Hacker News Reader

Comment by dingo_bat | Hacker News Reader

Is it possible to compile Signal from source and run it on Android yet? If not, Moxie needs a bit of "logic" for himself.

View on HN

I wish there was a way to do signed, git-verified builds for phone apps. Right now even if a project is opensource there's no way to tell that the version I have on my phone actually matches the source code I read in github.

I'm imagining a process where you point Apple or Google to your project's source tree. They download it and do the actual build process, and then the git SHA of the codebase they compiled gets signed and embedded in the build artifact. As a result, I could go into my phone and see the SHA of the code thats actually running, to make sure the developer of an opensource app hasn't quietly bundled in any changes that don't appear in the source tree.

Of course, this is still vulnerable to tampering from Apple or Google, but they have that capability anyway.

We are getting to reproducible builds.

https://reproducible-builds.org/

https://wiki.debian.org/ReproducibleBuilds

F-Droid has done a lot of work towards reproducible builds.

https://f-droid.org/wiki/page/Deterministic,_Reproducible_Bu...

Yes.

https://github.com/WhisperSystems/Signal-Android/blob/master...

I've been compiling and running Signal on Android for years. Every week I check the git repository for new tags, check them out, recompile a new signed build, then update my phone.

Care to share how you do this? Last time I tried, my self compiled Signal wouldn't work with Signal's servers. I just assumed I needed some sort of key. Perhaps my problem was something else?

A self built Signal would go a long way to be usable for me. One that didn't depend on Google Services would be even better.

Sure. You should just open the project in Android Studio and it will download all the dependencies it needs. After that it's more fun to compile from the command line, you just need to create a key and then make sure local.properties and signing.properties are filled in correctly[0] and then run `./gradlew aR` to build a signed release build with your own key.

[0] https://gist.github.com/alanorth/a755abbe21f5fdde2281771edae...

Pre-empting related FUD: Signal has dropped the hard dependency on Google Play Services. https://news.ycombinator.com/item?id=13691050

Wow. Finally...

I wonder when we are going to see it on f-droid.

When hell freezes over probably. See:

https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

Wait, why can't F-Droid ship normal Signal instead of LibreSignal?

Because signal don't want to distribute their app on fdroid.

Doesn't OWS distribute free-software-licensed APKs? Does F-Droid have a policy of not accepting things that aren't uploaded by the original authors, or something?

How useful is this attitude really? I understand the underlying aspiration of creating a 'known' ecosystem, but passive-aggressive callouts like this doesn't do anyone any good. Signal has done us a lot of good, let's keep that at the front of mind instead of trying to impart weird statements like this. Kinda sick of this internet logic.

Reply on news.ycombinator.com