Informational 16 Bitcoin Committed Jul 4, 2026 · 16:14 UTC

android build: build p4a recipes with --no-isolation

6c5b7bf9 View source ↗

Public commit record

What the developer wrote

Authored by SomberNight

81/100 · Strong

android build: build p4a recipes with --no-isolation

the core change is https://github.com/spesmilo/python-for-android/commit/8c0fcc9ef2e559918ca96ecde6e09fe521bb1427
the rest here just follow that

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference

The short version

What changed, and why it matters

This commit updates the Android build system for the Electrum Bitcoin wallet. It changes which version of a build tool (python-for-android) is used and adjusts the exact pinned versions of helper Python packages used during the build. The changes are about making the build process more reproducible and compatible with newer packaging tools, not about fixing a vulnerability in the wallet app itself. There is no direct evidence in the commit that this fixes a security flaw.

Recommended action

Treat as a routine build-maintenance commit. Review the referenced python-for-android commit 8c0fcc9ef2e559918ca96ecde6e09fe521bb1427 for any security-relevant notes, and verify that the pinned hashes match the upstream PyPI packages. No urgent user action is indicated.

Security signals we found

Build dependency pinning with SHA-256 hashes (HashPinnedDependency) improves supply-chain reproducibility

P4A version bump to a newer commit on the electrum_202602 branch

No runtime application code changed

No mention of vulnerability, CVE, bug, or security fix in commit message or diff

Technical analysis

Evidence from the diff

The commit bumps the python-for-android (P4A) checkout to 8c0fcc9ef2e559918ca96ecde6e09fe521bb1427 and adds/adjusts hostpython_prerequisites in several P4A recipes to pin build-time dependencies (setuptools, wheel, flit-core, setuptools-scm, packaging) with cryptographic hashes. The title says recipes are now built with –no-isolation, meaning P4A will use the pre-installed pinned build dependencies instead of letting each package build in an isolated environment. This is a build-hygiene/reproducibility change. The diff does not show any runtime code change in Electrum, any patch to cryptographic logic, or any disclosure of a CVE.

Changed components

contrib/android/Dockerfilecontrib/android/p4a_recipes/packaging/__init__.pycontrib/android/p4a_recipes/pyjnius/__init__.pycontrib/android/p4a_recipes/pyqt6sip/__init__.pycontrib/android/p4a_recipes/setuptools/__init__.pycontrib/android/p4a_recipes/sip/__init__.py

Inspect captured patch +34 / −4

diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index 620f9cb..5d5bda9 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -234,7 +234,7 @@ RUN cd /opt \
     && /opt/venv/bin/python3 -m pip install --no-build-isolation --no-dependencies -e .
 
 # install python-for-android
-ENV P4A_CHECKOUT_COMMIT="1098be6964cfc2156959e435e81c2c50f8398586"
+ENV P4A_CHECKOUT_COMMIT="8c0fcc9ef2e559918ca96ecde6e09fe521bb1427"
 # ^ from branch electrum_202602 (note: careful with force-pushing! see #8162)
 RUN cd /opt \
     && git clone https://github.com/spesmilo/python-for-android \
diff --git a/contrib/android/p4a_recipes/packaging/__init__.py b/contrib/android/p4a_recipes/packaging/__init__.py
index b16d67d..8aab4b1 100644
--- a/contrib/android/p4a_recipes/packaging/__init__.py
+++ b/contrib/android/p4a_recipes/packaging/__init__.py
@@ -1,4 +1,5 @@
 from pythonforandroid.recipes.packaging import PackagingRecipe
+from pythonforandroid.util import HashPinnedDependency
 
 
 assert PackagingRecipe._version == "26.0"
@@ -8,6 +9,10 @@ assert PackagingRecipe.python_depends == []
 
 class PackagingRecipePinned(PackagingRecipe):
     sha512sum = "27a066a7d65ba76189212973b6a0d162f3d361848b1b0c34a82865cf180b3284a837cc34206c297f002a73feae414e25a26c5960bb884a74ea337f582585f1d2"
+    hostpython_prerequisites = [
+        HashPinnedDependency(package="flit-core==3.12.0",
+                             hashes=['sha256:e7a0304069ea895172e3c7bb703292e992c5d1555dd1233ab7b5621b5b69e62c']),
+    ]
 
