Electrum: PlayStore app is not verifiable. reproducible/deterministic build for Android
At the time of writing this article we were not able to verify the build on GooglePlay to match the published code.
I know there is no claim otherwise but this is a huge security issue and should be given priority as it also means that even the other team members cannot verify what the release manager is doing and he might be in distress ...
Giszmo
All 5 comments
Yes, indeed, reproducible builds would be highly desired for all platforms.
Unfortunately, I expect it would be difficult to accomplish with the toolchain we use. (python-for-android / buildozer)
I guess a good first step would be to try to find another project that uses the same toolchain and has succeeded in reproducibility. I don't know of any... :/
Like it says in the relevant README, help would be welcome, as we are already stretched thin as-is.
SomberNight
on 14 Dec 2019
A good start would be to make it build without release key at all. For my project I allow certain diffs. If file timestamps differ, it's ok and probably will stay ok forever. If PNGs remain being PNGs with same size but some bits flipped, that's ok. If I can read the diff to not be an exploit, it's kind of ok for now.
The above criteria are the basic requirements for team members to approve an APK. If the wallet does not comply with those, I have to assume that a gun to the release manager's head might be worth millions of dollars and that is not ok.
Giszmo
on 16 Dec 2019
How is progress on this? 3.5 months passed ...
Giszmo
on 29 Mar 2020
Unless someone steps up to work on this, it will not happen in the near term.
The priority now is Lightning.
We know that reproducibility is very important. It is. However, resources are limited, and for keeping the project alive long term, Lightning is even more important.
SomberNight
on 29 Mar 2020
Lightning works now I heard?
Giszmo
on 1 Oct 2020
Related issues
dl3br
路
4Comments
reardenlife
路
4Comments
nolith
路
5Comments
karelbilek
路
4Comments
shawnpringle
路
3Comments
Most helpful comment
Unless someone steps up to work on this, it will not happen in the near term.
The priority now is Lightning.
We know that reproducibility is very important. It is. However, resources are limited, and for keeping the project alive long term, Lightning is even more important.