From cc484479e1ddf0cd95cf2ab86dd1f7e55ead2813 Mon Sep 17 00:00:00 2001 From: shum Date: Fri, 28 Nov 2025 12:22:40 +0000 Subject: [PATCH 1/7] nix: make android aarch64 library reproducible --- flake.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/flake.nix b/flake.nix index a68b42e2f1..49fbd5143c 100644 --- a/flake.nix +++ b/flake.nix @@ -452,6 +452,12 @@ ./scripts/nix/direct-sqlcipher-android-log.patch ]; packages.simplex-chat.flags.client_library = true; + # Determenistic builds + packages.simplex-chat.components.library.ghcOptions = [ + "-j1" + "-dinitial-unique=0" + "-dunique-increment=1" + ]; packages.simplexmq.flags.client_library = true; packages.simplexmq.components.library.libs = pkgs.lib.mkForce [ (androidPkgs.openssl.override { static = true; }) @@ -542,6 +548,10 @@ done ${pkgs.tree}/bin/tree $out/_pkg + + # Set all files to init timestamp for determenistic zip archive + find $out/_pkg -type f -exec touch -d "1970-01-01 00:00:00 UTC" {} + + (cd $out/_pkg; ${pkgs.zip}/bin/zip -r -9 $out/pkg-aarch64-android-libsimplex.zip *) rm -fR $out/_pkg mkdir -p $out/nix-support From 67171092f479742fda73219c33998aed8be273f3 Mon Sep 17 00:00:00 2001 From: shum Date: Wed, 3 Dec 2025 08:09:01 +0000 Subject: [PATCH 2/7] src/Operators: embed PRIVACY.md without full paths --- src/Simplex/Chat/Operators.hs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/Simplex/Chat/Operators.hs b/src/Simplex/Chat/Operators.hs index 24baa37e4e..e6fe91cd49 100644 --- a/src/Simplex/Chat/Operators.hs +++ b/src/Simplex/Chat/Operators.hs @@ -63,8 +63,9 @@ previousConditionsCommit = "a5061f3147165a05979d6ace33960aced2d6ac03" usageConditionsText :: Text usageConditionsText = - $( let s = $(embedFile =<< makeRelativeToProject "PRIVACY.md") - in [|stripFrontMatter $(lift (safeDecodeUtf8 s))|] + $( do + let bs = $(embedFile "PRIVACY.md") + [| stripFrontMatter (safeDecodeUtf8 bs) |] ) data OperatorTag = OTSimplex | OTFlux From 9b45f449d4aef9d353814f2dc24c2f4e576e7d92 Mon Sep 17 00:00:00 2001 From: shum Date: Wed, 3 Dec 2025 08:10:55 +0000 Subject: [PATCH 3/7] nix: make android library reproducible --- flake.nix | 51 ++++++++++++++++++++++++++++++++++----------------- 1 file changed, 34 insertions(+), 17 deletions(-) diff --git a/flake.nix b/flake.nix index 49fbd5143c..9a3ae7e1b2 100644 --- a/flake.nix +++ b/flake.nix @@ -41,14 +41,29 @@ }; sha256map = import ./scripts/nix/sha256map.nix; modules = [ - ({ pkgs, lib, ...}: lib.mkIf (!pkgs.stdenv.hostPlatform.isWindows) { - # This patch adds `dl` as an extra-library to direct-sqlciper, which is needed - # on pretty much all unix platforms, but then blows up on windows m( - packages.direct-sqlcipher.patches = [ ./scripts/nix/direct-sqlcipher-2.3.27.patch ]; - }) - ({ pkgs,lib, ... }: lib.mkIf (pkgs.stdenv.hostPlatform.isAndroid) { - packages.simplex-chat.components.library.ghcOptions = [ "-pie" ]; - })] ++ extra-modules; + ({ pkgs, lib, config, ... }: + { + # Override ghcOptions for ALL packages + ghcOptions = lib.mkDefault [ + "-optl-Wl,--build-id=none" + "-optl-Wl,--sort-common" + "-optc-fdebug-prefix-map=/=." + "-j1" + "-dinitial-unique=8388608" + "-dunique-increment=-1" + ]; + } + ) + + ({ pkgs, lib, ...