Hacker News new | ask | show | jobs
by leshow 3044 days ago
Theoretically, but when you throw in things like build systems often not being deterministic, minor versions of dependencies changing, different OS or slightly different OS version with different libraries; there's a multitude of places to throw the final binary off by a few bytes or more and end up with a different checksum.

Signal wants to distribute a binary with a checksum. Once the checksum is different all bets are off, that's why it's not in F-Droid
2 comments
Ao7bei3s 3044 days ago
As if reproducible builds hadn't been done before. If Debian can get to building 80% of their packages reproducibly[1], the communities around Android can get there too. Luckily, it's being worked on.[2]

Now the question is: (when) will this be supported by F-Droid?

[1] Scroll down for a big graph https://wiki.debian.org/ReproducibleBuilds

[2] https://github.com/signalapp/Signal-Android/wiki/Reproducibl...

link
kuschku 3044 days ago
F-Droid has supported reproducible builds for years: https://f-droid.org/en/docs/Reproducible_Builds/

The real question is, when will Signal finally support it?

link
Ao7bei3s 3041 days ago
Nice, thanks for pointing that out!
link
izacus 3044 days ago
So why don't they just also list checksum of the F-Droid binary?
link
JetSpiegel 3044 days ago
They don't trust F-Droid.
link
izacus 3044 days ago
Yeah, figured. They seem very inconsistent in applying their trust. At times they'll do strange things like build app on Chrome Apps platform / mandatory phone ID and on other times they'll make user-hostile decisions like hijacking SMS messages and refusing to publish to F-Droid due to "security".

The end result is an app that keeps shooting itself in the foot and being beaten by Messenger and WhatsApp.

link