laantungir/zapstore
1
0
Fork 0
mirror of https://github.com/zapstore/zapstore.git synced 2026-10-06 13:08:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add SOURCE_DATE_EPOCH setting to stabilize time-based metadata in reproducible builds

Browse Source
This commit is contained in:
Henrique Velloso
2026-01-20 01:12:36 -03:00
parent 90dd5cb423
commit 8adb770742
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPRODUCIBLE_BUILD.md
+4
View File
@@ -10,6 +10,7 @@ For reproducibility, always compare **unsigned APKs** (or APKs signed with the e
- **Dart/Flutter packages**: pinned via `pubspec.lock`.
- **Gradle**: pinned via `android/gradle/wrapper/gradle-wrapper.properties`.
- **Java**: use **JDK 17** (changing JDK can change bytecode/packaging).
- **SOURCE_DATE_EPOCH**: set to the current commit timestamp to stabilize time-based metadata.
- **Archive determinism**: Gradle archive tasks use stable ordering and no timestamps (`android/build.gradle.kts`).
- **Signing**: `release` is **signed only when a complete `android/key.properties` is present**; otherwise **release builds are unsigned** (`android/app/build.gradle.kts`).
@@ -27,6 +28,9 @@ For reproducibility, always compare **unsigned APKs** (or APKs signed with the e
Important: ensure `android/key.properties` is **absent** (or incomplete) so the APK is **not signed**.
```bash
# Standard reproducible-build timestamp (ties "build time" to the commit)
export SOURCE_DATE_EPOCH="$(git log -1 --pretty=%ct)"
java -version
fvm install