Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deterministic builds #1

Open
Sjors opened this issue Jan 2, 2020 · 0 comments
Open

Deterministic builds #1

Sjors opened this issue Jan 2, 2020 · 0 comments

Comments

@Sjors
Copy link
Owner

Sjors commented Jan 2, 2020

I'd like to be able to prove that the TestFlight and App Store binaries are actually derived from this source code.

As a first step I've uploaded the binary to the release tag: https://github.com/Sjors/nthkey-ios/releases/tag/v0.0.1

I didn't check if that matches the binary that end users download from TestFlight, or whether Apple injects some signature magic.

Because the binary is signed by me, it's not possible for someone else to reproduce the exact same binary. However perhaps it's possible to generate a binary, strip the signature data and then perform the comparison.

The v0.0.1 release uses a temporary branch of upstream libwally-core and libwally-swift. These commits won't exist anymore after a while, at least Github won't serve them. This is a temporary issue; by the time this app is ready for the App Store I plan to use only tagged releases for dependencies; those should remain available on Github.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant