Android: Make apks files hermetic

Since bundletool does not produce hermetic zip files (apks files),
extract and re-zip so builds become deterministic again. Also localize
temp file/dir usage as much as possible.

Add .apks as a valid build artifact extension.

Fixed: 1008664
Change-Id: I72b237e49670c83c1aa48aa06795fb6d72dd43ba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1877150
Auto-Submit: Peter Wen <wnwen@chromium.org>
Reviewed-by: Takuto Ikuta <tikuta@chromium.org>
Reviewed-by: Andrew Grieve <agrieve@chromium.org>
Commit-Queue: Peter Wen <wnwen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#709005}

build/android/pylib/utils/app_bundle_utils.py

@@ -94,28 +94,36 @@ def GenerateBundleApks(bundle_path,
 
   def rebuild():
     logging.info('Building %s', bundle_apks_path)
-    with tempfile.NamedTemporaryFile(suffix='.json') as spec_file, \
-        build_utils.AtomicOutput(bundle_apks_path, only_if_changed=False) as f:
+    with tempfile.NamedTemporaryFile(suffix='.apks') as tmp_apks_file:
       cmd_args = [
           'build-apks',
           '--aapt2=%s' % aapt2_path,
-          '--output=%s' % f.name,
+          '--output=%s' % tmp_apks_file.name,
           '--bundle=%s' % bundle_path,
           '--ks=%s' % keystore_path,
           '--ks-pass=pass:%s' % keystore_password,
           '--ks-key-alias=%s' % keystore_alias,
           '--overwrite',
       ]
-      if device_spec:
-        json.dump(device_spec, spec_file)
-        spec_file.flush()
-        cmd_args += ['--device-spec=' + spec_file.name]
+
       if mode is not None:
         if mode not in BUILD_APKS_MODES:
           raise Exception('Invalid mode parameter %s (should be in %s)' %
                           (mode, BUILD_APKS_MODES))
         cmd_args += ['--mode=' + mode]
-      bundletool.RunBundleTool(cmd_args)
+
+      with tempfile.NamedTemporaryFile(suffix='.json') as spec_file:
+        if device_spec:
+          json.dump(device_spec, spec_file)
+          spec_file.flush()
+          cmd_args += ['--device-spec=' + spec_file.name]
+        bundletool.RunBundleTool(cmd_args)
+
+      # Make the resulting .apks file hermetic.
+      with build_utils.TempDir() as temp_dir, \
+        build_utils.AtomicOutput(bundle_apks_path, only_if_changed=False) as f:
+        files = build_utils.ExtractAll(tmp_apks_file.name, temp_dir)
+        build_utils.DoZip(files, f, base_dir=temp_dir)
 
   if check_for_noop:
     # NOTE: BUNDLETOOL_JAR_PATH is added to input_strings, rather than

tools/determinism/compare_build_artifacts.py

@@ -29,6 +29,7 @@ def get_files_to_compare(build_dir, recursive=False):
   allowed = frozenset((
     '.aab',
     '.apk',
+    '.apks',
     '.app',
     '.bin',  # V8 snapshot file snapshot_blob.bin
     '.dll',