comunes/tane
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

ci(release): apksigner --alignment-preserved true (reproducibility, final layer)
All checks were successful
ci / analyze (push) Successful in 1m29s
Details
ci / test-commons-core (push) Successful in 55s
Details
ci / test-app-seeds (push) Successful in 9m51s
Details

Browse source 
Even with the /home/vagrant path fix and v2/v3-only signing, the verify
still failed on a v3 CHUNKED_SHA512 mismatch with an EMPTY file diff. Cause
found by byte-level compare: apksigner (build-tools 35+) re-aligns native
libs to 16KB pages by default (--alignment-preserved defaults to false),
rewriting each .so's ZIP local-header extra field from gradle's 0x0 padding
to the 0xd935 alignment marker. F-Droid's reproducibility check compares
against the raw gradle output (0x0), so our re-aligned reference (0xd935)
differed in the signed bytes though every file was identical. Proven: 273
entries differed only in the extra field, 0 in compressed data. Signing
F-Droid's own unsigned build with --alignment-preserved true yields content
byte-identical to it (0 extra-field diffs, 0 data diffs). So preserve the
build's alignment when signing the reference.
This commit is contained in:
vjrj 2026-07-22 22:57:51 +02:00
parent 6c9de115e9
commit facd72db16
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
.forgejo/workflows/release.yml
View file

@ -249,6 +249,7 @@ jobs:
"$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \ "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
--ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \ --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
--v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \ --v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \
--alignment-preserved true \
--out "$out" "$f" --out "$out" "$f"
# Prove the signer cert matches AllowedAPKSigningKeys. # Prove the signer cert matches AllowedAPKSigningKeys.
"$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
@ -375,6 +376,7 @@ jobs:
"$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \ "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
--ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \ --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
--v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \ --v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \
--alignment-preserved true \
--out "$out" "$f" --out "$out" "$f"
"$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
rm -f /tmp/ks.jks rm -f /tmp/ks.jks
@ -499,6 +501,7 @@ jobs:
"$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \ "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
--ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \ --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
--v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \ --v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \
--alignment-preserved true \
--out "$out" "$f" --out "$out" "$f"
"$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
rm -f /tmp/ks.jks rm -f /tmp/ks.jks