Are reproducible builds practically possible on major app stores?

Question

'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it.

But numerous sources^1,2 indicate reproducible builds are very difficult (or even impossible) to implement in practice on major app stores.

Some reasons listed include:

• app store processes and idiosyncrasies that alter source code
• complexities in software versions and compilers
• app thinning
• any random generators in the build process

And:

Usually, different compilations of the same code will not result in the same binary, even when using the same version of libraries, compiler, target, etc.

Given the concept of a 'reproducible build' is quite new, (its wiki page is less than 5 years old), and that methods may improve in coming years, is it reasonable to expect reproducible builds for entire apps in practice (i.e. on major app stores), or do insurmountable factors limit reproducible builds to being theoretically possible (and possible for a small subset of apps), but practically difficult if not impossible for most apps?

---

¹ _{https://news.ycombinator.com/item?id=23396499}

² _{https://web.archive.org/web/20200527063225if_/https://github.com/immuni-app/immuni-documentation/blob/master/Technology%20Description.md#reproducible-builds}

Answer 1

The answer is no, and that's because most major app stores require signing and generally the signature process used includes a timestamp. Timestamps are inherently non-reproducible. This is the case for both phone app stores and computer app stores.

If you wanted to ignore signatures, it probably is possible. Debian does it, and many pieces of software used during builds are probably already patched upstream by now. It may require a post-processing step for certain files, though, which most developers will not implement. So it is not reasonable to expect that anyone but the most security-conscious developers will implement it. For example, Signal does it for Android, but most developers do not.

Answer 2

Reproducible builds in an app store are not only possible, but they are standard practice in https://f-droid.org with many apps shipping via the reproducible process that requires that the f-droid.org buildserver can reproduce the APK from the source code before it will publish them.

Now the question mentioned a major app store, so with that, I have to assume the monopolists: Apple App Store and Google Play. With the Apple App Store, reproducible builds are impossible because publishing there means that the executable file is encrypted for their DRM (Digital Restrictions Management) system. It is not possible to reproduce an encrypted file without the private key.

For Google Play, it is possible, but there are caveats. If you have the source code, then it is possible to rebuild the APK and compare it to the one you got from Google Play. That comparison can be done by copying only the signature from the Google Play APK into the unsigned APK that you just built, then using standard methods for verifying APKs to see if the signature in your APK verifies. If so, you have achieved reproduction. There are tools and processes for doing that. If the app only publishes an AAB (Android App Bundle) to Google Play, then reproducible builds is not possible since Google Play assembles the APKs that the device installs based on the Android App Bundle.