Thank you and good luck for release day!

[MikeJayDee]

First, good luck for release day (which I understand is tomorrow)!

Secondly, thank you for all the hard work to everyone involved and for delivering on-time under a lot of pressure and under the watchful eye of the public.

Finally, against all pessimistic expectation, I wanted to thank you that this project is being developed in an absolutely exemplary and transparent manner. It is not only open source in name but also in spirit; I have never seen this before for a large publicly funded software project developed by a private corporation (at least in Germany).

So, again, thank you (and apologies for misusing an issue for this).

[SebastianWolf-SAP]

Thank you very much for your kind words, really appreciated! And no problem with (mis)using an issue, we can even keep it open for a while... ;)

Let's keep our fingers crossed that it works out more or less as planned...

Mit freundlichen Grüßen/Best regards,
SW
Corona Warn-App Open Source Team

[NilsAhrDE]

When will the Download-Links be available today?

Thank you for your great work and happy release day!
Nils

[jonasohland]

I just installed the app from the Google Play Store. Looks like i am one of the first 10 users!
Thanks to everyone from the Corona Warn-App Open Source Team and all the contributors.
Happy tracing!

[daimpi]

Yes I also got it!
Thanks to everyone who is helping making this a success ☺️

Btw: here is the link to the landing page: https://www.corona-warn-app.de

[jakob11git]

Unfortunately only available in the German Apple App Store. Impossible to install without a German Apple ID.

[corneliusroemer]

@jeifour Open a separate issue in the iOS app repo? For Android it might be possible to sideload in this case. Not sure whether there's a workaround for iOS

[lennarto]

@jeifour On your iPhone you are able to use more than one Apple ID per Device - Therefore I have a US-Apple ID as well as a german Apple ID to download specific apps.

[sventuerpe]

Judging by the media echo the release seems to have gone well. Congratulations to everyone!

Like @MikeJayDee I am thoroughly impressed by the professionalism seen in this project, the constructive discussions around here, and timely delivery of the app. I would love to see more projects like* this in the future. Great job!

*) perhaps with a looser schedule and more flexible requirements

[KaiRoesner]

@sventuerpe , maybe the tight schedule and requirements were the reason why this went so well... ;-)

[sventuerpe]

@KaiRoesner A clearly defined mission and scope certainly helps and a short project can work at a speed that would be infeasible to sustain over a longer period.

[corneliusroemer]

While it is certainly laudable, that the release went more or less well, it's important to remember that there are important issues that remain to be resolved:

• App not in non-German app stores App unavailable on non-German Play Store cwa-app-android#478
• Wrong status when location/internet disabled https://github.com/corona-warn-app/cwa-app-android/issues/491 https://github.com/corona-warn-app/cwa-documentation/issues/262
• Apple App store ages is set to 17+ preventing certain 16y olds from downloading without good justification for why the age can't be 12+ https://github.com/corona-warn-app/cwa-documentation/issues/262
• Build pushed cannot be confirmed to be authentic since reproducible build not provided, the APKs are also not published on Github https://github.com/corona-warn-app/cwa-documentation/issues/14 https://github.com/corona-warn-app/cwa-app-android/issues/514
• Very important: Potentially unnecessary notification delays of 24-48hr #236

[Giszmo]

* Build pushed cannot be confirmed to be authentic since reproducible build not provided, the APKs are also not published on Github #14 [corona-warn-app/cwa-app-android#514](https://github.com/corona-warn-app/cwa-app-android/issues/514)

Providing an alternative download on GitHub would not help as you want to know they roll out via Google what they show you and as they could in theory roll out a different version by country (not in this case as Google only allows one Corona app per country), by Phone model and even by user ID, you really want to collect the binaries where they end up, on the users' phones. If there is interest, I would extend this app to also monitor the corona app. Some 20 people using it would be awesome. No need for thousands or millions to run it. As I'm in Chile myself, I would have real difficulties to get the app by other means at all.

Regarding the reproducibility ... did you try to compile it? If the devs did everything right, it might "just work". The people at Google usually care a lot if some build tool or library doesn't produce deterministic results.

[corneliusroemer]

@Giszmo Unfortunately the things you suggest don't work due to special whitelisting being necessary for a compiled app to be allowed to use the Exposure API #214

Published official apks would avoid people having to trust others, they just need to trust the developers, not Google nor mirror servers. Furthermore, Play Store APKs could be verified with checksums.

The app is currently rolled out as one apk containing all the various processor architecture apks, this is a reason for the large size of the app.

[Giszmo]

@Giszmo Unfortunately the things you suggest don't work due to special whitelisting being necessary for a compiled app to be allowed to use the Exposure API #214

Reproducibility and testability are two different things. To test the reproducibility I don't need access to the exposure API.

Published official apks would avoid people having to trust others, they just need to trust the developers, not Google nor mirror servers. Furthermore, Play Store APKs could be verified with checksums.

What do you think a checksum would provide? Compute the checksum. My project does that for many apps with every update they release.

The app is currently rolled out as one apk containing all the various processor architecture apks, this is a reason for the large size of the app.

So? Reproducibility doesn't care about what you pack into your apk. In fact it's easier to reproduce one app than to reproduce 5 flavors of the same app.

Furthermore while it would be great if the app could be used from a binary compiled by any third party, reproducibility would actually mean that you could test the app from what you compiled:

1. Take the original app
2. Take the source code
3. Compile the source code
4. Add the signature from the original app to your result.
5. If the app is reproducible, the signature will match and you can actually test it too. If not, then it's neither reproducible nor testable.

[corneliusroemer]

@Giszmo May I suggest this discussion be moved to a more appropriate issue? Why don't you create one suggesting an implementation of your proposal?

[tkowark]

Thank you very much again for all your support, questions, and also criticism throughout the last weeks!