Google login does not work on release/ci builds

[antonis]

Expected behavior

The user is able to login with Google social login.

Actual behavior

The user is not able to login with Google social login and an error WordPress-NUX: Google Login Failed: result was CANCELED is emmited.

Steps to reproduce the behavior

1. Open a CI build (e.g. this one) the Jetpack or Wordpress app
2. Select Log in or sign up with WordPress.com
3. Press Continue with Google at the bottom
4. Select an account (non-A8C)
5. Notice that the login fails

device-2022-09-08-100727.mp4

Notes:

• I can replicate the issue on both the WP and JP apps and on CI builds.
• I haven’t been able to replicate on debug mode.
• I verified that the issue is not reproduced on 2.6.1 Jetpack release
• Maybe this relates to related with the latest login library update.

Tested on Pixel 5, Android 13, WPAndroid 20.7

[mkevins]

I reproduced this as well with the linked APK (CI build). Investigating a bit, I discovered an area of the code where we are using deprecated API. I didn't see anything in the recent changes that looked suspicious (though I'm not very familiar with this part of the code 🤔). I did find an article about the deprecation which mentions issues with thread-safety, so am wondering whether there could be a difficult to track down issue related with that.

One thing I observed in the logs (though I haven't yet checked whether this is present in the unbroken flow), is the presence of a java.util.concurrent.ExecutionException:

BasePeopleOperation     com.google.android.gms               E  Failed to load OwnerAvatar from MDI with cause: %s
                                                                                                    java.util.concurrent.ExecutionException: btie
                                                                                                    	at clmx.s(:com.google.android.gms@222615044@22.26.15 (190400-461192076):3)
                                                                                                    	at clmx.get(:com.google.android.gms@222615044@22.26.15 (190400-461192076):9)
                                                                                                    	at bain.e(:com.google.android.gms@222615044@22.26.15 (190400-461192076):7)
                                                                                                    	at baii.b(:com.google.android.gms@222615044@22.26.15 (190400-461192076):1)
                                                                                                    	at baig.d(:com.google.android.gms@222615044@22.26.15 (190400-461192076):3)
                                                                                                    	at bbcm.f(:com.google.android.gms@222615044@22.26.15 (190400-461192076):1)
                                                                                                    	at antj.en(:com.google.android.gms@222615044@22.26.15 (190400-461192076):1)
                                                                                                    	at ahjx.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):12)
                                                                                                    	at cfvf.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):2)
                                                                                                    	at xot.c(:com.google.android.gms@222615044@22.26.15 (190400-461192076):6)
                                                                                                    	at xot.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):7)
                                                                                                    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
                                                                                                    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
                                                                                                    	at xty.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):0)
                                                                                                    	at java.lang.Thread.run(Thread.java:920)
                                                                                                    Caused by: btie
                                                                                                    	at btiq.a(:com.google.android.gms@222615044@22.26.15 (190400-461192076):2)
                                                                                                    	at cfvk.a(:com.google.android.gms@222615044@22.26.15 (190400-461192076):2)
                                                                                                    	at clmz.c(:com.google.android.gms@222615044@22.26.15 (190400-461192076):2)
                                                                                                    	at clnb.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):9)
                                                                                                    	at clol.execute(:com.google.android.gms@222615044@22.26.15 (190400-461192076):0)
                                                                                                    	at clmx.q(:com.google.android.gms@222615044@22.26.15 (190400-461192076):1)
                                                                                                    	at clmx.j(:com.google.android.gms@222615044@22.26.15 (190400-461192076):8)
                                                                                                    	at clmx.m(:com.google.android.gms@222615044@22.26.15 (190400-461192076):0)
                                                                                                    	at clmh.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):9)
                                                                                                    	at clol.execute(:com.google.android.gms@222615044@22.26.15 (190400-461192076):0)
                                                                                                    	at clmx.q(:com.google.android.gms@222615044@22.26.15 (190400-461192076):1)
                                                                                                    	at clmx.j(:com.google.android.gms@222615044@22.26.15 (190400-461192076):8)
                                                                                                    	at clmx.m(:com.google.android.gms@222615044@22.26.15 (190400-461192076):0)
                                                                                                    	at clna.e(:com.google.android.gms@222615044@22.26.15 (190400-461192076):0)
                                                                                                    	at clnb.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):13)
                                                                                                    	at clol.execute(:com.google.android.gms@222615044@22.26.15 (190400-461192076):0)
                                                                                                    	at clmx.q(:com.google.android.gms@222615044@22.26.15 (190400-461192076):1)
                                                                                                    	at clmx.j(:com.google.android.gms@222615044@22.26.15 (190400-461192076):8)
                                                                                                    	at clmx.p(:com.google.android.gms@222615044@22.26.15 (190400-461192076):2)
                                                                                                    	at clqr.e(:com.google.android.gms@222615044@22.26.15 (190400-461192076):2)
                                                                                                    	at clps.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):6)
                                                                                                    	at clqt.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):0)
                                                                                                    	at xot.c(:com.google.android.gms@222615044@22.26.15 (190400-461192076):6) 
                                                                                                    	at xot.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):7) 
                                                                                                    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167) 
                                                                                                    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) 
                                                                                                    	at xty.run(:com.google.android.gms@222615044@22.26.15 (190400-461192076):0) 
                                                                                                    	at java.lang.Thread.run(Thread.java:920) 

I found some discussion about same or similar errors in this SO question, which mentions in particular solutions that the SHA1 fingerprint needs to be updated / added in some cases. I haven't gotten any further than this today, but it could be worth checking whether any of the solutions mentioned there would be relevant for us, especially with ongoing / recent work with our app release process.

