-
Notifications
You must be signed in to change notification settings - Fork 3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
PlayStore app is not verifiable. reproducible/deterministic build for Android #5839
Comments
Yes, indeed, reproducible builds would be highly desired for all platforms. Unfortunately, I expect it would be difficult to accomplish with the toolchain we use. (python-for-android / buildozer) Like it says in the relevant README, help would be welcome, as we are already stretched thin as-is. |
A good start would be to make it build without release key at all. For my project I allow certain diffs. If file timestamps differ, it's ok and probably will stay ok forever. If PNGs remain being PNGs with same size but some bits flipped, that's ok. If I can read the diff to not be an exploit, it's kind of ok for now. The above criteria are the basic requirements for team members to approve an APK. If the wallet does not comply with those, I have to assume that a gun to the release manager's head might be worth millions of dollars and that is not ok. |
How is progress on this? 3.5 months passed ... |
Unless someone steps up to work on this, it will not happen in the near term. We know that reproducibility is very important. It is. However, resources are limited, and for keeping the project alive long term, Lightning is even more important. |
Lightning works now I heard? |
promising developments on the kivy side: kivy/python-for-android#2390 |
Now with #7263 merged, the next release (4.1.3) should be reproducible. EDIT: I'll try to remember to add another comment here when that is released. |
4.1.3 is out and ThomasV and I have managed to build "matching" binaries (according to |
Thanks guys! Can confirm that 4.1.4 is reproducible and updated the listing accordingly. I mentioned some details but overall it's usable as is. |
At the time of writing this article we were not able to verify the build on GooglePlay to match the published code.
I know there is no claim otherwise but this is a huge security issue and should be given priority as it also means that even the other team members cannot verify what the release manager is doing and he might be in distress ...
The text was updated successfully, but these errors were encountered: