build: android: build and use python 3.12 on host, instead of apt 3.13
What the developer wrote
Authored by SomberNight
build: android: build and use python 3.12 on host, instead of apt 3.13
- want to do the android build on debian 13 (stable)
- debian 13 ships python 3.13 in apt
- p4a requires Cython < 3.0
- ref https://github.com/kivy/python-for-android/issues/2919
- ref https://github.com/kivy/buildozer/issues/1526
- the newest such Cython is version 0.29.37, which predates python 3.13
- the latest python I managed to build cython 0.29.37 with is 3.12
- upstream p4a really would need some love :(
- this is not even just an issue on our p4a fork, but still unsolved upstream
- re rebasing our fork: https://github.com/spesmilo/electrum/issues/10331
What changed, and why it matters
This commit changes how the Android version of the Electrum wallet is built. The build system previously used the version of Python that comes with Debian's package manager, but Debian 13 now ships Python 3.13, which is too new for some older build tools the project still depends on. The fix downloads and compiles Python 3.12 from source inside the build container so the Android build can still work. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a build-compatibility workaround.
Treat as a routine build-maintenance change. If reviewing supply-chain risk, verify the pinned Python 3.12.12 SHA-256 hash (487c908ddf4097a1b9ba859f25fe46d22ccaabfb335880faac305ac62bffb79b) against python.org and consider whether building CPython from source in the Android build container is acceptable compared to using a distribution package. No security patch deployment is indicated by this commit alone.
Security signals we found
No security-relevant code change in the wallet or networking logic
Build script now downloads and compiles a specific Python version from upstream python.org with a pinned SHA-256 hash
Removal of apt-managed Python packages in favor of a manually compiled interpreter
No mention of CVE, vulnerability, bug bounty, researcher credit, or security advisory in commit message or diff
Evidence from the diff
The patch modifies contrib/android/Dockerfile. It removes the installation of python3/python3-dev/python3-pip/python3-setuptools/python3-venv from apt, then adds a build-from-source step for CPython 3.12.12 (with a SHA-256 checksum verification), installs it under /opt/cpython/install, and uses that interpreter to create the buildozer venv. The stated reason is that python-for-android and buildozer still require Cython < 3.0, and the newest such Cython (0.29.37) cannot be built with Python 3.13. No runtime wallet code is changed.
Changed components
contrib/android/DockerfileInspect captured patch +21 / −6
diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index a7c8d90..7d643e4 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -129,11 +129,6 @@ RUN curl --location --progress-bar \
# https://github.com/kivy/buildozer/blob/master/docs/source/installation.rst#android-on-ubuntu-2004-64bit
RUN apt -y update -q \
&& apt -y install -q --no-install-recommends --allow-downgrades \
- python3 \
- python3-dev \
- python3-pip \
- python3-setuptools \
- python3-venv \
wget \
lbzip2 \
patch \
@@ -182,9 +177,29 @@ RUN chown --recursive ${UID} ${WORK_DIR} ${ANDROID_SDK_HOME}
RUN chown ${UID} /opt
USER ${UID}
+# build cpython. FIXME we can't use the python3 from apt, as it is too new o.O
+# - p4a and buildozer require cython<3 (see https://github.com/kivy/python-for-android/issues/2919)
+# but the last such version, cython 0.29.37, can only be built by up to python 3.12
+ENV VENV_PYTHON_VERSION="3.12.12"
+ENV VENV_PY_VER_MAJOR="3.12"
+ENV VENV_PYTHON_HASH="487c908ddf4097a1b9ba859f25fe46d22ccaabfb335880faac305ac62bffb79b"
+RUN mkdir --parents "/opt/cpython/download" && cd "/opt/cpython/download" \
+ && wget "https://www.python.org/ftp/python/${VENV_PYTHON_VERSION}/Python-${VENV_PYTHON_VERSION}.tgz" \
+ && echo "${VENV_PYTHON_HASH} Python-${VENV_PYTHON_VERSION}.tgz" | sha256sum -c - \
+ && tar xf "Python-${VENV_PYTHON_VERSION}.tgz" -C "/opt/cpython/download" \
+ && cd "Python-${VENV_PYTHON_VERSION}" \
+ && mkdir "/opt/cpython/install" \
+ && ./configure \
+ --prefix="/opt/cpython/install" \
+ -q \
+ && make "-j$(nproc)" -s \
+ && make -s altinstall \
+ && ln -s "/opt/cpython/install/bin/python${VENV_PY_VER_MAJOR}" "/opt/cpython/install/bin/python3"
+RUN "/opt/cpython/install/bin/python3" -m ensurepip
+
# venv, VIRTUAL_ENV is used by buildozer to indicate a venv environment
ENV VIRTUAL_ENV=/opt/venv
-RUN python3 -m venv ${VIRTUAL_ENV}
+RUN "/opt/cpython/install/bin/python3" -m venv ${VIRTUAL_ENV}
ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
COPY contrib/deterministic-build/requirements-build-base.txt /opt/deterministic-build/
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.