Version 4.0.22 from Google Play is not reproducible

[Giszmo]

Version 4.0.22 from Google Play is not reproducible

[angelix]

@Giszmo
Added a gradle task to help with this.
Please use ./gradlew useBlockstreamKeys next time before building.

[angelix]

@Giszmo Please check latest commit e38570c

[Giszmo]

That commit does not help reproduce 4.0.22 but I see better results in 4.0.23 now.

I see all the secrets were moved into one resource file - app_secrets.txt

The resulting /res/Re.txt containing a base64 encoded object with base64 encoded secrets should be documented though. I took the Re.txt and added

echo \"ewogICJicmVlel9hc...pUTT0iCn0=\" > green/src/main/res/raw/app_secrets.txt;

to my build script and that gives me one remaining whitespace diff in Re.txt: My Re.txt has a linefeed that yours doesn't. I really don't know what to do with this in terms of reproducibility attestation. Slippery slope ... Can't you provide this blob somehow nicer in the BUILD.md for reproducibility, only? Anybody maliciously stealing your API keys can already do so and with them in the documentation, nobody would accidentally use them for clones.