Oh, PS: I forgot to mention some nice numbers. We are now available in 4k – err, I mean, our main builder today reached 4,000 k packages coverage :awesome:
(2/2) eventful day. 6 RBs we had to fix, some failed. The Trixie upgrade to one of our builders temporarily disabled it, took us half a day to find and fix the culprits. I'm a zombie now…
3 unmaintained apps were removed:
M17 HT: almost no downloads anyway
Mobilinkd TNC Config: incl. Tracking; and almost no downloads
The Particulate Matter App: dead since 2021, and reported crashing; NonFreeDep+Tracking
And now you wonder why the shield turned green, right? Well: when after about 15 tries we always got the byte-identical APK, but not one matching the original, fate seemed to have been sealed. But I forgot to commit recipe & logs – and today, next to the "off-by-one" we got the "one time lucky", and succeeded reproducing the original APK.
Life's a bitch. And so are RBs, sometimes… Sometimes, they are like ferrets: you try to shoo them in front of you, but they come around and nip your calf 🙈
(2/2) We could have claimed: "Reproducible!" – as we were able to reproduce the very same APK over and again, on multiple builders even. But: it was not the APK "upstream" shipped we reproduced, just our own builds.
Hence, if you wonder about the warning shield at DavDroid v1.5.1: We could not reproduce THAT APK. But, the difference was minimal, and not in the code itself: it was just the baseline profile, which differed in number of "hot" (important) methods: https://developer.android.com/topic/performance/baselineprofiles/overview
DavDroid 4.5.1 unfortunately failed RB. Which shows the thin line between "deterministic" and "reproducible":
We were able to build the app umpteen times, and got the very same, byte identical APK on each build: deterministic. So, it was reproducible, right? Well: no. It didn't match the APK built by the developer. A very slight difference in this case, an "off-by-one" in the baseline (so don't you worry, it's just the optimizer).
Btw: kudos for this go to @bg443@floss.social – who runs an independent builder (i.e. Ben is not a member of IzzyOnDroid himself, but his builder covers several of our apps. So it's verifying our builders are telling the truth, so to say).
So while IoD takes the APKs directly from the devs, our builders verify they were indeed built from the source code the devs claim to – while independents like Ben verify we're not "cheating". The winners are YOU :awesome:
@sabreW4K3@eattherich.club "time to" hits it, with 4+ hours each day going into it. Would I get paid for the work that went into it, I could take a year off and have a "world tour" I guess. It's 12 years now, feel free to draw the "bill" 🙈
Thanks for the warm words, motivation like this keeps us going 🤗
@iNeedADoctor@social.anoxinon.de Yeah, but the APKs are more than twice the per-app size limit we have, unfortunately (69 MB for the no-google variant; limit here is 30 MB).
10 apps were removed as they haven't been updated long time, and their sources have since disappeared.
for 6 more such apps we found the sources elsewhere, so we've kept them.
for 2 apps the source repos re-surfaced, so we were able to restore them. One more will follow soon as we were able to reach the dev, who will restore the source repo.
Nitterify was found on Codeberg, having also changed its packageName. An update is available, so please switch over.
@lauteshirn@social.tchncs.de Passwörter sollten automatisch wieder aus der Zwischenablage entfernt werden. "… tauchen auch Passwörter auf, die beispielsweise aus einem Passwort-Manager kopiert wurden …" sollte daher eigentlich nicht passieren.
Ob das jetzt allerdings die Schuld der Zwischenablage ist, die Kopien aus Safes entsprechend behandeln sollte – oder das Problem eines Safes, der das nicht entsprechend kommuniziert hat, geht aus dem Artikel allerdings in der Tat nicht hervor.
@MichaelZ@norden.social You do understand correctly. Unfortunately, the adb backup command was pretty much castrated from around Android 10 onward, and no replacement provided. So reliable backups cannot be done with that anymore.
If your device is rooted, Adebar provides replacements for backup/restore, too – otherwise, you can still use it for device documentation. Sorry, not much that can be done about that (apart from using a companion app, which I cannot provide).
