Reproducible Builds

[IzzySoft]

Looks like you just broke them for SysctlGUI – with this block:

            signingConfig = if (envEnabled || hasSigningValues) {
                signingConfigs.getByName("release")
            } else {
                signingConfigs.getByName("debug")
            }

Never have a release build signed by a debug key (which is supposed to happen here when the release key was not found – so instead of an unsigned APK, we'd end up with a debug-signed one). Adding to that:

FAILURE: Build failed with an exception.                                                                                                     
                                                                                                                                             
* Where:                                                                                                                                     
Build file '/build/repo/app/build.gradle.kts' line: 85                                                                                       
                                                                                                                                             
* What went wrong:                                                                                                                           
Script compilation error:                                                                                                                    
                                                                                                                                             
  Line 85:             signingConfig = if (envEnabled || hasSigningValues) {                                                                 
                                       ^ Assignment type mismatch: actual type is 'Unit', but 'ApkSigningConfig?' was expected.              

🤷‍♂️

To work around that, we've applied

sed -ri '/signingConfig =.*\{/,/^            \}$/d' app/build.gradle.kts

before calling gradlew. Build succeeds then, and is even RB again.

[Lennoard]

So it's ok for you to get an unsigned APK instead? Just making sure I get this right.

This ApkSigningConfig error, I've never seen it before The script appears to be fine as both my local machine and GitHub actions built the project more than once.

[IzzySoft]

So it's ok for you to get an unsigned APK instead?

For our build yes, we even need to build an unsigned APK – your release build of course should always be signed with your release key. If our build produces an otherwise identical APK, apksigcopier would be able to copy over your signing (the only missing part, unless our build is suddenly signed with another key) – and thereby confirm RB. We of course only ever ship your "original" APK – the one we built, will be "thrown away" after the RB process is through 😉

This ApkSigningConfig error, I've never seen it before

Nor have I. It might have been caused by our recipe having removed the line that follows (for previous releases, we needed to remove the enforced signing as well) – and thus received neither an ApkSigningConfig nor null. Pointing to the if with the error, is not exactly a helpful hint 😉

Speaking of "hint": We do have some hint in our documentation for that on our website, under Signing Config 😉

[Lennoard]

In that case I'll just remove thwt condition and add another one for thr gradle build command.
Then tag another release.

[IzzySoft]

Time's closing up to 2 am – guess my eyes are too crossed to understand the terms (thwt? thr?) 🙈 Does this mean there would be no more forced signing at all then with the next release – and we can drop the sed entirely? In that case I'd ass a FIXME note to our recipe, so that gets done before the next release would be built here.

[Lennoard]

My apologies.
My plan is having the build script free of code for forcing a signed build, It'll no longer use a debug config if it doesn't find the envs or the .prop file (instead, no signing will happen).

So no more signingConfig = if ... or keystore setup if the conditions are not met.

Is that ok?

ETA: 2 days

[IzzySoft]

That's wonderful, thanks! Let me put a FIXME note into our recipe then, to remove that sed with the next release 🤗 Done. So once the next release becomes available, our builder will not process it automatically, but instead send me a note to adjust the recipe first.

Your change should also be helpful for whoever else wants to build for themselves. If I wanted, for some reason, build an app myself, my plan would be to sign it myself, too, after the build. That way I wouldn't have to adjust the build.gradle.kts beforehand, or see what variables to set, how to name the keystore and where to put it, etc – I could if I wanted, but I could also simply call apksigner on the APK the very same way for whatever app I build 😉

So, thank you very much also in the name of "others affected" 🤗

[Lennoard]

@IzzySoft would this be it?

[IzzySoft]

I've never fully understood the difference between getByName and findByName – but maybe if this if had an else null (so findByName('release') would get something returned in any case), we'd be on the safe side?