Bull Bitcoin Mobile v6.2.3 - Reproducible Build Issue

[xrviv]

R8 obfuscation runs with non-deterministic settings, preventing APK reproducibility. R8 v8.6.17 generates unique obfuscation mappings on each build (different `pg_map_hash`), resulting in 466,604 lines of bytecode differences across 1,128 files. All native Rust libraries (libbdk_flutter, libark_wallet, libboltz) compile identically — the issue is R8 only.

User stories

• As an open-source contributor or auditor, I want to reproduce the exact same APK from source, so I can verify the published binary matches the public code

Acceptance criteria

• Release APK is reproducible: building from the same commit and environment produces a byte-identical APK
• R8 obfuscation is either disabled, made deterministic (fixed dictionary), or mapping files are published with each release
• `.env` build-time configuration is documented for reproducibility

Test cases

• Build release APK twice from the same commit and verify outputs are identical
• Verify native Rust libraries remain reproducible after the R8 fix
• Verify APK size and performance are acceptable after the change
• Third-party (WalletScrutiny) can independently reproduce the build

Context

• Reported by WalletScrutiny (Danny Garcia)
• Options: disable R8 minification, use fixed obfuscation dictionary, or publish mapping files per release

[i5hi]

Hey thanks for following up! We have prioritized this for the upcoming spint.

We will make the updates requested and follow up.

[thibistaken]

Duplicate of #937

[ethicnology]

Hey @xrviv I've disable R8 shrinking and ProGuard obfuscation in #1523, it should be better for the next version