@ananas Yes, please do! 🤣 But no worries, the Knapsack is not an endangered species. Yet 🙊 💨
(2/2) Removed apps in this round:
Oh, PS: I forgot to mention some nice numbers. We are now available in 4k – err, I mean, our main builder today reached 4,000 k packages coverage :awesome:
> 4000 packages, 3875 reproducible
RB status: 687 apps (52.2%)
#reproducibleBuilds #IzzyOnDroid
@SamantazFox@infosec.exchange Thanks! I'd like to sleep now for a full day. Or 2. Maybe 3, idk… Luckily, it seems everything's in order again now…
(2/2) eventful day. 6 RBs we had to fix, some failed. The Trixie upgrade to one of our builders temporarily disabled it, took us half a day to find and fix the culprits. I'm a zombie now…
3 unmaintained apps were removed:
More another day, please excuse me for now…
Our RBs are also through now – luckily not too many issues on the one leg:
661 apps (50.4%)
Shields are up! 🛡️
(2/2)
And just 15 days before the first anniversary of our public RB GoLive (which happened on August 1st, 2024), we've reached 50% coverage:
Every 2nd app at IzzyOnDroid is now RB! 🥳
#reproducibleBuilds #IzzyOnDroid
And now you wonder why the shield turned green, right? Well: when after about 15 tries we always got the byte-identical APK, but not one matching the original, fate seemed to have been sealed. But I forgot to commit recipe & logs – and today, next to the "off-by-one" we got the "one time lucky", and succeeded reproducing the original APK.
Life's a bitch. And so are RBs, sometimes… Sometimes, they are like ferrets: you try to shoo them in front of you, but they come around and nip your calf 🙈
(2/2) We could have claimed: "Reproducible!" – as we were able to reproduce the very same APK over and again, on multiple builders even. But: it was not the APK "upstream" shipped we reproduced, just our own builds.
Hence, if you wonder about the warning shield at DavDroid v1.5.1: We could not reproduce THAT APK. But, the difference was minimal, and not in the code itself: it was just the baseline profile, which differed in number of "hot" (important) methods: https://developer.android.com/topic/performance/baselineprofiles/overview
Speaking of RB:
DavDroid 4.5.1 unfortunately failed RB. Which shows the thin line between "deterministic" and "reproducible":
We were able to build the app umpteen times, and got the very same, byte identical APK on each build: deterministic. So, it was reproducible, right? Well: no. It didn't match the APK built by the developer. A very slight difference in this case, an "off-by-one" in the baseline (so don't you worry, it's just the optimizer).
#reproducibleBuilds #IzzyOnDroid (1/2)
Btw: kudos for this go to @bg443@floss.social – who runs an independent builder (i.e. Ben is not a member of IzzyOnDroid himself, but his builder covers several of our apps. So it's verifying our builders are telling the truth, so to say).
So while IoD takes the APKs directly from the devs, our builders verify they were indeed built from the source code the devs claim to – while independents like Ben verify we're not "cheating". The winners are YOU :awesome:
#reproducibleBuilds #IzzyOnDroid
(2/2) at https://apt.izzysoft.de/magisk there were 2 #Magisk modules added and 3 updated today:
Enjoy those, too, should you use Magisk or KernelSU :awesome:
Status there: 134 FOSS modules available
@sabreW4K3@eattherich.club "time to" hits it, with 4+ hours each day going into it. Would I get paid for the work that went into it, I could take a year off and have a "world tour" I guess. It's 12 years now, feel free to draw the "bill" 🙈
Thanks for the warm words, motivation like this keeps us going 🤗
@sabreW4K3@eattherich.club Thanks! Still hoping to reach the 50% mark in Q3… 🙈
@MichaelZ@norden.social Is it possible to know all those details about 1300+ apps in the repo? 😉 I cannot tell, sorry, I'm not using all apps myself…
@iNeedADoctor@social.anoxinon.de Yeah, but the APKs are more than twice the per-app size limit we have, unfortunately (69 MB for the no-google variant; limit here is 30 MB).
accompanying AndroidAppDrain:
@lauteshirn@social.tchncs.de Passwörter sollten automatisch wieder aus der Zwischenablage entfernt werden. "… tauchen auch Passwörter auf, die beispielsweise aus einem Passwort-Manager kopiert wurden …" sollte daher eigentlich nicht passieren.
Ob das jetzt allerdings die Schuld der Zwischenablage ist, die Kopien aus Safes entsprechend behandeln sollte – oder das Problem eines Safes, der das nicht entsprechend kommuniziert hat, geht aus dem Artikel allerdings in der Tat nicht hervor.
@jak2k@mastodontech.de with Kreate, a new fork emerged. But yes, what happened to RiMusic is a tragedy.
@MichaelZ@norden.social You do understand correctly. Unfortunately, the
adb backupcommand was pretty much castrated from around Android 10 onward, and no replacement provided. So reliable backups cannot be done with that anymore.If your device is rooted, Adebar provides replacements for backup/restore, too – otherwise, you can still use it for device documentation. Sorry, not much that can be done about that (apart from using a companion app, which I cannot provide).