v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs) #953

Open
Open
v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs)#953
Assignees
ovitrif
Milestone
2.6.0

Description

@xrviv
xrviv
opened on May 19, 2026

We attempted to reproduce the Play Store release of Bitkit v2.2.0 (to.bitkit) as part of
WalletScrutiny's automated verification pipeline.

Build succeeded. The build command ./gradlew bundleMainnetRelease --no-build-cache --no-configuration-cache completed in ~7 minutes using JDK 17 (Zulu), Android SDK build-tools 35/36, and bundletool v1.17.2 to extract split APKs from the produced AAB.

Commit: e6cd61e (tag v2.2.0)

Split APK Comparison Results

SplitResult
base.apk✅ Identical (modulo Play Store signing artifacts)
split_config.xxhdpi.apk✅ Identical (modulo Play Store signing artifacts)
split_config.arm64_v8a.apk❌ 4 native libraries differ

Non-reproducible files in split_config.arm64_v8a.apk

  • lib/arm64-v8a/libbitkitcore.so
  • lib/arm64-v8a/libdatastore_shared_counter.so
  • lib/arm64-v8a/libjnidispatch.so
  • lib/arm64-v8a/libpubky_app_specs-90a3a8b6be1a7a22.so ← new in v2.2.0

The same three libraries also differed in our v2.1.2 verification. libpubky_app_specs is new in v2.2.0.

All AndroidManifest.xml, resources.arsc, META-INF/, and stamp-cert-sha256 differences are Play Store injection artifacts and are excluded from this finding.

Likely Causes

  • libbitkitcore.so and libpubky_app_specs are Rust/native libraries distributed via GitHub Packages AARs (com.synonym:bitkit-core-android, etc.). If the AARs themselves were not built reproducibly, the embedded .so files will differ regardless of how the app build is reproduced.
  • libdatastore_shared_counter.so and libjnidispatch.so may differ due to how Play Store packages .so files vs. what bundletool extracts from a locally built AAB.

We have not yet run diffoscope on the differing libraries. If the developers can point to
reproducible-build documentation or upstream CI for the native AARs, that would help narrow the
root cause.

Environment

  • Script: bitkit_build.sh v0.3.6 (WalletScrutiny build scripts)
  • Container image: bitkitwallet_build_env:3 (Ubuntu 22.04, Zulu JDK 17, Android SDK build-tools 35
    + 36)
  • Runtime: Podman on Ubuntu 24.04

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
     blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

    Skip to content
    v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs) #953
    Open
    Open
    v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs)#953
    Assignees
    ovitrif
    Milestone
    2.6.0
    Description
    @xrviv
    xrviv
    opened on May 19, 2026
    We attempted to reproduce the Play Store release of Bitkit v2.2.0 (to.bitkit) as part of
    
WalletScrutiny's automated verification pipeline.
    Build succeeded. The build command ./gradlew bundleMainnetRelease --no-build-cache --no-configuration-cache completed in ~7 minutes using JDK 17 (Zulu), Android SDK build-tools 35/36, and bundletool v1.17.2 to extract split APKs from the produced AAB.
    Commit: e6cd61e (tag v2.2.0)
    Split APK Comparison Results
    SplitResult
    base.apk✅ Identical (modulo Play Store signing artifacts)
    split_config.xxhdpi.apk✅ Identical (modulo Play Store signing artifacts)
    split_config.arm64_v8a.apk❌ 4 native libraries differ
    Non-reproducible files in split_config.arm64_v8a.apk
    • lib/arm64-v8a/libbitkitcore.so
    • lib/arm64-v8a/libdatastore_shared_counter.so
    • lib/arm64-v8a/libjnidispatch.so
    • lib/arm64-v8a/libpubky_app_specs-90a3a8b6be1a7a22.so ← new in v2.2.0
    The same three libraries also differed in our v2.1.2 verification. libpubky_app_specs is new in v2.2.0.
    All AndroidManifest.xml, resources.arsc, META-INF/, and stamp-cert-sha256 differences are Play Store injection artifacts and are excluded from this finding.
    Likely Causes
    • libbitkitcore.so and libpubky_app_specs are Rust/native libraries distributed via GitHub Packages AARs (com.synonym:bitkit-core-android, etc.). If the AARs themselves were not built reproducibly, the embedded .so files will differ regardless of how the app build is reproduced.
    • libdatastore_shared_counter.so and libjnidispatch.so may differ due to how Play Store packages .so files vs. what bundletool extracts from a locally built AAB.
    We have not yet run diffoscope on the differing libraries. If the developers can point to
    
