Ask HN: How to verify binary came from this exact source code?
I want to make an app and put the source on GitHub so everybody can verify it.
How can I ensure that the corresponding binary really belonged to a specific GIT commit? Is this possible?
I know for example that Google Go has reproducible builds and I would get the same hash out of the binary. But I would have to attach this hash to the binary so I could have a “print version” dialogue. And this attachment would mess up the previous binary.
Google Go was an example. I am talking about an Android, iOS app.