Failed to verify the build on GooglePlay #232
Comments
|
Thanks for the report and for sharing those, we've had reproducible builds on our todo list for a while but didn't have time to work on it yet. |
|
How is it going? Eclair could still be |
|
It's going to take some time. Verifiable builds on Java/Scala aren't that easy to integrate with our build setup, and Maven is making changes towards that direction but it's still a WIP on their side. |
|
Excuse me, 3 months went by and I see no progress here. Could you please elaborate how maven is to blame for your wallet not to be verifiable and how you can pick a build system that cannot produce verifiable builds for a Bitcoin wallet? The release manager put under duress could any day inject a wallet stealer into a release and steal all the funds of all the users in an instance. Is that acceptable by your standards? |
|
The release manager put under duress could any day inject a wallet
stealer into a release and steal all the funds of all the users in an
instance. Is that acceptable by your standards?
<greta_howdareyou.gif>
What if I told you that the release manager is also the main developer.
You're trusting him anyway, except if you review the code. Not to mention
that 99.9% of our users download the app from Google Play.
I agree that reproductible builds are a good thing, but the entitlement
here is a bit over the top. This is FOSS, either submit a PR or be patient.
Le dim. 29 mars 2020 à 01:44, Leo Wandersleb <[email protected]> a
écrit :
… Excuse me, 3 months went by and I see no progress here. Could you please
elaborate how maven is to blame for your wallet not to be verifiable and
how you can pick a build system that cannot produce verifiable builds for a
Bitcoin wallet? The release manager put under duress could any day inject a
wallet stealer into a release and steal all the funds of all the users in
an instance. Is that acceptable by your standards?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#232 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAPPFPTQHMKZEV4IR4IIZRLRJ2KXPANCNFSM4J6LH3NA>
.
|
|
Sorry, I'm normally with you regarding open source not giving users the right to demand anything but walletscrutiny.com is aiming to find bad actors that try to pull the rug under the feet of their users at some point. While my gut feelings are much more sympathetic towards ACINQ than other providers that are more elusive, I have to develop some rigid metrics by which to categorize apps. I hope to get the word out there to not trust non-verifiable apps on Google Play with any money and at this point, Eclair is not verifiable. I would love to not have to warn against its use as I use it myself. In the end, there is an open source project and there is a Playstore app and the critique goes against the Playstore app provider not against the open source developer. GitHub is just a much more transparent and easy way to deliver the message, so if you are not the Playstore app provider, please don't feel offended personally. The burden of proof of having provided an app based on public code is on the release manager, not on the developer. |
You didn't make much effort to look before accusing... It's very easy to judge and complain, but if you hope to inform your users you could at least spend 5 minutes looking at the repository's activity before claiming no progress is being made. We have shipped deterministic builds on the server in our latest release (ACINQ/eclair@a028645), and are making steady progress towards deterministic builds for eclair-mobile and phoenix. Even just googling for "eclair mobile deterministic build" returns results showing the progress. Right now the apps still aren't deterministic, but that will come. Please be patient and don't use it in the meantime if you don't trust it. |
|
At https://walletscrutiny.com/ we currently track 92 apps. Please don't get personally offended if I don't start investigations from zero when the very specific issue has not been updated in 3 months and thank you for the progress. The goal is to develop solid rules and to get users and providers to care enough so that non-verifiability is considered a huge red flag and nobody recommends non-verifiable apps. We are not there yet and providers are thus given huge slack anyway but when your main focus is "How would you steal funds from unsuspecting users", this is a big deal. I understand that until it generally is a big deal, any wallet that doesn't see it as their top priority to fix it, isn't sticking out much. I hope to work together with wallets that do the right thing, so we can push to the fringes wallets that don't and have no doubt Eclair will be verifiable soon, too. |
|
Hiho, at the risk of offending you again, is there any progress? Should I try to rebuild your app and get it into the "reproducible" section of the listing or is https://walletscrutiny.com/android/fr.acinq.eclair.wallet.mainnet2/ still correct? |
|
Hello, the build is not reproducible for now, I need to port what has been done in Phoenix to this project. It should not be too hard but it still takes some time. I will update this issue when it's done. |
|
The app is currently fail to build, see opened issue: #266 |
|
Building latest version 0.4.16 works, compared the result to apk on github was: command Containerfile to compile the app: FROM frolvlad/alpine-glibc
RUN set -ex; \
apk update; \
apk add --no-cache \
bash \
git \
maven \
openjdk11; \
adduser -D appuser;
USER appuser
ENV ANDROID_HOME="/home/appuser/app/sdk" \
ANDROID_SDK_ROOT="/home/appuser/app/sdk"
RUN set -ex; \
mkdir -p "/home/appuser/app/sdk/licenses" "/home/appuser/app/eclair/"; \
printf "\n24333f8a63b6825ea9c5514f83c2829b004d1fee" > "/home/appuser/app/sdk/licenses/android-sdk-license"; \
printf "\n84831b9409646a918e30573bab4c9c91346d8abd" > "/home/appuser/app/sdk/licenses/android-sdk-preview-license"; \
cd /home/appuser/app/sdk/; \
wget https://dl.google.com/android/repository/commandlinetools-linux-7302050_latest.zip; \
echo "7a00faadc0864f78edd8f4908a629a46d622375cbe2e5814e82934aebecdb622 commandlinetools-linux-7302050_latest.zip" | sha256sum -c; \
unzip commandlinetools-linux-7302050_latest.zip; \
rm commandlinetools-linux-7302050_latest.zip; \
/home/appuser/app/sdk/cmdline-tools/bin/sdkmanager --sdk_root=/home/appuser/app/sdk/ --install --channel=1 "ndk-bundle" "ndk;23.0.7196353"; \
cd /home/appuser/app/eclair/; \
git clone https://github.com/ACINQ/eclair; \
cd /home/appuser/app/eclair/eclair/; \
git checkout v0.4.12-android; \
mvn clean install -DskipTests; \
cd /home/appuser/app/eclair; \
git clone https://github.com/ACINQ/eclair-mobile; \
cd /home/appuser/app/eclair/eclair-mobile; \
git checkout v0.4.16-MAINNET; \
./gradlew assembleReleasenext steps are to run diffoscope and look at the diffs and why they happen and also to write Containerfile based on ubuntu instead of alpine, as the RB PR use ubuntu: https://github.com/ACINQ/eclair-mobile/pull/236/files |
|
Ubuntu build fail with error, opened issue for it at #275, The above diff result was done when Both above Containerfile & when installation additional
Opened issue to declare specifc version for CMake: #276 For classes2.dex & classes3.dex using jadx like in Predef$.MODULE$.implicitly(incomingHtlcReadWriter()), (Types.BaseReader) Predef$.MODULE$.implicitly(outgoingHtlcReadWriter())})),in @@ -191,10 +191,10 @@
public Option<ByteVector32> getHash(ShaChain shaChain, Vector<Object> vector) {
return shaChain.knownHashes().keys().find(new Serializable(vector) { // from class: fr.acinq.eclair.crypto.ShaChain$$anonfun$getHash$1
public static final long serialVersionUID = 0;
- private final Vector index$1;
+ private final Vector index$2;
{
- this.index$1 = r1;
+ this.index$2 = r1;
}Other diff maybe cause different java version need to be used? |
I tried to verify the released version from GooglePlay matches the version on GitHub but had several issues. Could you please have a look into reproducible builds. I shared my findings here.
I suspect there are more hurdles than what I mentioned in my findings but so far my impression of Eclair was very good, so I hope we get this done.
The text was updated successfully, but these errors were encountered: