Reproducibility report — Android 2026.8.0 (fdroid APK)
An independent rebuild of the v2026.8.0-bwpm tag (commit 8be53c1) with a read:packages token resolving com.bitwarden:sdk-android:3.0.0-8157-eb825d59 produced an APK that matches the official release APK in 659 of 661 ZIP entries (identical: resources.arsc, AndroidManifest.xml, version-control-info.textproto, all resources and native libs).
Two entries differ:
-
classes.dex — the only string-level differences are CI provenance baked into the binary:
build source: bitwarden/android/actions/runs/31214376447/attempts/1 commit: bitwarden/android/release/2026.8-rc60@8be53c1ae519ab417b64b0d2154f9815adf7c44a
The variable-length CI-info string shifts subsequent offsets, scattering ~700KB of bytes with zero semantic difference. Providing ci.properties (or documenting ci.info) for release builds, or making the CI-info injection length-stable, would make this APK byte-for-byte reproducible by third parties.
-
assets/dexopt/baseline.prof — likely downstream of the same offset shifts.
Note: appVersionName/appVersionCode in gradle/libs.versions.toml are not bumped on the tag, so rebuilders must pin 2026.8.0/21819 manually; tagging with the values already set would remove another manual step.
Verdict: near-reproducible — only CI provenance metadata blocks byte-identity. Attestation (kind 30301) published; happy to share build details.
Reproducibility report — Android 2026.8.0 (fdroid APK)
An independent rebuild of the
v2026.8.0-bwpmtag (commit 8be53c1) with a read:packages token resolvingcom.bitwarden:sdk-android:3.0.0-8157-eb825d59produced an APK that matches the official release APK in 659 of 661 ZIP entries (identical:resources.arsc,AndroidManifest.xml,version-control-info.textproto, all resources and native libs).Two entries differ:
classes.dex— the only string-level differences are CI provenance baked into the binary:build source: bitwarden/android/actions/runs/31214376447/attempts/1commit: bitwarden/android/release/2026.8-rc60@8be53c1ae519ab417b64b0d2154f9815adf7c44aThe variable-length CI-info string shifts subsequent offsets, scattering ~700KB of bytes with zero semantic difference. Providing
ci.properties(or documentingci.info) for release builds, or making the CI-info injection length-stable, would make this APK byte-for-byte reproducible by third parties.assets/dexopt/baseline.prof— likely downstream of the same offset shifts.Note:
appVersionName/appVersionCodeingradle/libs.versions.tomlare not bumped on the tag, so rebuilders must pin2026.8.0/21819manually; tagging with the values already set would remove another manual step.Verdict: near-reproducible — only CI provenance metadata blocks byte-identity. Attestation (kind 30301) published; happy to share build details.