Reproducible Build fails for v0.7

[IzzySoft]

… with a diff in the DEX showing ordering differences:

 | gv.<init>:(Lg9;Ljava/util/ArrayList;Landroid/content/Context;Landroid/view/View;)V
-|: iput-object v6, v2, Lgv;.q:Landroid/view/View;
 |: iput-object v3, v2, Lgv;.r:Lg9;
+|: iput-object v6, v2, Lgv;.q:Landroid/view/View;
 |: invoke-direct {v2, v5}, Ld7;.<init>:(Landroid/content/Context;)V
 |: const v3, #float 1.84764e+38 // #7f0b0035
 |: const/4 v6, #int 0 // #0
@@ -159308,8 +159308,8 @@
       insns size    : 10 16-bit code units
 | je.<init>:(Li6;Ljava/lang/String;Ljava/lang/String;Li6;Landroidx/recyclerview/widget/RecyclerView;I)V
 |: iput v6, v0, Lje;.d:I
-|: iput-object v5, v0, Lje;.e:Landroidx/recyclerview/widget/RecyclerView;
 |: iput-object v1, v0, Lje;.f:Li6;
+|: iput-object v5, v0, Lje;.e:Landroidx/recyclerview/widget/RecyclerView;
 |: invoke-direct {v0, v4, v2, v3}, Lp0;.<init>:(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V
 |: return-void                                             
       catches       : (none)                               
@@ -167182,9 +167182,9 @@                                   
       outs          : 4                                    
       insns size    : 10 16-bit code units                 
 | kv.<init>:(Llv;Ljava/lang/String;Ljava/lang/String;Lr2;Landroidx/appcompat/widget/AppCompatImageView;Landroidx/recyclerview/widget/RecyclerView;
+|: iput-object v1, v0, Lkv;.f:Llv;                           
 |: iput-object v5, v0, Lkv;.d:Landroidx/appcompat/widget/AppCompatImageView;
 |: iput-object v6, v0, Lkv;.e:Landroidx/recyclerview/widget/RecyclerView;
-|: iput-object v1, v0, Lkv;.f:Llv;
 |: invoke-direct {v0, v4, v2, v3}, Lp0;.<init>:(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V
 |: return-void
       catches       : (none)
@@ -256482,8 +256482,8 @@
       insns size    : 8 16-bit code units
 | zf.<init>:(Lag;Landroidx/recyclerview/widget/RecyclerView;)V
 |: invoke-direct {v0}, Ljava/lang/Object;.<init>:()V       
-|: iput-object v2, v0, Lzf;.a:Landroidx/recyclerview/widget/RecyclerView;
 |: iput-object v1, v0, Lzf;.b:Lag;
+|: iput-object v2, v0, Lzf;.a:Landroidx/recyclerview/widget/RecyclerView;
 |: return-void

Could it be you've built this APK locally, using Android Studio, and the Jetbrains JDK?

[sunilpaulmathew]

… with a diff in the DEX showing ordering differences:

