From a0048554c65f3e2a402810a4d10449a3fe582cb0 Mon Sep 17 00:00:00 2001
From: callebtc <93376500+callebtc@users.noreply.github.com>
Date: Tue, 28 Jul 2026 17:50:17 +0200
Subject: [PATCH] fix: isolate container SDK configuration

---
 docs/reproducible-builds.md                          | 3 ++-
 tools/reproducible-builds/build-in-container.sh      | 6 ++++++
 tools/reproducible-builds/container-local.properties | 1 +
 3 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 tools/reproducible-builds/container-local.properties

diff --git a/docs/reproducible-builds.md b/docs/reproducible-builds.md
index 290eb72e..4286510c 100644
--- a/docs/reproducible-builds.md
+++ b/docs/reproducible-builds.md
@@ -28,7 +28,8 @@ The build uses a clean source tree, an isolated Gradle user home, UTC, a stable
 locale, `SOURCE_DATE_EPOCH` from the Git commit, no Gradle build or configuration
 cache, fresh tasks, and a non-incremental in-process Kotlin compiler. Native
 builds remap source paths and release validation rejects host paths in packaged
-libraries.
+libraries. The container overlays a canonical `local.properties`, so an ignored
+Android Studio file cannot redirect Gradle to a host-specific SDK.
 
 AGP's embedded VCS record is disabled because its Git discovery depends on the
 host checkout layout. The canonical `BUILDINFO.json` and GitHub provenance
diff --git a/tools/reproducible-builds/build-in-container.sh b/tools/reproducible-builds/build-in-container.sh
index 0fe7a71f..09b3871e 100755
--- a/tools/reproducible-builds/build-in-container.sh
+++ b/tools/reproducible-builds/build-in-container.sh
@@ -7,11 +7,16 @@ PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 IMAGE_NAME="bitchat-android-reproducible-builder:21.0.11"
 OUTPUT_DIR="${1:-$PROJECT_ROOT/.reproducible-build/release}"
 GRADLE_HOME_NAME="${BITCHAT_CONTAINER_GRADLE_HOME_NAME:-gradle-home-container}"
+CONTAINER_LOCAL_PROPERTIES="$SCRIPT_DIR/container-local.properties"
 
 if ! command -v docker >/dev/null 2>&1; then
   echo "error: Docker is required for the canonical container build" >&2
   exit 1
 fi
+if [ ! -f "$CONTAINER_LOCAL_PROPERTIES" ]; then
+  echo "error: missing canonical container local.properties" >&2
+  exit 1
+fi
 
 if [ "${BITCHAT_ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git -C "$PROJECT_ROOT" status --porcelain --untracked-files=normal)" ]; then
   echo "error: reproducible builds require a clean source tree" >&2
@@ -58,6 +63,7 @@ docker run \
   --env HOME=/workspace/.reproducible-build \
   --env SOURCE_DATE_EPOCH="$source_date_epoch" \
   --volume "$PROJECT_ROOT:/workspace" \
+  --mount "type=bind,source=$CONTAINER_LOCAL_PROPERTIES,target=/workspace/local.properties,readonly" \
   "${output_mount[@]}" \
   "$IMAGE_NAME" \
   "$container_output"
diff --git a/tools/reproducible-builds/container-local.properties b/tools/reproducible-builds/container-local.properties
new file mode 100644
index 00000000..daae45e6
--- /dev/null
+++ b/tools/reproducible-builds/container-local.properties
@@ -0,0 +1 @@
+sdk.dir=/opt/android-sdk