Reproducibility Issue

[keraliss]

Hi, keraliss from walletscrutiny here! i was trying to do a reproducibility test on your wallet. i was successfully able to build the wallet, but found some diff in the built apk and the downloaded official one. here is the list of diff -

Total differences (excluding META-INF signing): 1608
  - png/xml files (excluded from verdict):      1543
  - other files (used for verdict):             65

Significant differences:
Files /tmp/flash_official_68_2289213/assets/dexopt/baseline.prof and /tmp/flash_built_68_2289213/assets/dexopt/baseline.prof differ
Files /tmp/flash_official_68_2289213/assets/index.android.bundle and /tmp/flash_built_68_2289213/assets/index.android.bundle differ
Files /tmp/flash_official_68_2289213/classes2.dex and /tmp/flash_built_68_2289213/classes2.dex differ
Files /tmp/flash_official_68_2289213/classes3.dex and /tmp/flash_built_68_2289213/classes3.dex differ
Files /tmp/flash_official_68_2289213/classes4.dex and /tmp/flash_built_68_2289213/classes4.dex differ
Files /tmp/flash_official_68_2289213/classes6.dex and /tmp/flash_built_68_2289213/classes6.dex differ
Files /tmp/flash_official_68_2289213/classes.dex and /tmp/flash_built_68_2289213/classes.dex differ
Only in /tmp/flash_built_68_2289213: lib
Only in /tmp/flash_built_68_2289213/res: 5z.kml
Only in /tmp/flash_built_68_2289213/res: 6G.kml
Only in /tmp/flash_built_68_2289213/res: 9a.mp3
Only in /tmp/flash_official_68_2289213/res: anim
Only in /tmp/flash_official_68_2289213/res: animator
Only in /tmp/flash_official_68_2289213/res: animator-v21
Only in /tmp/flash_official_68_2289213/res: anim-v21
Only in /tmp/flash_official_68_2289213/res: anim-v33
Only in /tmp/flash_built_68_2289213/res: bl.kml
Only in /tmp/flash_built_68_2289213/res: BO.kml
Only in /tmp/flash_built_68_2289213/res: DH.kml
Only in /tmp/flash_official_68_2289213/res: drawable
Only in /tmp/flash_official_68_2289213/res: drawable-anydpi-v23
Only in /tmp/flash_official_68_2289213/res: drawable-hdpi-v4
Only in /tmp/flash_official_68_2289213/res: drawable-mdpi-v4
Only in /tmp/flash_official_68_2289213/res: drawable-v21
Only in /tmp/flash_official_68_2289213/res: drawable-v23
Only in /tmp/flash_official_68_2289213/res: drawable-v29
Only in /tmp/flash_official_68_2289213/res: drawable-watch-v20
Only in /tmp/flash_built_68_2289213/res: E1.kml
Only in /tmp/flash_official_68_2289213/res: font
Only in /tmp/flash_built_68_2289213/res: gB.gif
Only in /tmp/flash_built_68_2289213/res: Im.kml
Only in /tmp/flash_official_68_2289213/res: interpolator
Only in /tmp/flash_official_68_2289213/res: interpolator-v21
Only in /tmp/flash_built_68_2289213/res: kA.kml
Only in /tmp/flash_built_68_2289213/res: kr.kml
Only in /tmp/flash_official_68_2289213/res: layout
Only in /tmp/flash_official_68_2289213/res: layout-land
Only in /tmp/flash_official_68_2289213/res: layout-ldrtl-v17
Only in /tmp/flash_official_68_2289213/res: layout-sw600dp-v13
Only in /tmp/flash_official_68_2289213/res: layout-v21
Only in /tmp/flash_official_68_2289213/res: layout-v23
Only in /tmp/flash_official_68_2289213/res: layout-v26
Only in /tmp/flash_official_68_2289213/res: layout-watch-v20
Only in /tmp/flash_built_68_2289213/res: LJ.kml
Only in /tmp/flash_official_68_2289213/res: mipmap-anydpi-v26
Only in /tmp/flash_official_68_2289213/res: mipmap-hdpi-v4
Only in /tmp/flash_official_68_2289213/res: mipmap-mdpi-v4
Only in /tmp/flash_official_68_2289213/res: mipmap-xhdpi-v4
Only in /tmp/flash_official_68_2289213/res: mipmap-xxhdpi-v4
Only in /tmp/flash_official_68_2289213/res: mipmap-xxxhdpi-v4
Only in /tmp/flash_built_68_2289213/res: mZ.kml
Only in /tmp/flash_built_68_2289213/res: Od.kml
Only in /tmp/flash_built_68_2289213/res: -o.kml
Only in /tmp/flash_built_68_2289213/res: qN.kml
Only in /tmp/flash_official_68_2289213/res: raw
Only in /tmp/flash_built_68_2289213/res: RV.ttf
Only in /tmp/flash_built_68_2289213/res: s4.kml
Only in /tmp/flash_built_68_2289213/res: UA.kml
Only in /tmp/flash_built_68_2289213/res: ui.kml
Only in /tmp/flash_built_68_2289213/res: VF.kml
Only in /tmp/flash_official_68_2289213/res: xml
Only in /tmp/flash_built_68_2289213/res: Xo.kml
Only in /tmp/flash_built_68_2289213/res: yq.kml
Files /tmp/flash_official_68_2289213/resources.arsc and /tmp/flash_built_68_2289213/resources.arsc differ
Only in /tmp/flash_official_68_2289213: stamp-cert-sha256

would be great if you guys can look into it and resolve the issue. you can see the test details and my detailed review here - https://walletscrutiny.com/android/com.lnflash/

[abh3po]

@Nodirbek75 can you check this?

[Nodirbek75]

Hi @keraliss ,
We believe the differences you found may be due to a comparison against the Play Store APK rather than our published release APK. Here's the issue:

We upload an AAB (Android App Bundle) to the Play Store, which Google then transforms into a device-optimized APK via their bundletool pipeline. This transformation re-processes resources, re-obfuscates asset names, re-signs with Google's key (adding stamp-cert-sha256), and reorganizes the lib/ folder — which would explain the majority of the differences you observed.

For reproducibility testing, we publish a signed APK directly on our GitHub Releases page which is the correct artifact to compare against:
👉 https://github.com/lnflash/flash-mobile/releases/tag/v0.4.9-beta

Could you re-run the reproducibility test comparing your local build against the GitHub release APK instead of the Play Store APK? We believe this should significantly reduce or eliminate the differences found.

Please make sure to use the same version/build number for both. Let us know if you need any clarification or run into any issues — happy to help!

[patoo0x]

📋 Definition of Done

⚠️ Bundled bounty: This issue is bundled with flash#302 and #591. See the full DoD and 500,000 sats bounty details on flash#302.

[chengyixu]

Proposal

I'd like to address the reproducibility issue as part of the bundled bounty.

Approach:

• Analyze the 65 non-image differing files to identify root cause — likely candidates: build timestamps embedded in DEX/manifest, R8/ProGuard non-determinism, or dependency version drift between local and CI builds
• Pin all Gradle dependency versions (no dynamic + versions), set SOURCE_DATE_EPOCH for deterministic timestamps, configure ProGuard seed and mapping consistency
• Verify the fix by building from a clean environment and diffing against the published release APK

Timeline: 2-3 days

Available immediately! cc @Nodirbek75 @abh3po