git.iko.soy/Multigram
on multigram help sign in
Multigram/scripts/reproducible-build.sh
56 lines 2.0 kB history raw
1#!/usr/bin/env bash
2# Build the release APK inside a pinned Docker image for byte-for-byte
3# reproducibility. SOURCE_DATE_EPOCH is derived from the HEAD commit so the
4# same git revision always produces the same archive timestamps.
5#
6# Usage:
7# scripts/reproducible-build.sh [gradle-task]
8#
9# Default task: :TMessagesProj_App:assembleAfatRelease
10# Output: TMessagesProj_App/build/outputs/apk/...
12set -euo pipefail
14REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
15cd "$REPO_ROOT"
17GRADLE_TASK="${1:-:TMessagesProj_App:assembleAfatRelease}"
18IMAGE_TAG="${IMAGE_TAG:-telegramandroid-reproducible:latest}"
20if [ -z "${SOURCE_DATE_EPOCH:-}" ]; then
21 SOURCE_DATE_EPOCH="$(git log -1 --format=%ct HEAD)"
22fi
23export SOURCE_DATE_EPOCH
25echo "==> SOURCE_DATE_EPOCH = ${SOURCE_DATE_EPOCH} ($(date -u -r "${SOURCE_DATE_EPOCH}" '+%Y-%m-%d %H:%M:%S UTC' 2>/dev/null || date -u -d "@${SOURCE_DATE_EPOCH}"))"
26echo "==> Gradle task = ${GRADLE_TASK}"
27echo "==> Docker image = ${IMAGE_TAG}"
29echo "==> Building Docker image..."
30docker build -t "${IMAGE_TAG}" -f docker/Dockerfile docker/
32echo "==> Running Gradle build inside container..."
33docker run --rm \
34 -v "${REPO_ROOT}:/project" \
35 -w /project \
36 -e SOURCE_DATE_EPOCH \
37 -e GRADLE_OPTS="-Dorg.gradle.daemon=false -Duser.timezone=UTC" \
38 "${IMAGE_TAG}" \
39 bash -c "
40 set -e
41 # Prebuild the native dependencies that are not part of the gradle
42 # externalNativeBuild graph.
43 cd TMessagesProj/jni
44 export NDK=\${ANDROID_NDK_HOME}
45 export NINJA_PATH=/usr/bin/ninja
46 ./ffmpeg/build_ffmpeg_libvpx_dav1d_android_ndk27_merged.sh
47 ./patch_boringssl.sh
48 ./build_boringssl.sh
49 cd /project
50 ./gradlew --no-daemon --init-script reproducible.gradle ${GRADLE_TASK}
51 "
53echo "==> Build artifacts:"
54find TMessagesProj_App/build/outputs/apk -name '*.apk' -print 2>/dev/null | while read -r apk; do
55 sha256sum "$apk"
56done