Build Reproducibility Verification Failure – OneKey v5.11.0 (Android)

[xrviv]

Summary:
Attempted to reproduce the OneKey Android app (v5.11.0) from source on Ubuntu 22.04 LTS.
While a debug build succeeded, all release build attempts failed due to Gradle daemon crashes, high memory usage, and external service authentication requirements (Sentry).\

No unsigned release APK suitable for reproducibility comparison could be generated.\

Full verification report (with asciicast and build logs) will be published on walletscrutiny.com.

(update: here)

Details:

• Repo: https://github.com/OneKeyHQ/app-monorepo

• Platform: Android

• Version: 5.11.0

• Build Environment: Ubuntu 22.04, Android SDK (API 34), JDK 17.0.10-tem, Gradle 8.13

• Total Attempts: 10 (9 failed, 1 successful debug build)

• Successful Build: Debug APK only --- unsuitable for verification due to signing/optimization differences

Key Issues:

1. Gradle daemon instability -- frequent crashes near build completion (Gradle build daemon disappeared unexpectedly).

2. System resource exhaustion -- freezes at 99.9% completion, >50min build times, high memory use during JS bundling.

3. Release build authentication requirements -- blocked by Sentry auth token requests.

4. Debug vs release limitations -- debug build not comparable to Google Play release.

Reproduction Barriers:

• Proprietary build secrets (Sentry, EAS) required for production builds.

• External service dependencies prevent offline/local reproducibility.

• No documented process for generating unsigned release APKs.

• CI/CD-oriented build pipeline not optimized for reproducible local builds.

Recommendation:

• Provide documented, dependency-free process for building unsigned release APKs locally.

• Reduce external service coupling for basic builds.

• Improve Gradle stability and memory efficiency in local environments.

Status: ❌ Failed -- Could not generate comparable release APK from source.

[xrviv]

Update: OneKey Android v5.12.1 Reproducibility Verification Results

Following up on the previous reproducibility discussion, we've
completed a comprehensive verification of OneKey Wallet Android v5.12.1.

🔍 Verification Results

• Status: ❌ Not Reproducible
• Builds Attempted: 2 independent builds with progressive fixes
• Analysis: Full APK extraction and diff comparison using apktool

📋 Key Findings

• Build Success: ✅ Both builds completed successfully
• Version Configuration: ✅ Fixed hardcoded versionCode/versionName in build.gradle
• Core Issues: ❌ Multiple blocking reproducibility problems remain

🚫 Blocking Issues Identified

1. Build Configuration Mismatch

   • Official uses production JPUSH_APPKEY, builds use test value "1"
   • Different manifest permissions (REQUEST_INSTALL_PACKAGES)

2. Non-Deterministic JavaScript Bundling

   • React Native index.android.bundle content completely differs
   • Web-embed chunks have different content hashes (40+ files)
   • Webpack/Metro lack deterministic configuration

3. Native Library Differences

   • All major .so files differ (expo-modules, realm, reanimated, etc.)
   • NDK compilation includes build timestamps/paths

🤝 Request for Assistance

To enable reproducible builds, could OneKey team help with:

1. Production Build Documentation: Share the exact environment variables and build configuration used for Play Store
   releases
2. Deterministic Bundling: Configure Webpack with optimization.chunkIds: 'deterministic'
3. NDK Reproducibility: Add build flags to remove timestamps from native libraries
4. Build Environment: Document/containerize the exact tool versions used

📄 Detailed Analysis

Full technical report with diff analysis and recommendations available in our WalletScrutiny Nostr
verification.

Any guidance on achieving reproducible builds would be greatly appreciated! 🙏