Bug#1099632: Treat AARs as zips

Matt Corallo dsgim at bluematt.me
Tue Mar 11 15:19:10 GMT 2025



On 3/11/25 10:16 AM, Chris Lamb wrote:
> Matt Corallo wrote:
> 
>> https://git.bitcoin.ninja/?p=ldk-java-bins;a=tree;f=v0.1.1.0;hb=refs/heads/main
>> and
>> https://git.bitcoin.ninja/?p=ldk-java-bins;a=tree;f=v0.1.0.0;hb=refs/heads/main
> 
> Thanks for linking these. So, the proximate cause of this issue is
> that the underlying file(1) utility reports these as Android packages:
> 
>      $ file v0.1.0.0_LDK-release.aar v0.1.1.0_LDK-release.aar
>      v0.1.0.0_LDK-release.aar: Android package (APK), with AndroidManifest.xml
>      v0.1.1.0_LDK-release.aar: Android package (APK), with AndroidManifest.xml
> 
> In general, diffoscope basically has to trust what file(1) reports and
> proceed on that basis. We used to work around its bugs, but as you can
> imagine, that became something of a game of whack-a-mole...
> 
> In the first instance, just to confirm that file(1) is at fault here? As
> in, these are definitely not Android packages. :)

They're android "packages" in that they're libraries that other APKs can depend on, but certainly 
not runnable apps or anything of the like.

AFAIU, all "Android package (APK)"s should be treated like zips cause they are just zips with 
specific files in them.



More information about the Reproducible-builds mailing list