4 ms·
> For the verification, you now depend on a complex binary blob provided by the authors, that is distributed through a different channel (Docker images instead
by haffenloher 11y ago
> For the verification, you now depend on a complex binary blob provided by the authors, that is distributed through a different channel (Docker images instead of Google Play).
Nothing stops you from building the Docker image yourself using the Dockerfile provided in the repo.
https://github.com/WhisperSystems/Signal-Android/blob/master/Dockerfile https://github.com/WhisperSystems/Signal-Android/blob/master...
- davexunit 11y agoBut those Docker images are not reproducible. They don't build everything from source from a trusted, well-known set of bootstrap binaries, nor will they produce bit-identical binaries. Docker does absolutely nothing to aid in the task of reproducible builds. See https://reproducible-builds.org https://reproducible-builds.org for more information about initiatives that are helping. Using something like GNU Guix instead of Docker, one could make good progress towards a reproducible Android tool chain that produces bit-identical APKs. Reproducibility is an ongoing problem, but Guix has been carefully designed to maximize reproducibility and to help identify what isn't reproducible.