reproducible-build documentation or upstream CI for the native AARs, that would help narrow the
    
root cause.
    Environment
    • Script: bitkit_build.sh v0.3.6 (WalletScrutiny build scripts)
    • Container image: bitkitwallet_build_env:3 (Ubuntu 22.04, Zulu JDK 17, Android SDK build-tools 35
      
+ 36)
    • Runtime: Podman on Ubuntu 24.04
    Metadata
    Metadata
    Assignees
    Labels
    No labels
    No labels
    Type
    No type
    Projects
    No projects
      Milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

      Skip to content
      v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs) #953
      Open
      Open
      v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs)#953
      Assignees
      ovitrif
      Milestone
      2.6.0
      Description
      @xrviv
      xrviv
      opened on May 19, 2026
      We attempted to reproduce the Play Store release of Bitkit v2.2.0 (to.bitkit) as part of
      
WalletScrutiny's automated verification pipeline.
      Build succeeded. The build command ./gradlew bundleMainnetRelease --no-build-cache --no-configuration-cache completed in ~7 minutes using JDK 17 (Zulu), Android SDK build-tools 35/36, and bundletool v1.17.2 to extract split APKs from the produced AAB.
      Commit: e6cd61e (tag v2.2.0)
      Split APK Comparison Results
      SplitResult
      base.apk✅ Identical (modulo Play Store signing artifacts)
      split_config.xxhdpi.apk✅ Identical (modulo Play Store signing artifacts)
      split_config.arm64_v8a.apk❌ 4 native libraries differ
      Non-reproducible files in split_config.arm64_v8a.apk
      • lib/arm64-v8a/libbitkitcore.so
      • lib/arm64-v8a/libdatastore_shared_counter.so
      • lib/arm64-v8a/libjnidispatch.so
      • lib/arm64-v8a/libpubky_app_specs-90a3a8b6be1a7a22.so ← new in v2.2.0
      The same three libraries also differed in our v2.1.2 verification. libpubky_app_specs is new in v2.2.0.
      All AndroidManifest.xml, resources.arsc, META-INF/, and stamp-cert-sha256 differences are Play Store injection artifacts and are excluded from this finding.
      Likely Causes
      • libbitkitcore.so and libpubky_app_specs are Rust/native libraries distributed via GitHub Packages AARs (com.synonym:bitkit-core-android, etc.). If the AARs themselves were not built reproducibly, the embedded .so files will differ regardless of how the app build is reproduced.
      • libdatastore_shared_counter.so and libjnidispatch.so may differ due to how Play Store packages .so files vs. what bundletool extracts from a locally built AAB.
      We have not yet run diffoscope on the differing libraries. If the developers can point to
      
reproducible-build documentation or upstream CI for the native AARs, that would help narrow the
      
root cause.
      Environment
      • Script: bitkit_build.sh v0.3.6 (WalletScrutiny build scripts)
      • Container image: bitkitwallet_build_env:3 (Ubuntu 22.04, Zulu JDK 17, Android SDK build-tools 35
        
+ 36)
      • Runtime: Podman on Ubuntu 24.04
      Metadata
      Metadata
      Assignees
      Labels
      No labels
      No labels
      Type
      No type
      Projects
      No projects
        Milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

        Skip to content
        v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs) #953
        Open
        Open
        v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs)#953
        Assignees
        ovitrif
        Milestone
        2.6.0
        Description
        @xrviv
        xrviv
        opened on May 19, 2026
        We attempted to reproduce the Play Store release of Bitkit v2.2.0 (to.bitkit) as part of
        