}: lib.mkIf (!pkgs.stdenv.hostPlatform.isWindows) { + # This patch adds `dl` as an extra-library to direct-sqlciper, which is needed + # on pretty much all unix platforms, but then blows up on windows m( + packages.direct-sqlcipher.patches = [ ./scripts/nix/direct-sqlcipher-2.3.27.patch ]; + }) + + ({ pkgs,lib, ... }: lib.mkIf (pkgs.stdenv.hostPlatform.isAndroid) { + packages.simplex-chat.components.library.ghcOptions = [ "-pie" ]; + })] ++ extra-modules; }; in # by defualt we don't need to pass extra-modules. let drv = pkgs': drv' { extra-modules = []; inherit pkgs'; }; in @@ -452,12 +467,6 @@ ./scripts/nix/direct-sqlcipher-android-log.patch ]; packages.simplex-chat.flags.client_library = true; - # Determenistic builds - packages.simplex-chat.components.library.ghcOptions = [ - "-j1" - "-dinitial-unique=0" - "-dunique-increment=1" - ]; packages.simplexmq.flags.client_library = true; packages.simplexmq.components.library.libs = pkgs.lib.mkForce [ (androidPkgs.openssl.override { static = true; }) @@ -483,6 +492,12 @@ # "-debug" "-optl-lffi" "-optl-Wl,-z,max-page-size=16384" + "-optl-Wl,--build-id=none" + "-optl-Wl,--sort-common" + "-optc-fdebug-prefix-map=/=." + "-j1" + "-dinitial-unique=8388608" + "-dunique-increment=-1" ] # This is fairly idiotic. LLD will strip out foreign exported # symbols (a GHC bug? Codegen bug?). So we need to pass `-u ` @@ -549,10 +564,12 @@ ${pkgs.tree}/bin/tree $out/_pkg - # Set all files to init timestamp for determenistic zip archive - find $out/_pkg -type f -exec touch -d "1970-01-01 00:00:00 UTC" {} + + # Normalize permissions + timestamps + find "$out/_pkg" -type f -exec chmod 644 {} + + find "$out/_pkg" -type d -exec chmod 755 {} + + find "$out/_pkg" -exec touch -h -d '@0' {} + - (cd $out/_pkg; ${pkgs.zip}/bin/zip -r -9 $out/pkg-aarch64-android-libsimplex.zip *) + (cd $out/_pkg; ${pkgs.zip}/bin/zip -r -9 -X $out/pkg-aarch64-android-libsimplex.zip *) rm -fR $out/_pkg mkdir -p $out/nix-support echo "file binary-dist \"$(echo $out/*.zip)\"" \ From 1f312ef8fe9ddd9fb0eb07d08a8ece96aba7c6da Mon Sep 17 00:00:00 2001 From: sh <37271604+shumvgolove@users.noreply.github.com> Date: Wed, 3 Dec 2025 11:43:19 +0000 Subject: [PATCH 4/7] Update src/Simplex/Chat/Operators.hs Co-authored-by: Evgeny --- src/Simplex/Chat/Operators.hs | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/Simplex/Chat/Operators.hs b/src/Simplex/Chat/Operators.hs index e6fe91cd49..08c7b84087 100644 --- a/src/Simplex/Chat/Operators.hs +++ b/src/Simplex/Chat/Operators.hs @@ -63,9 +63,8 @@ previousConditionsCommit = "a5061f3147165a05979d6ace33960aced2d6ac03" usageConditionsText :: Text usageConditionsText = - $( do - let bs = $(embedFile "PRIVACY.md") - [| stripFrontMatter (safeDecodeUtf8 bs) |] + $( let s = $(embedFile "PRIVACY.md") + in [|stripFrontMatter $(lift (safeDecodeUtf8 s))|] ) data OperatorTag = OTSimplex | OTFlux From 3a884cff7ea8b38fb9a7ca9df2f0c2020ac98228 Mon Sep 17 00:00:00 2001 From: shum Date: Thu, 4 Dec 2025 14:38:29 +0000 Subject: [PATCH 5/7] nix: remove unnecessary flags and apply changes to armv7a --- flake.nix | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/flake.nix b/flake.nix index 9a3ae7e1b2..3773c6cfb6 100644 --- a/flake.nix +++ b/flake.nix @@ -45,12 +45,7 @@ { # Override ghcOptions for ALL packages ghcOptions = lib.mkDefault [ - "-optl-Wl,--build-id=none" - "-optl-Wl,--sort-common" - "-optc-fdebug-prefix-map=/=." "-j1" - "-dinitial-unique=8388608" - "-dunique-increment=-1" ]; } ) @@ -383,6 +378,7 @@ "-threaded" # "-debug" "-optl-lffi" + "-j1" ] # This is fairly idiotic. LLD will strip out foreign exported # symbols (a GHC bug? Codegen bug?). So we need to pass `-u ` @@ -448,7 +444,13 @@ done ${pkgs.tree}/bin/tree $out/_pkg - (cd $out/_pkg; ${pkgs.zip}/bin/zip -r -9 $out/pkg-armv7a-android-libsimplex.zip *) + + # Normalize permissions + timestamps + find "$out/_pkg" -type f -exec chmod 644 {} + + find "$out/_pkg" -type d -exec chmod 755 {} + + find "$out/_pkg" -exec touch -h -d '@0' {} + + + (cd $out/_pkg; ${pkgs.zip}/bin/zip -r -9 -X $out/pkg-armv7a-android-libsimplex.zip *) rm -fR $out/_pkg mkdir -p $out/nix-support echo "file binary-dist \"$(echo $out/*.zip)\"" \ @@ -492,12 +494,7 @@ # "-debug" "-optl-lffi" "-optl-Wl,-z,max-page-size=16384" - "-optl-Wl,--build-id=none" - "-optl-Wl,--sort-common" - "-optc-fdebug-prefix-map=/=." "-j1" - "-dinitial-unique=8388608" - "-dunique-increment=-1" ] # This is fairly idiotic. LLD will strip out foreign exported # symbols (a GHC bug? Codegen bug?). So we need to pass `-u ` From 1a4eb869de4038ef72418feb578b05b1c6470fb7 Mon Sep 17 00:00:00 2001 From: shum Date: Sat, 6 Dec 2025 10:32:58 +0000 Subject: [PATCH 6/7] nix: strip libraries from debug symbols --- flake.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/flake.nix b/flake.nix index 3773c6cfb6..313277dbaf 100644 --- a/flake.nix +++ b/flake.nix @@ -449,6 +449,7 @@ find "$out/_pkg" -type f -exec chmod 644 {} + find "$out/_pkg" -type d -exec chmod 755 {} + find "$out/_pkg" -exec touch -h -d '@0' {} + + find "$out/_pkg" -type f -name "*.so" -exec ${android32Pkgs.stdenv.cc.targetPrefix}strip --strip-unneeded {} + (cd $out/_pkg; ${pkgs.zip}/bin/zip -r -9 -X $out/pkg-armv7a-android-libsimplex.zip *) rm -fR $out/_pkg @@ -565,6 +566,7 @@ find "$out/_pkg" -type f -exec chmod 644 {} + find "$out/_pkg" -type d -exec chmod 755 {} + find "$out/_pkg" -exec touch -h -d '@0' {} + + find "$out/_pkg" -type f -name "*.so" -exec ${androidPkgs.stdenv.cc.targetPrefix}strip --strip-unneeded {} + (cd $out/_pkg; ${pkgs.zip}/bin/zip -r -9 -X $out/pkg-aarch64-android-libsimplex.zip *) rm -fR $out/_pkg From 338f9969f6882995499973647c866f2325e1c2b3 Mon Sep 17 00:00:00 2001 From: shum Date: Sun, 7 Dec 2025 15:04:37 +0000 Subject: [PATCH 7/7] nix: strip before timestamp normalization --- flake.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index 313277dbaf..82054eb2b2 100644 --- a/flake.nix +++ b/flake.nix @@ -445,11 +445,13 @@ ${pkgs.tree}/bin/tree $out/_pkg + # Strip from debug symbols + find "$out/_pkg" -type f -name "*.so" -exec ${android32Pkgs.stdenv.cc.targetPrefix}strip --strip-unneeded {} + + # Normalize permissions + timestamps find "$out/_pkg" -type f -exec chmod 644 {} + find "$out/_pkg" -type d -exec chmod 755 {} + find "$out/_pkg" -exec touch -h -d '@0' {} + - find "$out/_pkg" -type f -name "*.so" -exec ${android32Pkgs.stdenv.cc.targetPrefix}strip --strip-unneeded {} + (cd $out/_pkg; ${pkgs.zip}/bin/zip -r -9 -X $out/pkg-armv7a-android-libsimplex.zip *) rm -fR $out/_pkg @@ -562,11 +564,13 @@ ${pkgs.tree}/bin/tree $out/_pkg + # Strip from debug symbols + find "$out/_pkg" -type f -name "*.so" -exec ${androidPkgs.stdenv.cc.targetPrefix}strip --strip-unneeded {} + + # Normalize permissions + timestamps find "$out/_pkg" -type f -exec chmod 644 {} + find "$out/_pkg" -type d -exec chmod 755 {} + find "$out/_pkg" -exec touch -h -d '@0' {} + - find "$out/_pkg" -type f -name "*.so" -exec ${androidPkgs.stdenv.cc.targetPrefix}strip --strip-unneeded {} + (cd $out/_pkg; ${pkgs.zip}/bin/zip -r -9 -X $out/pkg-aarch64-android-libsimplex.zip *) rm -fR $out/_pkg