mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-08 23:54:39 +00:00
Claude
f7a15a8407
The libarti_android.so shipped in the APK is the one binary we compile ourselves, and it was the remaining blocker to a verifiable build: a Rust cdylib is only reproducible when the compiler, the dependency graph, and the embedded build paths are all pinned. None were. Pin all three: - rust-toolchain.toml pins rustc (rustup auto-installs it + the Android targets), so codegen is stable across machines. - Cargo.lock is now generated and committed (501 packages); both build scripts run `cargo --locked` so transitive versions can't drift. - repro-env.sh (sourced by build-arti.sh and build-arti-host.sh) rewrites host-specific absolute paths with --remap-path-prefix, disables incremental compilation, and sets a fixed SOURCE_DATE_EPOCH derived from the Arti tag. With these, an independent rebuild of the pinned tag reproduces the committed .so bit-for-bit, which is what lets F-Droid / Zapstore verify it from source instead of trusting a prebuilt blob. README documents the pins and a two-path build-and-diff verification recipe. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JtjUcSjjpu4auFndw1QKeU