Reproducible and Verifiable client builds
#1.084 aberto em 20 de abr. de 2020
Métricas do repositório
- Stars
- (2.118 estrelas)
- Métricas de merge de PR
- (Nenhuma PRs mesclada em 30d)
Description
Expert users should be able to verify that the installed client on iOS and Android matches the tagged version in the open source repo. This allows anyone to audit the app and verify that there has been no MITM attacks to modify the binary before it is published. The benefit is increased transparency and trust in our build system. It also has additional benefits with increasing automation, ensuring all dependencies are pinned and making the build reproducible.
Telegram approach to reproducible builds: https://core.telegram.org/reproducible-builds
Philosophical buy-in to the approach and examples of mitigated attacks: https://reproducible-builds.org/docs/buy-in/
Please follow this checklist. Please check each appropriate box (put an 'x' or check it after creating the issue).
- Searched the existing issues to ensure you are not creating a duplicate.
- Followed the Contributor Guidelines.
- Issue has descriptive title focused on the feature or problem from the user's perspective