20 ms·
There are two trust problems that verifiable builds are supposed to solve: 1. Did the authors manipulate the source code compared to what they published? 2. D
by ge0rg 11y ago
There are two trust problems that verifiable builds are supposed to solve:
1. Did the authors manipulate the source code compared to what they published?
2. Did a third party manipulate the binaries on the distribution channel?
The process of verifying a build can be done through a Docker image containing an Android build environment that we've published.
For the verification, you now depend on a complex binary blob provided by the authors, that is distributed through a different channel (Docker images instead of Google Play).
This is a good solution to the second problem, but it does not preclude OWS insiders from injecting malicious code (they merely need to add the backdoor at the SDK level[0] and use that same SDK for the public releases). Such a manipulation could be performed by an evil insider, or be part of a "government cooperation". I am not saying that OWS is or will be doing this. This is merely an observation of the shortcomings of the overall solution.
[0] "Reflections on Trusting Trust" https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
- haffenloher 11y ago> For the verification, you now depend on a complex binary blob provided by the authors, that is distributed through a different channel (Docker images instead of Google Play). Nothing stops you from building the Docker image yourself using the Dockerfile provided in the repo. https://github.com/WhisperSystems/Signal-Android/blob/master/Dockerfile https://github.com/WhisperSystems/Signal-Android/blob/master...
- davexunit 11y agoBut those Docker images are not reproducible. They don't build everything from source from a trusted, well-known set of bootstrap binaries, nor will they produce bit-identical binaries. Docker does absolutely nothing to aid in the task of reproducible builds. See https://reproducible-builds.org https://reproducible-builds.org for more information about initiatives that are helping. Using something like GNU Guix instead of Docker, one could make good progress towards a reproducible Android tool chain that produces bit-identical APKs. Reproducibility is an ongoing problem, but Guix has been carefully designed to maximize reproducibility and to help identify what isn't reproducible.