sisbell):

 Replying to [comment:3 gk]:
 > Hm. Did they say when it got introduced? Is our reproducible builds
 setup broken that we did not detect that problem during the esr60 cycle?
 Or is that really a thing that got introduced with the new toolchain we
 use.
 >
 > That said, sisbell, what are our options here? Can we just use a newer
 gradle plugin which has this fixed? Or do we need to build that one
 ourselves and use it then or...?

 In the google issuetracker. one person mentioned that they got around the
 issue by using aapt2 directly with the correct order in the linker. I
 think this is worth investigating since it could potentially be scripted
 without requiring a patch. My only concern is that Firefox has a
 customized build so it may not be extendible to this approach. It requires
 looking into.

 https://developer.android.com/studio/command-line/aapt2


 {{{
  aapt2 link -o output.apk
  -I android_sdk/platforms/android_version/android.jar
     compiled/res/values_values.arsc.flat
     compiled/res/drawable_Image.flat --manifest
 /path/to/AndroidManifest.xml -v
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31564#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online