Informational 15 Bitcoin Committed Jan 30, 2026 · 16:45 UTC

build: android: use Java 17, as before debian upgrade :/

4da7b7f5 View source ↗

Public commit record

What the developer wrote

Authored by SomberNight

93/100 · Strong

build: android: use Java 17, as before debian upgrade :/

When building on debian 12, we were using Java 17.
On debian 13, Java 17 is not packaged anymore, instead there is Java 21 and 25.
Ideally we should upgrade to Java 21 and just install it from apt.

However old Gradle is not compatible with new Java, so we have to upgrade Gradle for that.
- see https://docs.gradle.org/current/userguide/compatibility.html

Old Gradle is giving build errors with Java 21:
```
Could not compile build file '/home/user/wspace/electrum/.buildozer_qml/android/platform/build-arm64-v8a/dists/Electrum/build.gradle'.
> startup failed:
General error during conversion: Unsupported class file major version 65

java.lang.IllegalArgumentException: Unsupported class file major version 65
```

for our p4a fork, I tried to cherry-pick stuff from upstream:
- https://github.com/kivy/python-for-android/commit/17bf5322791ec8cec85836fbe906e63664a05445
- https://github.com/kivy/python-for-android/pull/3172
https://github.com/kivy/python-for-android/commit/a8f2ca1c5b1bb6696b47fdf2c052285e116e0ebe
- see https://github.com/SomberNight/python-for-android/compare/a01269f7799587ad74ee40e0b642d917b8db7d4e...846a1094874aeb64b623fa746222a41851245271

That seems sufficient to upgrade Gradle as far as p4a is concerned.

However that still did not work yet:
- contrib/android/make_barcode_scanner.sh fails, as
markusfisch/zxing-cpp and markusfisch/CameraView
are also using too old gradle versions for Java 21
- it seems they are intentionally doing this to maintain compat with Android 4:
see https://github.com/markusfisch/zxing-cpp/commit/d98ed5d0be513c4077b4c13d1f7873f141949839

So for now maybe the path of least resistance is to downgrade to Java 17 :(

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference

The short version

What changed, and why it matters

This commit changes the Android build environment for the Electrum Bitcoin wallet. Because the newer Debian Linux version no longer includes Java 17, the developers manually download and install old Java 17 packages from an archived Debian snapshot instead of using the newer Java versions available in the operating system. This is a temporary workaround to keep the Android app building, not a fix for a user-facing security bug. The main risk is that relying on an older Java version and manually downloaded packages could eventually miss security updates or break the build process, but there is no direct evidence this introduces an exploitable vulnerability in the wallet app itself.

Recommended action

Treat this as a build-maintenance change, not a security patch. Reviewers should verify the SHA-256 hashes of the downloaded Debian packages against official Debian snapshot records, ensure snapshot.debian.org is a trusted source, and monitor for future migration to a supported Java/Gradle combination. Users of the Electrum app do not need to take action based solely on this commit.

Security signals we found

Downgrade to an older Java runtime/toolchain in the build environment

Manual download of binary packages from a third-party snapshot archive (snapshot.debian.org) instead of the distribution package manager

SHA-256 hashes are pinned for the downloaded .deb files

No application code, cryptographic, or network changes

No vendor disclosure of a security vulnerability

Technical analysis

Evidence from the diff

The commit modifies contrib/android/Dockerfile to replace an apt-installed openjdk-21-jdk-headless with a manual download and dpkg installation of openjdk-17-jre-headless and openjdk-17-jdk-headless from snapshot.debian.org. The reason given is that Debian 13 only packages Java 21/25, but the project’s older Gradle and dependencies (markusfisch/zxing-cpp, CameraView) are incompatible with Java 21. The Dockerfile adds dependencies such as ca-certificates-java, libcups2, libfontconfig1, libjpeg62-turbo, libnss3, libasound2, libfreetype6, libharfbuzz0b, libpcsclite1, and liblcms2-2 needed by the downloaded OpenJDK debs. The change is purely build-environment configuration; no application code, cryptography, or network logic is modified.

