mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-09 08:04:45 +00:00
Claude
6bb2f8045d
Bugs / inconsistencies found while reviewing the branch for merge: - dependenciesInfo comment falsely claimed Play "still derives this data server-side, nothing is lost." Not true: includeInBundle=false means the .aab carries no dependency metadata, so Play Console's dependency-insights / SDK-vulnerability alerts go unpopulated (uploads still succeed). Corrected the comment and the BUILDING.md framing (it called the blob "the one remaining blocker" when the Arti .so was the bigger one). - Version-bump workflow was broken: the README told you to run `build-arti.sh --clean` to refresh Cargo.lock, but the build is now --locked (fails on a stale lock) and the clone moved to the canonical /tmp path. Added a dedicated `--regen-lock` mode (clone + cargo generate-lockfile, no NDK needed) and pointed the docs at it. Verified it reproduces the committed lock byte-for-byte. - verify-reproducible.sh: new helper that builds twice and diffs to prove byte-for-byte reproducibility; uses portable sha256 (sha256sum/shasum) and plain `sort` so it runs on macOS too. - README verify recipe referenced paths that only resolved from the repo root while telling you to cd into tools/arti-build — replaced with the helper. - rust-toolchain.toml listed four Android targets but only two ABIs ship a .so; trimmed to match (check_prerequisites adds any other on the fly). - BUILDING.md: documented that the bundled Arti .so is reproducible-from-source and that secp256k1/webrtc are version-pinned Maven prebuilts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JtjUcSjjpu4auFndw1QKeU
20 lines
881 B
TOML
20 lines
881 B
TOML
# Pin the exact Rust toolchain used to build libarti_android.so.
|
|
#
|
|
# Reproducibility: rustc output is only stable for a fixed compiler version, so
|
|
# everyone who rebuilds the shipped .so (us, F-Droid, an independent verifier)
|
|
# must use this exact toolchain. rustup reads this file automatically and
|
|
# installs the pinned version + the Android targets on first invocation of the
|
|
# build scripts. Bump this in lockstep with ARTI_VERSION / Cargo.lock and
|
|
# re-verify (see README.md → "Reproducible builds").
|
|
[toolchain]
|
|
channel = "1.94.1"
|
|
profile = "minimal"
|
|
components = ["rustc", "cargo", "rust-std"]
|
|
# Only the two ABIs we actually ship libarti_android.so for (see jniLibs/). If
|
|
# build-arti.sh is extended to armv7/i686, add them here too — check_prerequisites
|
|
# also adds any missing target on the fly.
|
|
targets = [
|
|
"aarch64-linux-android",
|
|
"x86_64-linux-android",
|
|
]
|