We Keep Coding

How to make Android applications with reproducible builds?

In my experience, recompiling the source code for the same Android application won't produce the same binary every time. A reproducible build is very useful for developers, but I think the most important benefit from a reproducible build process is security. In open source Android apps, how we can verify produced binary (.apk) is really compiled from reviewed source code? Is there any way to generate reproducible builds from Android SDK or Java?

"Reproducible"/"deterministic" build refers to build processes where the compiler outputs a binary that is always identical, given identical input files/build system/chroot. (The article you linked to is actually talking about being able to build/run the same version of an app that a bug is filed against, which is something different. See this description of how Tor makes deterministic builds.)
Java packages seem to be very difficult to work with, since timestamps are present in many, many places. One thing you could try, in lieu of exact binary compatibility, is to decompile the two .apk's, and see if that decompiled output is identical.

The F-Droid project has been working on reproducible builds for Android for a couple years now. The Android-specific issues are tracked at https://f-droid.org/docs/Reproducible_Builds It is still a tricky process, especially if the app includes NDK code. If the app is only Java, then there are a few relatively easy steps that will get you there, like pre-crunching PNGs and committing them to git.
Google doesn't make it easy to reproduce APKs in the longer term, since they do a lot of random little changes, like:
adding a non-reproducible version to AndroidManifest.xml
different binary releases with the same version number
Definitely check out diffoscope for viewing the differences between two builds. You can see lots of example output at https://verification.f-droid.org

I just found that Telegram claims experimental reproducible builds for their Android app: https://core.telegram.org/reproducible-builds so it might be worth to study how they are achieving it.
The procedure uses Docker to build, and at the end compares the APKs with:
python apkdiff.py telegram_store.apk telegram_built.apk
which suggests they are not byte-by-byte the same.
apkdiff.py is present in-tree at: https://github.com/DrKLO/Telegram/blob/e1c101c334c80387cf10ca9857052e70e19c60af/apkdiff.py

How to share Java project with other developers? [closed]

Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 10 years ago.
Improve this question
I am working on a Java project together with a collaborator, and we are both using the Eclipse editor. What I want to do is to be able to share the .java files with him so that we can both edit it separately but see what has the other has written. Currently, I am doing this is an ad-hoc way by sharing a Dropbox folder that contains the project. However, this approach does not work well because he is using a different version of Java (as he runs a Mac while I am using Windows). For me to run the project, I would have to clear all the .class files that he has created which will appear on my computer since Dropbox just shares all the files.
I have heard of CVS as a way to manage file sharing among developers, but it sounds like a lot of work. I don't know for example how to get a CVS server or what to do to get it to work. Is there an easy and straightforward way to enable us to work together on the same Java project? Is GitHub the answer?

This is definitely the job of source control, as other answers have mentioned, Git or SVN are probably your best choices. Git is the newer one and is gaining a ton of popularity (probably thanks to GitHub).
GitHub is pretty easy to learn and can even take care of a lot of the more difficult tasks for you with their new GitHub for Windows client. They also have a GitHub for Mac client. Once you are more familiar with the tool you can get the EGit plugin for eclipse so you can control the source control directly from your IDE.
Additionally, GitHub created an online interactive tutorial for learning git.
As for clearing out class files (and also your .settings and .project and .classpath files from eclipse), you can instruct git to ignore these types of files using a .gitignore file. You can find templates for various languages (including Java) here.

you could spent the time to learn git at: https://help.github.com/articles/set-up-git
it's a very valuable tool and once you get used to it it will be very easy to share code.

Or better yet, Mercurial. It follows the same approach as Git, but is way simpler and works without hassle. To start a repository within the current directory, just run:
hg init
Have a look at the documentation for more information.

I recommend "Subversion"
Google it and look at the information.
You can easily check out files and check in.
I wish you luck.

Depending on what your future plans are the Git or Subversion would be fine. I finally made the switch to Git after years of using SVN.
Note that in addition to Github (which is great) there are also some other repository hosting services, some of which offer free "personal" accounts (most make your code public, but I think a few still give you a limited amount of space for free).

CVS is getting old and people are moving out of it to other source code control tools
The most famous tools are SVN and Git. There are other tools but less famous I believe
You definitly need a software revivision tool if you are going to work in a team(or even alone for that matters), as it marks the changes that have been made, when and by whom, etc...
google code for example offers an easy way to setup your svn repository in one minute. there are also alot of companies offers such a service online for free or for small money, depending on your need. So if you just need a sandbox, then setup a svn on google code and try it out
a code revision tool is almost a must for every programmer
good luck

Using Java Source Code in my own project [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about programming within the scope defined in the help center.
Closed 7 years ago.
Improve this question
I wrote a program in Java 6.0, but it turns out that some of our client only have 5.0.
The issues is that lot of features that 6.0 has was not in 5.0 yet. For example:
JTable Sorting, Filtering feature
SwingWorker class
My Question is :
is it legal to just copy the java 6.0 source code to my own project so that my client with 5.0 jre can run it.
from technical point of view, is it hard to copy the classes source code like TableRowSorter, regexFilter to my own project and let it work?
Thanks

Probably no, the OpenJDK classes are under GPL meaning you will have to put your sources under GPL too. The Oracle Java classes are also under a "you cannot just do what you want to with our sources", so this is most likely a VERY bad idea.
You can use Retroweaver to make your source work with an earlier version of Java, but I would say that you should make your code work with Java 5, optionally using Java 6 facilities if available, and then say to your customers which things they will get from upgrading.
2021 edit: As of Java 17 the proper solution would be to include a tested JVM as part of your deployment. There is tooling for bringing just what you need.

