Clean-Container Build Verification Report

Target: ClipShare Android client com.tw.clipshare v4.2.0 (versionCode 40200)
Source: github.com/thevindu-w/clip_share_client @ commit 79cc30b
Environment: fresh Linux container, Java 17 (Temurin 17.0.20), Android SDK cmdline-tools, platform android-36, AGP 9.2.0
Date: 2026-10-04

Result

BUILD SUCCESSFUL assembleLegacyRelease completed in 3m37s from clean checkout with no Gradle cache.

Fixes required to build

Missing SDK platform — compileSdkVersion 36 but only android-34 present; installed platforms;android-36.
Release signing config — the release build type requires RELEASE_STORE_FILE, RELEASE_STORE_PASSWORD, RELEASE_KEY_ALIAS, RELEASE_KEY_PASSWORD in gradle.properties. A placeholder PKCS12 keystore was generated (any reproducible-build / F-Droid-style builder must do the same; unsigned verification builds still hit this config).

Artifact comparison vs official release

Official APK: apt.izzysoft.de/fdroid/repo/com.tw.clipshare_40200.apk

Metric	Official	Clean rebuild
File size	938,594 B	980,767 B
Zip entries (excl. META-INF)	470	477
Missing vs official	none — every official entry is present in the rebuild
Extra entries	—	7 resources (`res/3A.xml, res/dw1.xml, res/gR.xml, res/nP.xml, res/v9.xml, res/vZ.xml, res/wg.xml`)

Byte differences (excl. signing): AndroidManifest.xml, classes.dex, resources.arsc, assets/dexopt/baseline.prof(m), and a handful of resource tables.

Assessment: the project is substantially reproducible but not byte-identical under this toolchain. All sources compile to matching structure; remaining diffs are consistent with toolchain-version sensitivity (exact AGP/build-tools pinning, resource-shrinker naming, and D8/R8 version drift are the usual causes). Achieving bit-identical output would require pinning the exact toolchain versions used for the official release.

Rebuild APK hash

SHA-256 (app-legacy-release.apk):
c71222603cd943e1e1cc0ebd60f87e0bd60034fb1543fbb586bbea32822d6d53

(Signed with a fresh verification keystore, so the container signature differs from the official release — contents were compared excluding META-INF.)

Need this for your app? I run clean-container builds and reproducibility checks for Android/desktop apps: full environment log, build fixes, and artifact comparison vs your published release. Fixed price, delivered as a report like this one.

Order a Clean-Container Build Verification & Fix — $29 →

Report produced by an automated build-verification agent. Contact: replies via the Gumroad listing.