What changed, and why it matters
This commit is a routine version bump from 2.4.0 to 2.4.1 for the Sparrow Wallet application. It updates version strings in the build file, macOS app metadata, and the application's Java code, plus refreshes documentation about which Java version to use for reproducible builds. There are no code changes that affect wallet security, transaction handling, or user data.
No security action required. Treat as a normal release/version-bump commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff only changes version identifiers (2.4.0 → 2.4.1) in build.gradle, macOS Info.plist, and SparrowWallet.java. The docs/reproducible.md file is updated to recommend Eclipse Temurin 25.0.2+10 (instead of 22.0.2+9) and to warn against using system package-manager Java installs because they replace the bundled cacerts, breaking build reproducibility. No functional source code, cryptographic, networking, or UI logic is modified.
Changed components
build.gradle version stringmacOS Info.plist CFBundleShortVersionStringSparrowWallet.java APP_VERSION constantdocs/reproducible.md build instructionsInspect captured patch +23 / −50
diff --git a/build.gradle b/build.gradle
index 02e52ba..b7ffb5b 100644
--- a/build.gradle
+++ b/build.gradle
@@ -20,7 +20,7 @@ if(System.getProperty("os.arch") == "aarch64") {
def headless = "true".equals(System.getProperty("java.awt.headless"))
group = 'com.sparrowwallet'
-version = '2.4.0'
+version = '2.4.1'
repositories {
mavenCentral()
diff --git a/docs/reproducible.md b/docs/reproducible.md
index a146090..e44c103 100644
--- a/docs/reproducible.md
+++ b/docs/reproducible.md
@@ -12,63 +12,36 @@ Work on resolving both of these issues is ongoing.
### Install Java
Because Sparrow bundles a Java runtime in the release binaries, it is essential to have the same version of Java installed when creating the release.
-For v1.6.6 to v1.9.1, this was Eclipse Temurin 18.0.1+10. For v2.0.0 and later, Eclipse Temurin 22.0.2+9 is used.
+For v1.6.6 to v1.9.1, this was Eclipse Temurin 18.0.1+10. For v2.0.0 to v2.3.1, this was Eclipse Temurin 22.0.2+9. For v2.4.0 and later, Eclipse Temurin 25.0.2+10 is used.
+
+Note: Do not install Java using a system package manager (e.g. apt, dnf, rpm).
+Linux packages replace the JDK's bundled `cacerts` file with a symlink to the system CA certificates, which differ from those in the release tarballs and will produce a non-reproducible build.
#### Java from Adoptium github repo
-It is available for all supported platforms from [Eclipse Temurin 22.0.2+9](https://github.com/adoptium/temurin22-binaries/releases/tag/jdk-22.0.2%2B9).
+It is available for all supported platforms from [Eclipse Temurin 25.0.2+10](https://github.com/adoptium/temurin25-binaries/releases/tag/jdk-25.0.2%2B10).
For reference, the downloads are as follows:
-- [Linux x64](https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.2%2B9/OpenJDK22U-jdk_x64_linux_hotspot_22.0.2_9.tar.gz)
-- [Linux aarch64](https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.2%2B9/OpenJDK22U-jdk_aarch64_linux_hotspot_22.0.2_9.tar.gz)
-- [MacOS x64](https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.2%2B9/OpenJDK22U-jdk_x64_mac_hotspot_22.0.2_9.tar.gz)
-- [MacOS aarch64](https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.2%2B9/OpenJDK22U-jdk_aarch64_mac_hotspot_22.0.2_9.tar.gz)
-- [Windows x64](https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.2%2B9/OpenJDK22U-jdk_x64_windows_hotspot_22.0.2_9.zip)
-
-#### Java from Adoptium deb repo
-
-It is also possible to install via a package manager on *nix systems. For example, on Debian/Ubuntu systems:
-
-- Install dependencies:
-```sh
-sudo apt-get install -y wget curl apt-transport-https gnupg
-```
-
-Download Adoptium public PGP key:
-```sh
-curl --tlsv1.2 --proto =https --location -o adoptium.asc https://packages.adoptium.net/artifactory/api/gpg/key/public
-```
-
-Check if key fingerprint matches: `3B04D753C9050D9A5D343F39843C48A565F8F04B`:
-```
-gpg --import --import-options show-only adoptium.asc
-```
-If key doesn't match, do not proceed.
