Reproducible and Verifiable client builds
#1 084 ouverte le 20 avr. 2020
Métriques du dépôt
- Stars
- (2 118 étoiles)
- Métriques de merge PR
- (Aucune PR mergée en 30 j)
Description
Expert users should be able to verify that the installed client on iOS and Android matches the tagged version in the open source repo. This allows anyone to audit the app and verify that there has been no MITM attacks to modify the binary before it is published. The benefit is increased transparency and trust in our build system. It also has additional benefits with increasing automation, ensuring all dependencies are pinned and making the build reproducible.
Telegram approach to reproducible builds: https://core.telegram.org/reproducible-builds
Philosophical buy-in to the approach and examples of mitigated attacks: https://reproducible-builds.org/docs/buy-in/
Please follow this checklist. Please check each appropriate box (put an 'x' or check it after creating the issue).
- Searched the existing issues to ensure you are not creating a duplicate.
- Followed the Contributor Guidelines.
- Issue has descriptive title focused on the feature or problem from the user's perspective