C-toxcore: Reproducible Builds // OBS a bad Idea

[HulaHoopWhonix]

Hello. Whonix (whonix.org) developer here. We are an anonymity distro that some of you are familiar with. We have a vested interest in seeing Tox succeed as a secure/private communication alternative to the status quo.

IMHO moving the project binary builds to an online build server is a bad move especially in absence of a reproducible build system. You cannot rely on a cloud server to not work against your interests and that of your users. The Certificate Authority/HTTPS is badly broken system and not a guarantee against nation states trying to poison binaries.

I think that at the very least you should run your own build infrastructure until repro builds are realized so you can verify no one messed with binaries you distribute.

cc/ @adrelanos

[nurupo]

Tox builds run on our own build infrastructure at https://build.tox.chat/ and we have a package repo at https://pkg.tox.chat/ . It's the qTox project that has moved from using build.tox.chat to using OBS.

Also, currently there are no builds set up for toktok/toxcore, only for irungnetoo/toxcore.

[iphydf]

Reproducible builds is something we definitely want. I just started a new repository that will use submodules to import specific versions of:

• toxcore
• hstox
• apidsl
• qTox
• some libraries that are currently git-cloned as part of the build, such as libsodium and opus

and will perform a build (no tests) of the complete stack. This repository will contain checksums of each binary for each platform and verify them as part of the build. We will regularly update this snapshot and users should be able to easily (with a simple "make" invocation) reproduce the results.

Any help in this matter would be greatly appreciated.