Reproducible Builds - Feature Suggestion from WalletScrutiny.com Team

[xrviv]

Hello Verus Mobile Team 👋

I'm Danny, with the WalletScrutiny.com team.

We’re excited to let you know that WalletScrutiny will soon add your Android wallet, with Google Play app ID: "org.autonomoussoftwarefoundation.verusmobile.android" in our list of apps due to be verified for reproducibility.

Where to View & Contribute

Once my merge request is approved, you would be able to add your own attestation here:

• walletscrutiny.com/android/org.autonomoussoftwarefoundation.verusmobile.android

Feel free to drop in security notes, CI insights, or reproducible build instructions or any other context you’d like prospective auditors to see.
Our methodology.

Why Reproducibility Matters

Reproducible Builds ensure that “given the same source code, build environment and build instructions, any party can recreate bit-for-bit identical copies of all specified artifacts” Definition: Wikipedia. By publishing your reproducible build results, you bolster community trust and set a strong countermeasure against supply-chain tampering.

reproducible-builds.org

Example in Action: Bitkey App’s Android Verification

For a hands-on demonstration, see how Bitkey automates building and verifying its Android APKs step-by-step:
https://github.com/proto-at-block/bitkey/blob/main/app/verifiable-build/android/README.md

Their scripts pull an APK off a device, rebuild locally in CI, then diff the results—all in one workflow. With sufficient build instructions, independent builders could apply the same approach to Verus Mobile. And you could also do so yourself!

We look forward to showcasing your project’s integrity on WalletScrutiny! If you have questions or want to co-author the attestation, just let us know.

Kind Regards,

Daniel Garcia
walletscrutiny.com

[xrviv]

Update: Reproducibility Verification Completed - Results Show Significant Issues

We've completed a comprehensive reproducibility verification for Verus Mobile v1.0.30.
Unfortunately, the results confirm that the published Google Play Store version cannot be
reproduced from the public source code.

Key Findings:

• ✅ Build Success: Successfully built all variants (debug APK, release APK, release AAB)
  from source
• ❌ Reproducibility: Multiple critical differences prevent reproducing the official APK

Critical Issues Discovered:

1. Package Name Mismatch: Official APK uses
   org.autonomoussoftwarefoundation.verusmobile.android, but source code builds
   com.verusmobile
2. Missing Resources: 30+ drawable assets (crypto logos, custom icons) present in official
   APK but missing from buildable source
3. JavaScript Bundle Differences: Core application bundle differs between official and
   built versions
4. Dependency Mismatches: Different library versions (e.g., Kotlin Coroutines 1.8.0 vs
   1.7.3)

Impact:

This indicates the published application contains components, resources, or configurations not
available in the public repository, raising transparency concerns for users who expect to
verify the app matches the open source code.

Full Technical Report:

Complete verification details, build process, and diff analysis available at:
Report to follow once published

Date Verified: 2025-09-12
Verified By: WalletScrutiny.com

We recommend addressing these discrepancies to ensure users can independently verify the
published application matches the claimed open source code.

[michaeltout]

Hello, thank you for the analysis and the work that you do! WalletScrutiny seems interesting and I appreciate the service you guys are providing. Apologies for the late response to this issue, was caught up in a lot of work and travel lately, and was a little confused about what the initial issue meant (e.g. what were the next steps in your process). Now that you've provided feedback I would like to address some points:

1. The APK published to the play store is from the asf branch, so the package name will be org.autonomoussoftwarefoundation.verusmobile.android only on that branch. The APKs from the master branch are published in the GitHub releases page.

2. I believe this might be related to an issue where yarn bundle-android produces duplicate resources in drawable asset folders, preventing builds in some cases and requiring the deletion of those folders. If you're still interested in building I would be happy to assist but I can assure you that any assets in the APK are contained in the source. E.g. all crypto logos used in the app are contained in src/images/cryptologo.

3. I'm not really sure how without seeing diffs but this is most likely related to point 1, where the APK on the play store is published from the asf branch.

4. I'll have to look into this deeper but I suspect it might be related to point 1. @react-native-async-storage is the module that uses kotlin coroutines so I suspect its possible there may be a version mismatch somewhere between branches.