Wallet Scrutiny Review Process

Hello,

Over the past month, I’ve been working with Wallet Scrutiny to help verify Cake Wallet by providing a working Dockerfile. Unfortunately, the review process was closed today as Not Reproducible due to multiple verification attempts resulting in diffs.

Keraliss shared more details here. It seems progress stalled despite being halfway there—“we successfully generated split APKs matching the official release format.” and i don’t see any support from cake side

You can track the review process here:

4 Likes

Thanks for opening this issue! I know there are some outstanding issues with “full” reproducibility as WalletScrutiny normally wants, and I’ll make it a topic within the team on how we can address this.

In the meantime I believe @tuxsudo may have more info on why Cake isn’t reproducible today and what the path forward can look like.

Gonna drop this here for who ever follow up on this, I opened a thread on WalletScrutiny Discord for cake wallet…

Docker file: Cake_wallet_DOCKER_xD/cakeRELEASE.Dockerfile at main · Justxd22/Cake_wallet_DOCKER_xD · GitHub
Instructions: GitHub - Justxd22/Cake_wallet_DOCKER_xD

1 Like

build005

I encountered an error:

///opt/android/cake_wallet/tool/download_moneroc_prebuilds.dart#46:7 main:   extracting scripts/monero_c/release/monero/x86_64-w64-mingw32_libssp-0.dll
Unhandled exception:
FormatException: Invalid XZ stream header signature
#0      _XZStreamDecoder._readStreamHeader (package:archive/src/xz_decoder.dart:73:7)
#1      _XZStreamDecoder.decode (package:archive/src/xz_decoder.dart:47:5)
#2      XZDecoder.decodeBuffer (package:archive/src/xz_decoder.dart:22:20)
#3      main (file:///opt/android/cake_wallet/tool/download_moneroc_prebuilds.dart:48:35)
<asynchronous suspension>
The command '/bin/bash -c cd /opt/android/cake_wallet &&     flutter pub get &&     dart run tool/download_moneroc_prebuilds.dart &&     cd /opt/android/cake_wallet/android/app &&     keytool -genkey -v -keystore key.jks -keyalg RSA -keysize 2048 -validity 10000 -alias testKey -noprompt     -dname "CN=CakeWallet, OU=CakeWallet, O=CakeWallet, L=Florida, S=America, C=USA"     -storepass $STORE_PASS -keypass $KEY_PASS &&     cd /opt/android/cake_wallet &&     dart run tool/generate_android_key_properties.dart     keyAlias=testKey storeFile=key.jks storePassword=$STORE_PASS keyPassword=$KEY_PASS &&     dart run tool/generate_localization.dart &&     dart run tool/generate_new_secrets.dart &&     ./model_generator.sh' returned a non-zero code: 255
danny@lw10:~/work/builds/com.cakewallet.cake_wallet/4.23.0/Cake_wallet_DOCKER_xD$

I am modifying the dockerfile slightly. continuing.

It seems my new account is limited to posting 2 links per post.

So, I will reference my GitHub post here

build 008’s failure stems from:

Removing intermediate container 141c5b71dc04
 ---> e4244238b744
Step 11/15 : RUN sed -i "s/bitco inCashTestWalletReceiveAddress/bitcoinCashTestWalletReceiveAddresss/" /opt/android/cake_wallet/lib/.secrets.g.dart
 ---> Running in c3d9ab48c154
Removing intermediate container c3d9ab48c154
 ---> c4efcba8b5c1
Step 12/15 : RUN cd /opt/android/cake_wallet &&     flutter build apk --release --split-per-abi
 ---> Running in fe0c7340a348

Running Gradle task 'assembleRelease'...                        
You are applying Flutter's main Gradle plugin imperatively using the apply script method, which is deprecated and will be removed in a future release. Migrate to applying Gradle plugins with the declarative plugins block: https://flutter.dev/to/flutter-gradle-plugin-apply

Checking the license for package Android SDK Build-Tools 34 in /usr/local/lib/android/sdk/licenses
License for package Android SDK Build-Tools 34 accepted.
Preparing "Install Android SDK Build-Tools 34 v.34.0.0".
"Install Android SDK Build-Tools 34 v.34.0.0" ready.
Installing Android SDK Build-Tools 34 in /usr/local/lib/android/sdk/build-tools/34.0.0
"Install Android SDK Build-Tools 34 v.34.0.0" complete.
"Install Android SDK Build-Tools 34 v.34.0.0" finished.
Checking the license for package Android SDK Platform 34 in /usr/local/lib/android/sdk/licenses
License for package Android SDK Platform 34 accepted.
Preparing "Install Android SDK Platform 34 (revision 3)".
"Install Android SDK Platform 34 (revision 3)" ready.
Installing Android SDK Platform 34 in /usr/local/lib/android/sdk/platforms/android-34
"Install Android SDK Platform 34 (revision 3)" complete.
"Install Android SDK Platform 34 (revision 3)" finished.
Checking the license for package Android SDK Platform 33 in /usr/local/lib/android/sdk/licenses
License for package Android SDK Platform 33 accepted.
Preparing "Install Android SDK Platform 33 (revision 3)".
"Install Android SDK Platform 33 (revision 3)" ready.
Installing Android SDK Platform 33 in /usr/local/lib/android/sdk/platforms/android-33
"Install Android SDK Platform 33 (revision 3)" complete.
"Install Android SDK Platform 33 (revision 3)" finished.
lib/exchange/provider/chainflip_exchange_provider.dart:43:40: Error: Undefined name 'chainflipAffiliateFee'.
  static const _affiliateBps = secrets.chainflipAffiliateFee;
                                       ^^^^^^^^^^^^^^^^^^^^^
Target kernel_snapshot_program failed: Exception


FAILURE: Build failed with an exception.

* Where:
Script '/usr/local/flutter/packages/flutter_tools/gradle/src/main/groovy/flutter.groovy' line: 1687

* What went wrong:
Execution failed for task ':app:compileFlutterBuildRelease'.
> Process 'command '/usr/local/flutter/bin/flutter'' finished with non-zero exit value 1

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.

BUILD FAILED in 4m 43s
Running Gradle task 'assembleRelease'...                          284.1s
Gradle task assembleRelease failed with exit code 1
The command '/bin/bash -c cd /opt/android/cake_wallet &&     flutter build apk --release --split-per-abi' returned a non-zero code: 1

Explained:

Cake Wallet code is referencing a secret variable named chainflipAffiliateFee, but that constant was never defined in .secrets.g.dart. As a result, when Gradle tries to compile chainflip_exchange_provider.dart, it encounters Undefined name 'chainflipAffiliateFee'.

The Fix
Add a placeholder definition of chainflipAffiliateFee to .secrets.g.dart (or wherever your secrets are generated).

I will wait until the gh pr is merged to better clarify some matters. I have instructions to build the monero dependencies from source.