platform-27_r01.zip was overwritten with a new update [70292819]

Fixed

Bug

[AOSP] assigned

Status Update

No update yet.

Description

ha...@guardianproject.info

created issue #1

Dec 6, 2017 10:37PM

platform-27_r01.zip was originally released with ro.build.version.incremental=4402310 and SHA-256 of cbba6f8fcf025e1b533326746763aa1d6e2cf4001b1b441602bb44d253bc49ac in October. About two weeks ago, it was overwritten with a new release ro.build.version.incremental=4458339 and a SHA-256 of 96ddff1a5034fcc4340f2d482635eeaccaa6707b6b0f82d26d1435476a2f52e5. There are large differences between the two:

https://verification.f-droid.org/build-metadata/platform-27_r01.html

This totally breaks reproducible builds since it is not even possible to redownload the original platform-27_r01.zip. We're tracking this issue here:

https://gitlab.com/fdroid/fdroidserver/merge_requests/401

Comments

ha...@at.or.at <ha...@at.or.at> #2Dec 9, 2017 08:44AM

Looks like cbba6f8fcf025e1b533326746763aa1d6e2cf4001b1b441602bb44d253bc49ac was put back as platform-27_r01.zip, but no platform-27_r02.zip yet.

am...@google.com <am...@google.com> #3Dec 12, 2017 12:00PM

Assigned to am...@google.com.

Thank you for reporting this issue. We have shared this with our product and engineering team and will update this issue with more information as it becomes available.

ha...@guardianproject.info <ha...@guardianproject.info> #4Dec 12, 2017 12:07PM

It seems the original one has been put back now, this is what I'm seeing now:

$ sha256sum platform-27_r01.zip
cbba6f8fcf025e1b533326746763aa1d6e2cf4001b1b441602bb44d253bc49ac platform-27_r01.zip
$ sha1sum platform-27_r01.zip
dfda0862550768ed04a4fb0e03c322230aff9fdc platform-27_r01.zip

ha...@guardianproject.info <ha...@guardianproject.info> #5Dec 21, 2017 09:41PM

It seems to be flipping back and forth, back and forth between the two. There is this wonderful property to have in software binary release systems known as "binary transparency". I would love to see Google practice this

https://www.eff.org/deeplinks/2014/02/open-letter-to-tech-companies. Using version numbers when releases change would also be handy.

ha...@guardianproject.info <ha...@guardianproject.info> #6Dec 21, 2017 09:46PM

I stuck both binaries here, you can verify them by the familiar SHA-256 sums ;-)

https://verification.f-droid.org/build-metadata/

dn...@google.com <dn...@google.com> #7Aug 24, 2018 11:38AM

Marked as fixed.

The development team has fixed the issue that you have reported.

Issue 70292819