WalletScrutiny's automated verification pipeline.
        Build succeeded. The build command ./gradlew bundleMainnetRelease --no-build-cache --no-configuration-cache completed in ~7 minutes using JDK 17 (Zulu), Android SDK build-tools 35/36, and bundletool v1.17.2 to extract split APKs from the produced AAB.
        Commit: e6cd61e (tag v2.2.0)
        Split APK Comparison Results
        SplitResult
        base.apk✅ Identical (modulo Play Store signing artifacts)
        split_config.xxhdpi.apk✅ Identical (modulo Play Store signing artifacts)
        split_config.arm64_v8a.apk❌ 4 native libraries differ
        Non-reproducible files in split_config.arm64_v8a.apk
        • lib/arm64-v8a/libbitkitcore.so
        • lib/arm64-v8a/libdatastore_shared_counter.so
        • lib/arm64-v8a/libjnidispatch.so
        • lib/arm64-v8a/libpubky_app_specs-90a3a8b6be1a7a22.so ← new in v2.2.0
        The same three libraries also differed in our v2.1.2 verification. libpubky_app_specs is new in v2.2.0.
        All AndroidManifest.xml, resources.arsc, META-INF/, and stamp-cert-sha256 differences are Play Store injection artifacts and are excluded from this finding.
        Likely Causes
        • libbitkitcore.so and libpubky_app_specs are Rust/native libraries distributed via GitHub Packages AARs (com.synonym:bitkit-core-android, etc.). If the AARs themselves were not built reproducibly, the embedded .so files will differ regardless of how the app build is reproduced.
        • libdatastore_shared_counter.so and libjnidispatch.so may differ due to how Play Store packages .so files vs. what bundletool extracts from a locally built AAB.
        We have not yet run diffoscope on the differing libraries. If the developers can point to
        
reproducible-build documentation or upstream CI for the native AARs, that would help narrow the
        
root cause.
        Environment
        • Script: bitkit_build.sh v0.3.6 (WalletScrutiny build scripts)
        • Container image: bitkitwallet_build_env:3 (Ubuntu 22.04, Zulu JDK 17, Android SDK build-tools 35
          
+ 36)
        • Runtime: Podman on Ubuntu 24.04
        Metadata
        Metadata
        Assignees
        Labels
        No labels
        No labels
        Type
        No type
        Projects
        No projects
          Milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

          Skip to content
          v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs) #953
          Open
          Open
          v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs)#953
          Assignees
          ovitrif
          Milestone
          2.6.0
          Description
          @xrviv
          xrviv
          opened on May 19, 2026
          We attempted to reproduce the Play Store release of Bitkit v2.2.0 (to.bitkit) as part of
          
WalletScrutiny's automated verification pipeline.
          Build succeeded. The build command ./gradlew bundleMainnetRelease --no-build-cache --no-configuration-cache completed in ~7 minutes using JDK 17 (Zulu), Android SDK build-tools 35/36, and bundletool v1.17.2 to extract split APKs from the produced AAB.
          Commit: e6cd61e (tag v2.2.0)
          Split APK Comparison Results
          SplitResult
          base.apk✅ Identical (modulo Play Store signing artifacts)
          split_config.xxhdpi.apk✅ Identical (modulo Play Store signing artifacts)
          split_config.arm64_v8a.apk❌ 4 native libraries differ
          Non-reproducible files in split_config.arm64_v8a.apk
          • lib/arm64-v8a/libbitkitcore.so
          • lib/arm64-v8a/libdatastore_shared_counter.so
          • lib/arm64-v8a/libjnidispatch.so
          • lib/arm64-v8a/libpubky_app_specs-90a3a8b6be1a7a22.so ← new in v2.2.0
          The same three libraries also differed in our v2.1.2 verification. libpubky_app_specs is new in v2.2.0.
          All AndroidManifest.xml, resources.arsc, META-INF/, and stamp-cert-sha256 differences are Play Store injection artifacts and are excluded from this finding.
          Likely Causes
          • libbitkitcore.so and libpubky_app_specs are Rust/native libraries distributed via GitHub Packages AARs (com.synonym:bitkit-core-android, etc.). If the AARs themselves were not built reproducibly, the embedded .so files will differ regardless of how the app build is reproduced.
          • libdatastore_shared_counter.so and libjnidispatch.so may differ due to how Play Store packages .so files vs. what bundletool extracts from a locally built AAB.
          We have not yet run diffoscope on the differing libraries. If the developers can point to
          
reproducible-build documentation or upstream CI for the native AARs, that would help narrow the
          
root cause.
          Environment
          • Script: bitkit_build.sh v0.3.6 (WalletScrutiny build scripts)
          • Container image: bitkitwallet_build_env:3 (Ubuntu 22.04, Zulu JDK 17, Android SDK build-tools 35
            
