buildMetaData task doesn't generate reproducible binaries

未关闭

#1,885 创建于 2025年11月27日 0 条评论 2 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

难度: 4/5
预计耗时: 3-5 天
新手友好度: 45/100

Issue 类型: 缺陷
描述清晰度: 基本清楚
活跃度: 停滞
技术栈: android
领域: build-system, mobile-dev

调研方向

首先定位 Android runtime 中的 buildMetaData 任务，并在本地以及 Docker、Podman 或 GitHub Actions 环境中复现 APK 生成过程。使用 diffoscope 比较输出；对于相同的 compileSdk，无论环境如何，元数据二进制文件都逐字节完全一致即表示完成。

由索引模型根据 Issue 内容生成。

描述

Environment
Provide version numbers for the following components (information can be retrieved by running tns info in your project folder or by inspecting the package.json of the project):

CLI: 9.0.1
Cross-platform modules:
Android Runtime: 8.9.2 and 9.0.0
iOS Runtime (if applicable): -
Plugin(s): -

Describe the bug
buildMetaData task generates metadata binaries that are not deterministic and reproducible, Even with the same --compileSdk version set and exact Java, SDK, etc.. So, security checks will fail specially in opensource app stores like IzzyOnDroid and F-Droid.
The issue might be related to using methods like listFiles() without performing a sort on files or maybe different locale properties, I'm just guessing from my researches.
I've attached a diffoscope result to see the difference.

diff-with-upstream.html

To Reproduce

Generate an APK locally
Generate the same APK using a docker/podman container or Github actions
diff the results using any tool like diffoscope

Expected behavior
The metadata binaries should be exactly same for a specific compileSdk without considering which environment its running the buildMetaData task.

主要语言: C++
星标: 563
派生: 144
平均合并: 10 小时 46 分钟
30 天内合并 PR: 14