3 ms·
How do you prove that the Signal app you download from the Play Store is compiled from the source code on GitHub?
by Kwpolska 1y ago
How do you prove that the Signal app you download from the Play Store is compiled from the source code on GitHub?
- tcfhgj 1y agoidk, diff the binaries?
- maqp 1y agopull the apk from your phone with apktool. Compile Signal reproducibly with their instructions. Use the diff.py tool they provide and check for the message that confirms the APKs match.
- selfhoster11 1y agoIf I care about binary integrity, I wouldn't involve an app store. https://signal.org/android/apk/ https://signal.org/android/apk/ is a perfectly cromulent way to get your hands on the APK file directly from the source.
- JetSpiegel 1y agoHow do you keep that updated? What if there is a security issue?
- 31337Logic 1y agoCompile it yourself and compare the hash.