-
-Add Adoptium PGP key to a the keyring shared folder:
-```sh
-sudo cp adoptium.asc /usr/share/keyrings/
-```
+- [Linux x64](https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.2%2B10/OpenJDK25U-jdk_x64_linux_hotspot_25.0.2_10.tar.gz)
+- [Linux aarch64](https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.2%2B10/OpenJDK25U-jdk_aarch64_linux_hotspot_25.0.2_10.tar.gz)
+- [MacOS x64](https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.2%2B10/OpenJDK25U-jdk_x64_mac_hotspot_25.0.2_10.tar.gz)
+- [MacOS aarch64](https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.2%2B10/OpenJDK25U-jdk_aarch64_mac_hotspot_25.0.2_10.tar.gz)
+- [Windows x64](https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.2%2B10/OpenJDK25U-jdk_x64_windows_hotspot_25.0.2_10.zip)
-Add Adoptium debian repository:
-```sh
-echo "deb [signed-by=/usr/share/keyrings/adoptium.asc] https://packages.adoptium.net/artifactory/deb $(awk -F= '/^VERSION_CODENAME/{print$2}' /etc/os-release) main" | sudo tee /etc/apt/sources.list.d/adoptium.list
-```
-
-Update cache, install the desired temurin version and configure java to be linked to this same version:
-```
-sudo apt update -y
-sudo apt-get install -y temurin-22-jdk=22.0.2+9
-sudo update-alternatives --config java
+On Linux, extract the tarball and set `JAVA_HOME` to use it for the build:
+```shell
+tar -xzf OpenJDK25U-jdk_x64_linux_hotspot_25.0.2_10.tar.gz
+export JAVA_HOME=$PWD/jdk-25.0.2+10
+export PATH=$JAVA_HOME/bin:$PATH
```
-#### Java from SDK
+#### Java from SDKMAN
-A alternative option for all platforms is to use the [sdkman.io](https://sdkman.io/) package manager ([Git Bash for Windows](https://git-scm.com/download/win) is a good choice on that platform).
+An alternative option for all platforms is to use the [sdkman.io](https://sdkman.io/) package manager ([Git Bash for Windows](https://git-scm.com/download/win) is a good choice on that platform).
See the installation [instructions here](https://sdkman.io/install).
Once installed, run
```shell
-sdk install java 22.0.2-tem
+sdk install java 25.0.2-tem
```
### Other requirements
@@ -83,7 +56,7 @@ sudo apt install -y rpm fakeroot binutils
First, assign a temporary variable in your shell for the specific release you want to build. For the current one specify:
```shell
-GIT_TAG="2.3.1"
+GIT_TAG="2.4.0"
```
The project can then be initially cloned as follows:
@@ -101,7 +74,7 @@ git checkout "${GIT_TAG}"
```
Note - there is an additional step if you updated rather than initially cloned your repo at `GIT_TAG`.
-This is due to the [drongo submodule](https://github.com/sparrowwallet/drongo/tree/master) which needs to be checked out to the commit state it had at the time of the release.
+This is due to the Git submodules which need to be checked out to the commit state they had at the time of the release.
Only then your build will be comparable to the provided one in the release section of Github.
To checkout the submodule to the correct commit for `GIT_TAG`, additionally run:
diff --git a/src/main/deploy/package/macos/Info.plist b/src/main/deploy/package/macos/Info.plist
index 8978516..dbde6a0 100644
--- a/src/main/deploy/package/macos/Info.plist
+++ b/src/main/deploy/package/macos/Info.plist
@@ -21,7 +21,7 @@
<key>CFBundlePackageType</key>
<string>APPL</string>
<key>CFBundleShortVersionString</key>
- <string>2.4.0</string>
+ <string>2.4.1</string>
<key>CFBundleSignature</key>
<string>????</string>
<!-- See https://developer.apple.com/app-store/categories/ for list of AppStore categories -->
diff --git a/src/main/java/com/sparrowwallet/sparrow/SparrowWallet.java b/src/main/java/com/sparrowwallet/sparrow/SparrowWallet.java
index a1c866a..bbc98f5 100644
--- a/src/main/java/com/sparrowwallet/sparrow/SparrowWallet.java
+++ b/src/main/java/com/sparrowwallet/sparrow/SparrowWallet.java
@@ -18,7 +18,7 @@ import java.util.*;
public class SparrowWallet {
public static final String APP_ID = "sparrow";
public static final String APP_NAME = "Sparrow";
- public static final String APP_VERSION = "2.4.0";
+ public static final String APP_VERSION = "2.4.1";
public static final String APP_VERSION_SUFFIX = "";
public static final String APP_HOME_PROPERTY = "sparrow.home";
public static final String NETWORK_ENV_PROPERTY = "SPARROW_NETWORK";
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.