lib/external_api_keys.dart not in repo — potential blocker for reproducibility verification #1392

We are attempting to independently verify that Stack Wallet v2.4.4 (versionCode 301, tag build_301)
is reproducible for WalletScrutiny.com.

Based on our analysis of the build process: the CI decodes exchange API keys from a GitHub Actions
secret (CHANGE_NOW) into lib/external_api_keys.dart, which is then compiled into libapp.so. This
file is not committed to the repo and is gitignored. The prebuild.sh script generates an empty
template for local builds.

We performed binary analysis on the official Play Store APK and recovered some candidate values
from the binary, but could not reliably reconstruct all keys or confirm their assignments to the
correct variables.

Could you either:

1. Commit lib/external_api_keys.dart (or a reproducibility-specific version of it) to the repo at
   the relevant release tag, or
2. Publish the exact file contents used for v2.4.4 alongside the release on GitHub

This would allow us to complete the independent build verification.

Thanks,

Danny