+ 36)
          • Runtime: Podman on Ubuntu 24.04
          Metadata
          Metadata
          Assignees
          Labels
          No labels
          No labels
          Type
          No type
          Projects
          No projects
            Milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

            Skip to content
            v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs) #953
            Open
            Open
            v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs)#953
            Assignees
            ovitrif
            Milestone
            2.6.0
            Description
            @xrviv
            xrviv
            opened on May 19, 2026
            We attempted to reproduce the Play Store release of Bitkit v2.2.0 (to.bitkit) as part of
            
WalletScrutiny's automated verification pipeline.
            Build succeeded. The build command ./gradlew bundleMainnetRelease --no-build-cache --no-configuration-cache completed in ~7 minutes using JDK 17 (Zulu), Android SDK build-tools 35/36, and bundletool v1.17.2 to extract split APKs from the produced AAB.
            Commit: e6cd61e (tag v2.2.0)
            Split APK Comparison Results
            SplitResult
            base.apk✅ Identical (modulo Play Store signing artifacts)
            split_config.xxhdpi.apk✅ Identical (modulo Play Store signing artifacts)
            split_config.arm64_v8a.apk❌ 4 native libraries differ
            Non-reproducible files in split_config.arm64_v8a.apk
            • lib/arm64-v8a/libbitkitcore.so
            • lib/arm64-v8a/libdatastore_shared_counter.so
            • lib/arm64-v8a/libjnidispatch.so
            • lib/arm64-v8a/libpubky_app_specs-90a3a8b6be1a7a22.so ← new in v2.2.0
            The same three libraries also differed in our v2.1.2 verification. libpubky_app_specs is new in v2.2.0.
            All AndroidManifest.xml, resources.arsc, META-INF/, and stamp-cert-sha256 differences are Play Store injection artifacts and are excluded from this finding.
            Likely Causes
            • libbitkitcore.so and libpubky_app_specs are Rust/native libraries distributed via GitHub Packages AARs (com.synonym:bitkit-core-android, etc.). If the AARs themselves were not built reproducibly, the embedded .so files will differ regardless of how the app build is reproduced.
            • libdatastore_shared_counter.so and libjnidispatch.so may differ due to how Play Store packages .so files vs. what bundletool extracts from a locally built AAB.
            We have not yet run diffoscope on the differing libraries. If the developers can point to
            
reproducible-build documentation or upstream CI for the native AARs, that would help narrow the
            
root cause.
            Environment
            • Script: bitkit_build.sh v0.3.6 (WalletScrutiny build scripts)
            • Container image: bitkitwallet_build_env:3 (Ubuntu 22.04, Zulu JDK 17, Android SDK build-tools 35
              
+ 36)
            • Runtime: Podman on Ubuntu 24.04
            Metadata
            Metadata
            Assignees
            Labels
            No labels
            No labels
            Type
            No type
            Projects
            No projects
              Milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs) #953
              Open
              Open
              v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs)#953
              Assignees
              ovitrif
              Milestone
              2.6.0
              Description
              @xrviv
              xrviv
              opened on May 19, 2026
              We attempted to reproduce the Play Store release of Bitkit v2.2.0 (to.bitkit) as part of
              
WalletScrutiny's automated verification pipeline.
              Build succeeded. The build command ./gradlew bundleMainnetRelease --no-build-cache --no-configuration-cache completed in ~7 minutes using JDK 17 (Zulu), Android SDK build-tools 35/36, and bundletool v1.17.2 to extract split APKs from the produced AAB.
              Commit: e6cd61e (tag v2.2.0)
              Split APK Comparison Results
              SplitResult
              base.apk✅ Identical (modulo Play Store signing artifacts)
              split_config.xxhdpi.apk✅ Identical (modulo Play Store signing artifacts)
              split_config.arm64_v8a.apk❌ 4 native libraries differ
              Non-reproducible files in split_config.arm64_v8a.apk
              • lib/arm64-v8a/libbitkitcore.so
              • lib/arm64-v8a/libdatastore_shared_counter.so
              • lib/arm64-v8a/libjnidispatch.so
              • lib/arm64-v8a/libpubky_app_specs-90a3a8b6be1a7a22.so ← new in v2.2.0
              The same three libraries also differed in our v2.1.2 verification. libpubky_app_specs is new in v2.2.0.
              All AndroidManifest.xml, resources.arsc, META-INF/, and stamp-cert-sha256 differences are Play Store injection artifacts and are excluded from this finding.
              Likely Causes
              • libbitkitcore.so and libpubky_app_specs are Rust/native libraries distributed via GitHub Packages AARs (com.synonym:bitkit-core-android, etc.). If the AARs themselves were not built reproducibly, the embedded .so files will differ regardless of how the app build is reproduced.
              • libdatastore_shared_counter.so and libjnidispatch.so may differ due to how Play Store packages .so files vs. what bundletool extracts from a locally built AAB.
              We have not yet run diffoscope on the differing libraries. If the developers can point to
              