Changed components

contrib/android/DockerfileAndroid build container environmentOpenJDK toolchain used for Android builds

Inspect captured patch +35 / −4

diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index 7d643e4..d462bd4 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -91,11 +91,42 @@ RUN mkdir --parents "${ANDROID_SDK_HOME}/.android/" \
     && echo '### User Sources for Android SDK Manager' \
         > "${ANDROID_SDK_HOME}/.android/repositories.cfg"
 
-# accept Android licenses (JDK necessary!)
+# download Java-17 (debian 13 only packages Java-21 and Java-25)
+# - we download the amd64 binaries from debian 12 repos
+# - we should try to upgrade to Java-21...
+#   - the main blocker seems to be having to update Gradle (to a version compatible with Java-21)
+#     - make_barcode_scanner.sh: markusfisch/{zxing-cpp, ...} pins old Gradle
+ENV JAVA_JRE_DL_URL="https://snapshot.debian.org/archive/debian/20260130T143028Z/pool/main/o/openjdk-17/openjdk-17-jre-headless_17.0.18+8-1~deb12u1_amd64.deb"
+ENV JAVA_JRE_ARCHIVE="openjdk-17-jre-headless.deb"
+ENV JAVA_JRE_HASH="5bc36cbb4e383dbea4168d57b5fd9b42375ec8837dd62a1d56677632c3c960e0"
+ENV JAVA_JDK_DL_URL="https://snapshot.debian.org/archive/debian/20260130T143028Z/pool/main/o/openjdk-17/openjdk-17-jdk-headless_17.0.18+8-1~deb12u1_amd64.deb"
+ENV JAVA_JDK_ARCHIVE="openjdk-17-jdk-headless.deb"
+ENV JAVA_JDK_HASH="8841044caa66860a71039342fe3c02b7853b61c518e05970e501faa215b1788a"
 RUN apt -y update -qq \
-    && apt -y install -qq --no-install-recommends --allow-downgrades \
-        openjdk-21-jdk-headless \
-    && apt -y autoremove
+    && apt -y install -qq --no-install-recommends \
+        ca-certificates-java \
+        java-common \
+        libcups2 \
+        libfontconfig1 \
+        liblcms2-2 \
+        libjpeg62-turbo \
+        libnss3 \
+        libasound2 \
+        libfreetype6 \
+        libharfbuzz0b \
+        libpcsclite1 \
+    && apt -y autoremove \
+    && cd /opt \
+    && curl --location --progress-bar "${JAVA_JRE_DL_URL}" --output "${JAVA_JRE_ARCHIVE}" \
+    && echo "${JAVA_JRE_HASH} ${JAVA_JRE_ARCHIVE}" | sha256sum -c - \
+    && dpkg -i "${JAVA_JRE_ARCHIVE}" \
+    && rm "${JAVA_JRE_ARCHIVE}" \
+    && curl --location --progress-bar "${JAVA_JDK_DL_URL}" --output "${JAVA_JDK_ARCHIVE}" \
+    && echo "${JAVA_JDK_HASH} ${JAVA_JDK_ARCHIVE}" | sha256sum -c - \
+    && dpkg -i "${JAVA_JDK_ARCHIVE}" \
+    && rm "${JAVA_JDK_ARCHIVE}"
+
+# accept Android licenses (JDK necessary!)
 RUN yes | ${ANDROID_SDK_MANAGER} --licenses > /dev/null

Risk score

Why this scored 15/100

Our methodology →

Potential impact 2/30

Exploitability 3/25

Stealth signal 2/15

Affected reach 2/15

Confidence 4/10

Evidence quality 2/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

wallet: sign_message: strip whitespaces in GUIs, do not strip in CLI

qml: strip whitespace from message before signing, as in qt gui

trezor: drop session after closing it