You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Users should not have to trust that Stack Wallet binaries properly represent the source tree. Reproducible builds mitigate this risk by allowing users to check that a given binary matches a given commit.
I support @AaronFeickert comment above.
This will help mitigate unwarranted code injections by hackers / bad actors within Big Tech. Big brother is watching and with Big Tech working with Big Banks and the eminent rollout of CDBCs, wallets like Stack Wallet may be targeted.
Following the suggestion to track reproducibility here, this consolidates WalletScrutiny's earlier issues. New findings will go in this thread rather than in new issues.
#1392: lib/external_api_keys.dart not in repo (v2.4.4)
Release builds compile partner API keys into libapp.so from a file that is gitignored. scripts/prebuild.sh writes an empty template, so a build from source cannot match the official libapp.so. Request: publish the file used for each release, or give verifiers a way to confirm the app logic without the keys. This still applies to v2.7.5.
#1394: build_301 tag vs published APK (v2.4.4)
The source at build_301 failed to compile under the pinned Flutter ^3.38.1 (flutter_riverpod 1.0.4: "doesn't have a concrete implementation of the super-invoked member 'activate'"). Request: pin the exact Flutter version at each release tag (.fvmrc or .flutter-version), and tag the exact commit that was built.
#1398: v2.4.4 Play Store verification
3 of 4 split APKs reproduced. split_config.arm64_v8a.apk differed in 10 native libraries. Causes found: the API keys (#1392), a source patch we needed for the riverpod error, an embedded commit 6 days older than the build_301 tag, and a workstation source path embedded in the binaries.
#1399: frostdart.so missing from the v2.4.4 AppImage (closed)
danrmiller confirmed this was a bug (empty frostdart_bundled_libraries), fixed in frostdart PR #23 / v0.2.1. Resolved.
lib/libepic_cash_wallet.so and lib/libtor_ffi_plugin.so: bundled OpenSSL (3.5.4 and 3.3.1) embeds its build date (built on: ...). The changed build ID and layout shifts follow from that. OpenSSL reads SOURCE_DATE_EPOCH when it is set, so exporting it in the release build should remove these two differences.
Activity
marvelloz commentedon Oct 21, 2022
I support @AaronFeickert comment above.
This will help mitigate unwarranted code injections by hackers / bad actors within Big Tech. Big brother is watching and with Big Tech working with Big Banks and the eminent rollout of CDBCs, wallets like Stack Wallet may be targeted.
fetch paynym bot image over Tor
feat(test): add monero wallet test suite
sneurlax commentedon Nov 11, 2026
This has been achieved in part by julian-Cstack in recently-merged Nix reproducibility PRs in frostdart, flutter_libepiccash, flutter_libmwc, and tor
xrviv commentedon Nov 12, 2026
Following the suggestion to track reproducibility here, this consolidates WalletScrutiny's earlier issues. New findings will go in this thread rather than in new issues.
#1392:
lib/external_api_keys.dartnot in repo (v2.4.4)Release builds compile partner API keys into
libapp.sofrom a file that is gitignored.scripts/prebuild.shwrites an empty template, so a build from source cannot match the officiallibapp.so. Request: publish the file used for each release, or give verifiers a way to confirm the app logic without the keys. This still applies to v2.7.5.#1394:
build_301tag vs published APK (v2.4.4)The source at
build_301failed to compile under the pinned Flutter^3.38.1(flutter_riverpod1.0.4: "doesn't have a concrete implementation of the super-invoked member 'activate'"). Request: pin the exact Flutter version at each release tag (.fvmrcor.flutter-version), and tag the exact commit that was built.#1398: v2.4.4 Play Store verification
3 of 4 split APKs reproduced.
split_config.arm64_v8a.apkdiffered in 10 native libraries. Causes found: the API keys (#1392), a source patch we needed for the riverpod error, an embedded commit 6 days older than thebuild_301tag, and a workstation source path embedded in the binaries.#1399:
frostdart.somissing from the v2.4.4 AppImage (closed)danrmiller confirmed this was a bug (empty
frostdart_bundled_libraries), fixed in frostdart PR #23 / v0.2.1. Resolved.xrviv commentedon Nov 12, 2026
Update: v2.7.5 Linux AppImage (
sw-v2.7.5-linux.AppImage, tagbuild_325, commit7ce7b34f260f7bb481ee50e2ebebebfb42c2ed1c)Not reproducible. 240 of 243 bundle entries match byte for byte. The embedded commit now matches the release tag. Three files differ:
lib/libapp.so: the release has 14 extra strings that look like API keys and tokens. This is the same cause as lib/external_api_keys.dart not in repo — potential blocker for reproducibility verification #1392.lib/libepic_cash_wallet.soandlib/libtor_ffi_plugin.so: bundled OpenSSL (3.5.4 and 3.3.1) embeds its build date (built on: ...). The changed build ID and layout shifts follow from that. OpenSSL readsSOURCE_DATE_EPOCHwhen it is set, so exporting it in the release build should remove these two differences.Full report and build script: https://walletscrutiny.com/verifier/?pubkey=1f9e547c2f31942623b8ad1d07713282e8640fd8cf474e9f79f18ace8af216ed#verificationId=d70e8cf2b491c9fb0cbba2fcea23356dbb908f371f5e6e3f62f6927f9da18623