1

'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it.

But numerous sources1,2 indicate reproducible builds are very difficult (or even impossible) to implement in practice on major app stores.

Some reasons listed include:

  • app store processes and idiosyncrasies that alter source code
  • complexities in software versions and compilers
  • app thinning
  • any random generators in the build process

And:

Usually, different compilations of the same code will not result in the same binary, even when using the same version of libraries, compiler, target, etc.

Given the concept of a 'reproducible build' is quite new, (its wiki page is less than 5 years old), and that methods may improve in coming years, is it reasonable to expect reproducible builds for entire apps in practice (i.e. on major app stores), or do insurmountable factors limit reproducible builds to being theoretically possible (and possible for a small subset of apps), but practically difficult if not impossible for most apps?


1 https://news.ycombinator.com/item?id=23396499

2 https://web.archive.org/web/20200527063225if_/https://github.com/immuni-app/immuni-documentation/blob/master/Technology%20Description.md#reproducible-builds

2

The answer is no, and that's because most major app stores require signing and generally the signature process used includes a timestamp. Timestamps are inherently non-reproducible. This is the case for both phone app stores and computer app stores.

If you wanted to ignore signatures, it probably is possible. Debian does it, and many pieces of software used during builds are probably already patched upstream by now. It may require a post-processing step for certain files, though, which most developers will not implement. So it is not reasonable to expect that anyone but the most security-conscious developers will implement it. For example, Signal does it for Android, but most developers do not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.