Switch to semantic resources.arsc comparison in apkdiff reproducible script

[BarbossHack]

Contributor checklist

• I am following the Code Style Guidelines
• I have tested my contribution on these devices:

• Fedora 44
• Ubuntu 24.04

• My contribution is fully baked and ready to be merged as is
• I ensure that all the open issues my contribution fixes are mentioned in the commit message of my first commit using the Fixes #1234 syntax

---

Description

Context

Currently, apkdiff relies on a binary-level comparison of the resources.arsc file using Androguard. While this worked historically, it has become increasingly brittle. The Google Play Store's post-processing may modifies the internal structure of the resource table (reordering string pools, modifying header sizes, and shifting data offsets) without changing the actual resource content.

Problem

These structural optimizations trigger massive, "false positive" diffs in apkdiff. We are currently seeing errors like ARSCResTypeSpec/ARSCResTableEntry/ARSCHeader inconsistencies (see #14809), which are artifacts of binary repackaging rather than actual application discrepancies. Attempting to filter these individual binary fields using Androguard is unsustainable.

Also, currently apkdiff has 2 flaws in its resources.arsc comparison:

• It always returns True even when there are differences:

  Signal-Android/reproducible-builds/apkdiff/apkdiff.py

  Line 300 in 4f0f093

  return True

• It does not check the actual values of ARSCResTableEntry objects, it only compares the string representation of the entry metadata

  Signal-Android/reproducible-builds/apkdiff/apkdiff.py

  Line 267 in 4f0f093

  if pkg1.__repr__() != pkg2.__repr__():

Solution

Instead of comparing the binary structure, this PR proposes moving to a semantic comparison using aapt2 dump resources. By using aapt2 (the official Android build tool), we verify the resolved values of the resources. This method is completely immune to the structural optimizations performed by the Play Store, as aapt2 parses the logical content rather than the raw file layout.

We are still verifying content integrity. If a malicious actor modified a string in the resource table, aapt2 dump would catch it. The only thing we are ignoring is the 'the storage layout'.

Note that androguard is still needed to parse other binary XML files. I've updated it to v4.1.4 as explained here #14817 (comment)