4 ms·

Hi there, Signal Android dev here. We have reproducible build steps, so you actually can verify the code is the same :) https://github.com/signalapp/Signal-And

Hi there, Signal Android dev here. We have reproducible build steps, so you actually can verify the code is the same :) https://github.com/signalapp/Signal-Android/tree/master/reproducible-builds https://github.com/signalapp/Signal-Android/tree/master/repr...

vaduz 6y ago
Reproducible builds do not help to determine if the version you download via the Play Store (or, for those on enterprise devices, any pre-installed corporate stores) is the same as you build - Play Store presents no real means to verify that. This includes any auto-updates if they are enabled. It's an issue with Play Store as a delivery channel, the individual app in question can't do much about that. Reproducible builds help if you: - download the APK separately (includng from the Signal website, or some of the other sources) - install the file locally via sideload - disable updates (!)
- tprynn 6y ago
  The instructions posted by the dev directly include instructions for pulling the APK from your phone which was installed through the Play Store. https://github.com/signalapp/Signal-Android/tree/master/reproducible-builds#getting-the-google-play-store-version-of-signal-apk https://github.com/signalapp/Signal-Android/tree/master/repr...