I have forked a project’s source code on GitHub. The program takes a private key as an input and that key must never leave the client. If I want to share a pre-built executable as a release it is essential that I can prove beyond reasonable doubt that it is built from the published source....
I don’t know whether github actions output can be tampered with by you, but the only actually reliable way (that I know of) to prove that your binaries correspond to a certain state of the sourcecode is to support reproducible builds (See e.g. reproducible-builds.org).
All other methods require trust (in either the developer or w.r.t. github actions towards github).
The drawback is of course, that to verify whether your binaries are good, someone needs to rebuild the software, but it is a good tool to build and maintain trust in your signed binaries, especially if they deal with sensitive information like private keys.
But I am thinking that their workflows are reproducible builds, correct?
A reproducible build is more than an automated build. It is a build process which enables any third party to build a binary that is bit-by-bit identical (see reproducible-builds.org/docs/definition/).
So if I would build a specific release/commit of your application on my PC (given an identical development environment, i.e. same version dependencies, compiler, etc.) it MUST result in a bit-by-bit identical binary to the one you built on your development machine and the one the github workflows built.
All these binaries would result in the same hash (and thus be verifiable by the same signature files).
“Here is my very simple commit that you can read, and here is the executable in case you want to download the fixed wallet but are not technically savvy enough to build it”
Other than a signed binary from a trusted developer/organization, there is (IMHO) no way for a non-tech savvy user to gauge the trustworthiness of a binary they download from the internet, and even then a signing key might have been lost or broken (see the recent Microsoft debacle w.r.t. AD signing key misuse).
Yo folks, I have LineageOS installed on my smartphone without any google services ofc Why can’t I use U2F or FIDO2 (hardware keys)? It this Google feature?
Basically, yes. IIRC the FIDO/U2F handling is implemented in google libs.
They are however re-implemented in microG: github.com/microg/…/Implementation-Status, so if you are open to using that it should work with apps using the corresponding google client libraries.
I have used Firefox on Lineage/microG and tested FIDO2 there, it does NOT work with Fennec as that does not include the required client side libraries.
I have Nextcloud installed as a snap. I would like to back it up to a folder on a separate drive within the server. Nextcloud appears to have an official backup app, which I have installed on the Nextcloud instance....
How can I prove that a downloadable executable is built from the published source?
I have forked a project’s source code on GitHub. The program takes a private key as an input and that key must never leave the client. If I want to share a pre-built executable as a release it is essential that I can prove beyond reasonable doubt that it is built from the published source....
U2F/FIDO2 on Degoogled phone
Yo folks, I have LineageOS installed on my smartphone without any google services ofc Why can’t I use U2F or FIDO2 (hardware keys)? It this Google feature?
`zig cc`: a Powerful Drop-In Replacement for GCC/Clang - Andrew Kelley (andrewkelley.me)
Through witchcraft and dark magic, Zig contains a C standard library and cross compiler for every architecture in 45 megabytes.
How do you back up Nextcloud, installed as a snap, using the Backup app?
I have Nextcloud installed as a snap. I would like to back it up to a folder on a separate drive within the server. Nextcloud appears to have an official backup app, which I have installed on the Nextcloud instance....
Getting more than 50 posts - Pythorhead
Hello Lemmy!...