[mkevins]

In the latest release candidates for WordPress and Jetpack apps, this issue seems to be resolved.

I'm not certain about this, but I wonder whether this issue may have been due to the version code being intermittently held back 🤔 ? Afaik, there could be some caching based on this value, and there's a possibility that some parts of this flow were affected by stale parts in the authentication or Login API mechanisms

[AliSoftware]

Note that Installable Builds are not signed by Google (since we don't have the .jks signing key to self-sign those, especially for Jetpack for which, when we configured the new app in Play Store console back in the day, we chose Play App Signing, which means Google are the ones having the signing key on their servers and we don't have it to self-sign those Jetpack builds ourselves)

So for example for the WordPress and Jetpack Installable Builds of the PR that @antonis linked above (which are APKs generated by our commands and our own call of bundletool on CI), those are their signatures:

✓ $ $ANDROID_SDK_ROOT/build-tools/33.0.0/apksigner verify --print-certs ~/Downloads/wordpress-installable-build-pr17145-afb680b.apk 
~/Downloads/wordpress-installable-build-pr17145-afb680b.apk 
Signer #1 certificate DN: C=US, O=Android, CN=Android Debug
Signer #1 certificate SHA-256 digest: 60fca11c59c6933610146f40a1296250abff640dc5da2b85fc8e5aa411dd17d6
Signer #1 certificate SHA-1 digest: a9c6cab16ef738016fdbfa489b80daf0dec2caf0
Signer #1 certificate MD5 digest: 1020a7a9a15b728ca787607111726a34

✓ $ $ANDROID_SDK_ROOT/build-tools/33.0.0/apksigner verify --print-certs ~/Downloads/jetpack-installable-build-pr17145-afb680b.apk 
~/Downloads/jetpack-installable-build-pr17145-afb680b.apk 
Signer #1 certificate DN: C=US, O=Android, CN=Android Debug
Signer #1 certificate SHA-256 digest: 60fca11c59c6933610146f40a1296250abff640dc5da2b85fc8e5aa411dd17d6
Signer #1 certificate SHA-1 digest: a9c6cab16ef738016fdbfa489b80daf0dec2caf0
Signer #1 certificate MD5 digest: 1020a7a9a15b728ca787607111726a34

Those are different signatures than the ones used by the "Universal, Signed APK" that I download from the Play Store — which are APKs that Google generates and signs for us after I uploaded a new .aab — to attach them to the GitHub Releases. For example, for the latest 20.7-rc-3 that @mkevins linked to above, those are their code signatures:

✓ $ $ANDROID_SDK_ROOT/build-tools/33.0.0/apksigner verify --print-certs ~/Downloads/wpandroid-20.7-rc-3-Signed.apk                 
~/Downloads/wpandroid-20.7-rc-3-Signed.apk 
Signer #1 certificate DN: O=Automattic Inc, L=Redwood City, ST=California
Signer #1 certificate SHA-256 digest: b026087f08da58ef18573241cc81107aa2aa9783a38051f6d6f0eb01544e146e
Signer #1 certificate SHA-1 digest: f677f8d7e4571946ccf65e0e80e22cb140d1db3b
Signer #1 certificate MD5 digest: a792e6e58914f9e1ee0903413732a146
Source Stamp Signer certificate DN: CN=Android, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
Source Stamp Signer certificate SHA-256 digest: 3257d599a49d2c961a471ca9843f59d341a405884583fc087df4237b733bbd6d
Source Stamp Signer certificate SHA-1 digest: b1af3a0bf998aeede1a8716a539e5a59da1d86d6
Source Stamp Signer certificate MD5 digest: 577b8a9fbc7e308321aec6411169d2fb

✓ $ $ANDROID_SDK_ROOT/build-tools/33.0.0/apksigner verify --print-certs ~/Downloads/jpandroid-20.7-rc-3-Signed.apk

Signer #1 certificate DN: CN=Android, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
Signer #1 certificate SHA-256 digest: f2d7acc12614750009514a0932bf0b0aa9c11829a66e862ce4572bced344e76e
Signer #1 certificate SHA-1 digest: 052923e8fab332280aaf85a43d6cd88187b20ad4
Signer #1 certificate MD5 digest: 8885b6df417f76b12c4ce4940057f3da
Source Stamp Signer certificate DN: CN=Android, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
Source Stamp Signer certificate SHA-256 digest: 3257d599a49d2c961a471ca9843f59d341a405884583fc087df4237b733bbd6d
Source Stamp Signer certificate SHA-1 digest: b1af3a0bf998aeede1a8716a539e5a59da1d86d6
Source Stamp Signer certificate MD5 digest: 577b8a9fbc7e308321aec6411169d2fb

I'm not 100% that the fact that those are signed differently is the actual cause of you being unable to sign in with Google on Installable Builds, but that at least might be a lead? (and in this case, Google Login were probably never possible with Installable Builds, I guess)

[antonis]

As identified this is not an actual bug but more of a CI configuration issue that does not affect our users. I'm lowering the issue priority to avoid confusion.
@AliSoftware If you agree we can even close this and continue the discussion internally (ref hpdnsEh-BN-p2).

[AliSoftware]

I just tested the release build for 20.7 that I'm about to ship to Google for review (and whose APK is available on the GitHub Release draft for 20.7) and was able to log in. So I'm closing this issue (and we can continue the discussion internally to consider fixing this for Installable Builds)