Reproducible builds #9

New Issue

2026-09-01T23:49:25Z

paulhitt commented

2026-09-01 23:49:25 +00:00

(Migrated from gitlab.com)

Anyone can compare the published APK against a build from source, and confirm the binary matches the code they read. For a privacy product this converts "trust us" into "check it" — and F-Droid, already in the picture, expects it.

Trade: real work to make the toolchain deterministic, and it constrains how the build can change afterwards.

⚠️ Idea, not a commitment. Second pass, filed 2026-09-01 during the code freeze — design and cost it, do not build it yet.

Anyone can compare the published APK against a build from source, and confirm the binary matches the code they read. For a privacy product this converts "trust us" into "check it" — and F-Droid, already in the picture, expects it. **Trade:** real work to make the toolchain deterministic, and it constrains how the build can change afterwards. --- ⚠️ Idea, not a commitment. Second pass, filed 2026-09-01 during the code freeze — design and cost it, do not build it yet.

paulhitt commented

2026-09-04 21:27:16 +00:00

(Migrated from gitlab.com)

Closed: APK contents were proven reproducible — clean builds differ only in the randomized signing block, checked by scripts/verify-build.py.

Closed: APK contents were proven reproducible — clean builds differ only in the randomized signing block, checked by `scripts/verify-build.py`.

paulhitt (Migrated from gitlab.com) closed this issue

2026-09-04 21:27:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-messenger-android#9