 
 recipe = PackagingRecipePinned()
diff --git a/contrib/android/p4a_recipes/pyjnius/__init__.py b/contrib/android/p4a_recipes/pyjnius/__init__.py
index 267f5d9..b8ead6b 100644
--- a/contrib/android/p4a_recipes/pyjnius/__init__.py
+++ b/contrib/android/p4a_recipes/pyjnius/__init__.py
@@ -13,6 +13,10 @@ assert PyjniusRecipe.python_depends == []
 
 class PyjniusRecipePinned(util.InheritedRecipeMixin, PyjniusRecipe):
     hostpython_prerequisites = [
+        HashPinnedDependency(package="setuptools==80.9.0",
+                             hashes=['sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922']),
+        HashPinnedDependency(package="wheel==0.45.1",
+                             hashes=['sha256:708e7481cc80179af0e556bbf0cc00b8444c7321e2700b8d8580231d13017248']),
         HashPinnedDependency(package="Cython==3.1.8",
                              hashes=['sha256:282b3c8e6abc3fea421919e862e898ffdd86fc0796009bdb5ffdf8211413219f'])
     ]
diff --git a/contrib/android/p4a_recipes/pyqt6sip/__init__.py b/contrib/android/p4a_recipes/pyqt6sip/__init__.py
index dea2237..89ce5f8 100644
--- a/contrib/android/p4a_recipes/pyqt6sip/__init__.py
+++ b/contrib/android/p4a_recipes/pyqt6sip/__init__.py
@@ -17,8 +17,6 @@ class PyQt6SipRecipePinned(util.InheritedRecipeMixin, PyQt6SipRecipe):
     hostpython_prerequisites = [
         HashPinnedDependency(package="setuptools==80.9.0",
                              hashes=['sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922']),
-        HashPinnedDependency(package="packaging==26.0",
-                             hashes=['sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529']),
     ]
 
 
diff --git a/contrib/android/p4a_recipes/setuptools/__init__.py b/contrib/android/p4a_recipes/setuptools/__init__.py
new file mode 100644
index 0000000..0e43287
--- /dev/null
+++ b/contrib/android/p4a_recipes/setuptools/__init__.py
@@ -0,0 +1,18 @@
+from pythonforandroid.recipes.setuptools import SetuptoolsRecipe
+from pythonforandroid.util import HashPinnedDependency
+
+
+assert SetuptoolsRecipe._version == "80.9.0"
+assert SetuptoolsRecipe.depends == ['python3']
+assert SetuptoolsRecipe.python_depends == []
+
+
+class SetuptoolsRecipePinned(SetuptoolsRecipe):
+    sha512sum = "36eb1f219d29c6b9e135936bde2001ad70a971c8069cd0175d3a5325b450e6843a903d3f70043c9f534768ebeab8ab0c544b8f44456555d333f1ed72daa5c18b"
+    hostpython_prerequisites = [
+        HashPinnedDependency(package="setuptools==80.9.0",
+                             hashes=['sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922']),
+    ]
+
+
+recipe = SetuptoolsRecipePinned()
diff --git a/contrib/android/p4a_recipes/sip/__init__.py b/contrib/android/p4a_recipes/sip/__init__.py
index af6fdff..e01867f 100644
--- a/contrib/android/p4a_recipes/sip/__init__.py
+++ b/contrib/android/p4a_recipes/sip/__init__.py
@@ -2,7 +2,7 @@ from pythonforandroid.recipes.sip import SipRecipe
 from pythonforandroid.util import HashPinnedDependency
 
 assert SipRecipe._version == "6.15.1"
-assert SipRecipe.depends == ["python3"], SipRecipe.depends
+assert SipRecipe.depends == ["python3", "packaging"], SipRecipe.depends
 assert SipRecipe.python_depends == []
 
 
@@ -12,6 +12,11 @@ class SipRecipePinned(SipRecipe):
     hostpython_prerequisites = [
         HashPinnedDependency(package="setuptools==80.9.0",
                              hashes=['sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922']),
+        HashPinnedDependency(package="setuptools-scm==8.3.1",
+                             hashes=['sha256:332ca0d43791b818b841213e76b1971b7711a960761c5bea5fc5cdb5196fbce3']),
+        HashPinnedDependency(package="packaging==26.0",  # pulled in by setuptools-scm
+                             hashes=['sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529']),
+
     ]

Risk score

Why this scored 16/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 2/15

Confidence 7/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 16/100

Community notes

Related watches

Merge pull request #10830 from accumulator/qml_trustedcoin_wallet_scope

Merge pull request #10853 from f321x/swapserver_negative_nonce

swaps: handle negative PoW nonce gracefully