One question you should ask is: why haven't your clients upgraded to Java 6.0? Since it's free and easy to do they must have a reason, and you should probably find out what it is before sending them code from it.

That depends on the source code you are copying from. From JavaSE? OpenJDK?
Wherever you want to copy from, check their license for the code.
The copying may be simple, copying just the classes and it’s dependencies. There may be a lot of specific dependencies though, which can make it consume a lot of time. And you’ll really have a problem when you have to copy a changed class that already existed in version 5, where you would need one version for some code, and the newer for the other. But if you’re only using Java6 code in that project it should be alright. Moving the classes into another package may also be an option, with potentially a lot of work as well though.

Java licensing for commercial distribution [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
We don’t allow questions seeking recommendations for books, tools, software libraries, and more. You can edit the question so it can be answered with facts and citations.
Closed 7 years ago.
Improve this question
I'm thinking of using Java to write a program that I might try to sell one day. I'm new to Java so I have to ask, what types of tools/software/etc will I need (from development, to distribution, to user-friendly installation on users' machines) that have licenses that must be considered to make sure they allow sales and closed source code, etc.?
Should we assume the user already runs at least one Java app, and therefore has a fairly recent version of Java on their machine?
Also, do you have any recommendations for specific tools that are definitely suitable for this purpose?

It's very rare to see any development tools that restrict the way you can use software created using them. The only exception to that are libraries, and that is not a problem with standard Java libraries. Tools, IDE and so on - regardless of whether they're free or not - will not affect how you can distribute your code.
There are some weird exceptions, like BitKeeper source control software, the license of which prohibits anyone using it from trying to create software that could compete with BitKeeper - which is why I advise to stay as far away from the thing, and the company behind it, as possible. In the end, if you want to be absolutely legally clear, you'll have to hire a lawyer and have him go through licenses and EULAs for all software you're going to use in your development process, because of stuff like this.
Some specific data points: Java itself is okay (both compiler and libraries); both Ant and Maven are okay; and Eclipse and NetBeans are okay.

For development, you will likely need an IDE. The top picks are:
Eclipse (most features)
IntelliJ (non-free)
Netbeans (easiest to learn, imo)
A few others with much lower popularity
For a free installation program, I've had the best experiences with IzPack, but there are others available. Similarly, to convert to a .exe for easy launching, I recommend Launch4J.
I don't think that its safe to assume that users have Java installed. Many will, but the versions will vary fairly widely, and the few that don't will tend to cause problems. Obviously, this may vary depending upon your intended audience (and how much control you have over them).

For cross platform distribution you might want to look into launch4j: http://launch4j.sourceforge.net/
Also you might also want to obfuscate and optimize your code, for that you can use ProGuard: http://proguard.sourceforge.net/
For your development use any of the open source tools available such as eclipse or netbeans, or even emacs with jdee.
You should not assume users have Java, package a version of java with your application.
For installation you might want to search for some open source solutions, the only one I know of is install4j and it is commercial. http://www.ej-technologies.com/products/install4j/features.html

This is a question that is really hard to answer because the requirement and the preferences of the users are different from each other.
But I will tell you one entry point. Use ECLIPSE as your IDE to develop your Java code. It is an opensource one so you don't need any licence for that. When you are working on your project you will need variety of other tools to do various stuff. Fortunately most of the essential functions are implemented as plugins for eclipse. You can seperately add them to eclipse.
With time, you'll get the experience and you will have enough knowledge to swich to the necessary tools etc

Detecting API changes/evolution [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
We don’t allow questions seeking recommendations for books, tools, software libraries, and more. You can edit the question so it can be answered with facts and citations.
Closed 5 years ago.
Improve this question
I want to measure API evolution for a given Java project, in particular new/renamed classes, new methods, newly deprecated methods, etc. Is there a tool that detect such changes?
Back in 2007, a Google GSoc project was initiated, however, I cannot find the final work.

I'd use Clirr for that, a binary compatibility checker. From the Clirr web site:
What is it?
Clirr is a tool that checks Java
libraries for binary and source
compatibility with older releases.
Basically you give it two sets of jar
files and Clirr dumps out a list of
changes in the public api. The Clirr
Ant task can be configured to break
the build if it detects incompatible
api changes. In a continuous
integration process Clirr can
automatically prevent accidental
introduction of binary or source
compatibility problems.
...
Features
Report all API changes (currently only partially implemented)
Evaluate each change wrt. binary and source compatibility
support plain text and XML reports
Flexible failure handling (warnings vs. errors, break the build or set
error property)

There's also a new API evolution checking tool called Revapi

Btw there seems to be an api-checker in the gwt source code, don't know if that is the product of the mentioned GSoc project.
GwtJavaApiCompatibilityChecker is also used in build.xml

Try japi-compliance-checker tool. It's open-source. The tool shows API changes and detects both backward source (SC) and backward binary (BC) compatibility issues between two jar archives:
japi-compliance-checker -old LIB-0.jar -new LIB-1.jar
Sample reports for log4j: http://abi-laboratory.pro/java/tracker/timeline/log4j/
You can find classification of found compatibility problems by severity level in the reports for particular library versions:

JDiff is maybe also worth a mentioning.
JDiff is a Javadoc doclet which
generates an HTML report of all the
packages, classes, constructors,
methods, and fields which have been
removed, added or changed in any way,
including their documentation, when
two APIs are compared. This is very
useful for describing exactly what has
changed between two releases of a
product. Only the API (Application
Programming Interface) of each version
is compared. It does not compare what
the source code does when executed.
As I understood it runs on the sourcefolder of the old version and generates an xml file. The same for the sourcefolder with the new version. Than the two xml-outputs are compared and a changelist compiled. In html-javadoc-api-style

You might also want to try japicmp.