Reproducible and Verifiable client builds
#1084 aperta il 20 apr 2020
Metriche repository
- Star
- (2118 stelle)
- Metriche merge PR
- (Nessuna PR mergiata in 30 g)
Descrizione
Expert users should be able to verify that the installed client on iOS and Android matches the tagged version in the open source repo. This allows anyone to audit the app and verify that there has been no MITM attacks to modify the binary before it is published. The benefit is increased transparency and trust in our build system. It also has additional benefits with increasing automation, ensuring all dependencies are pinned and making the build reproducible.
Telegram approach to reproducible builds: https://core.telegram.org/reproducible-builds
Philosophical buy-in to the approach and examples of mitigated attacks: https://reproducible-builds.org/docs/buy-in/
Please follow this checklist. Please check each appropriate box (put an 'x' or check it after creating the issue).
- Searched the existing issues to ensure you are not creating a duplicate.
- Followed the Contributor Guidelines.
- Issue has descriptive title focused on the feature or problem from the user's perspective