 | gv.<init>:(Lg9;Ljava/util/ArrayList;Landroid/content/Context;Landroid/view/View;)V
-|: iput-object v6, v2, Lgv;.q:Landroid/view/View;
 |: iput-object v3, v2, Lgv;.r:Lg9;
+|: iput-object v6, v2, Lgv;.q:Landroid/view/View;
 |: invoke-direct {v2, v5}, Ld7;.<init>:(Landroid/content/Context;)V
 |: const v3, #float 1.84764e+38 // #7f0b0035
 |: const/4 v6, #int 0 // #0
@@ -159308,8 +159308,8 @@
       insns size    : 10 16-bit code units
 | je.<init>:(Li6;Ljava/lang/String;Ljava/lang/String;Li6;Landroidx/recyclerview/widget/RecyclerView;I)V
 |: iput v6, v0, Lje;.d:I
-|: iput-object v5, v0, Lje;.e:Landroidx/recyclerview/widget/RecyclerView;
 |: iput-object v1, v0, Lje;.f:Li6;
+|: iput-object v5, v0, Lje;.e:Landroidx/recyclerview/widget/RecyclerView;
 |: invoke-direct {v0, v4, v2, v3}, Lp0;.<init>:(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V
 |: return-void                                             
       catches       : (none)                               
@@ -167182,9 +167182,9 @@                                   
       outs          : 4                                    
       insns size    : 10 16-bit code units                 
 | kv.<init>:(Llv;Ljava/lang/String;Ljava/lang/String;Lr2;Landroidx/appcompat/widget/AppCompatImageView;Landroidx/recyclerview/widget/RecyclerView;
+|: iput-object v1, v0, Lkv;.f:Llv;                           
 |: iput-object v5, v0, Lkv;.d:Landroidx/appcompat/widget/AppCompatImageView;
 |: iput-object v6, v0, Lkv;.e:Landroidx/recyclerview/widget/RecyclerView;
-|: iput-object v1, v0, Lkv;.f:Llv;
 |: invoke-direct {v0, v4, v2, v3}, Lp0;.<init>:(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;)V
 |: return-void
       catches       : (none)
@@ -256482,8 +256482,8 @@
       insns size    : 8 16-bit code units
 | zf.<init>:(Lag;Landroidx/recyclerview/widget/RecyclerView;)V
 |: invoke-direct {v0}, Ljava/lang/Object;.<init>:()V       
-|: iput-object v2, v0, Lzf;.a:Landroidx/recyclerview/widget/RecyclerView;
 |: iput-object v1, v0, Lzf;.b:Lag;
+|: iput-object v2, v0, Lzf;.a:Landroidx/recyclerview/widget/RecyclerView;
 |: return-void

Could it be you've built this APK locally, using Android Studio, and the Jetbrains JDK?

Yes, that is correct. I am building the APK locally on Windows using Android Studio, which utilizes the default bundled JetBrain for the build process.

[IzzySoft]

Can you switch that to one of the following JDKs (order of preferences) please?

• OpenJDK
• Temurin
• Adopt

The above "RB breaker" is typical for JBR. We had it years ago, then a while silence, and currently it seems to pop in again…

Meanwhile, we'll have to declare v0.7 failed. But if you can rebuild the APK with one of the mentioned 3, we could at least make sure that clears the culprit.

[sunilpaulmathew]

Can you switch that to one of the following JDKs (order of preferences) please?

* OpenJDK

* Temurin

* Adopt

The above "RB breaker" is typical for JBR. We had it years ago, then a while silence, and currently it seems to pop in again…

Meanwhile, we'll have to declare v0.7 failed. But if you can rebuild the APK with one of the mentioned 3, we could at least make sure that clears the culprit.

I just replaced the latest release apk with a new one built with OpenJDk 26. Do you mind having a look, when you have time?

[IzzySoft]

I just replaced the latest release apk

Oof. You're aware that that will go nowhere? Never replace what was already distributed – our repo already has the previous one, now there's a different one at the release, so zero chance for RB as the two can't ever match…

built with OpenJDk 26

Sorry, but we cannot match that – that's no LTS. We currently can do 11, 17, 21, 25.

Do you mind having a look, when you have time?

Tried with the original recipe (using OpenJDK 17), diff looks the same – maybe you've built with 21 or 25 already before? Trying now with 25 🤞 Luckybastard! That is RB! 🥳

So maybe make a new release then, using OpenJDK 25? Some other minor change you could include, to "justify" a 0.7.1 "patch release"? Ah, there:

Android Signing Block verification:
-----------------------------------
* Google blocks:
  * Has "Dependency Info" block (0x504B4453): Yes

Please add a few lines to your build.gradle to get rid of that blob:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs (for IzzyOnDroid/F-Droid)
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles (for Google Play)
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains. More details can be found e.g. in our documentation on Signing Block Checks at our website, and in our blog article Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.

And that might then justify the 0.7.1. For the 8.txt in your Fastlane changelogs:

* fix RB issue
* remove Google DEPENDENCY_INFO_BLOCK

Make it a pre-release first if you want me to check before it gets picked up 😉