reproducible-build documentation or upstream CI for the native AARs, that would help narrow the
              
root cause.
              Environment
              • Script: bitkit_build.sh v0.3.6 (WalletScrutiny build scripts)
              • Container image: bitkitwallet_build_env:3 (Ubuntu 22.04, Zulu JDK 17, Android SDK build-tools 35
                
+ 36)
              • Runtime: Podman on Ubuntu 24.04
              Metadata
              Metadata
              Assignees
              Labels
              No labels
              No labels
              Type
              No type
              Projects
              No projects
                Milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                Skip to content
                v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs) #953
                Open
                Open
                v2.2.0: Native libraries not reproducible (libbitkitcore.so, libdatastore_shared_counter.so, libjnidispatch.so, libpubky_app_specs)#953
                Assignees
                ovitrif
                Milestone
                2.6.0
                Description
                @xrviv
                xrviv
                opened on May 19, 2026
                We attempted to reproduce the Play Store release of Bitkit v2.2.0 (to.bitkit) as part of
                
WalletScrutiny's automated verification pipeline.
                Build succeeded. The build command ./gradlew bundleMainnetRelease --no-build-cache --no-configuration-cache completed in ~7 minutes using JDK 17 (Zulu), Android SDK build-tools 35/36, and bundletool v1.17.2 to extract split APKs from the produced AAB.
                Commit: e6cd61e (tag v2.2.0)
                Split APK Comparison Results
                SplitResult
                base.apk✅ Identical (modulo Play Store signing artifacts)
                split_config.xxhdpi.apk✅ Identical (modulo Play Store signing artifacts)
                split_config.arm64_v8a.apk❌ 4 native libraries differ
                Non-reproducible files in split_config.arm64_v8a.apk
                • lib/arm64-v8a/libbitkitcore.so
                • lib/arm64-v8a/libdatastore_shared_counter.so
                • lib/arm64-v8a/libjnidispatch.so
                • lib/arm64-v8a/libpubky_app_specs-90a3a8b6be1a7a22.so ← new in v2.2.0
                The same three libraries also differed in our v2.1.2 verification. libpubky_app_specs is new in v2.2.0.
                All AndroidManifest.xml, resources.arsc, META-INF/, and stamp-cert-sha256 differences are Play Store injection artifacts and are excluded from this finding.
                Likely Causes
                • libbitkitcore.so and libpubky_app_specs are Rust/native libraries distributed via GitHub Packages AARs (com.synonym:bitkit-core-android, etc.). If the AARs themselves were not built reproducibly, the embedded .so files will differ regardless of how the app build is reproduced.
                • libdatastore_shared_counter.so and libjnidispatch.so may differ due to how Play Store packages .so files vs. what bundletool extracts from a locally built AAB.
                We have not yet run diffoscope on the differing libraries. If the developers can point to
                
reproducible-build documentation or upstream CI for the native AARs, that would help narrow the
                
root cause.
                Environment
                • Script: bitkit_build.sh v0.3.6 (WalletScrutiny build scripts)
                • Container image: bitkitwallet_build_env:3 (Ubuntu 22.04, Zulu JDK 17, Android SDK build-tools 35
                  
+ 36)
                • Runtime: Podman on Ubuntu 24.04
                Metadata
                Metadata
                Assignees
                Labels
                No labels
                No labels
                Type
                No type
                Projects
                No projects
                  Milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions