But then there is also the question if you trust github (and because of that microsoft, but also the USA because of laws) with always building from the sources, and adding nothing more.

Yesterday I would have said 'blah, they would not care about my particular small project'. But since then I read the paper recommended by a user in this post about building a compromised compiler that would installs a back-door to a type of login field. I now think it is not so crazy to think that intelligence agencies might collude with Microsoft to insert specific back-doors that somehow allows them to break privacy-related protocols or even recover private keys. Many of these might rely on a specific fundamental principle and so this could be recognized and exploited by a compiler. I came here for a practical answer to a simple practical situation, but I have learned a lot extra 😁

Ooh, I did not know this one was of the properties of Rust.

Thanks! I am convinced now, I will learn how to create reproducible builds.

My worry is that the build is run through npm, and I think that the dependencies rely on additional dependencies such as openssl libraries. I worry that it will be a lot of work to figure out what every npm dependency is, what libraries they depend on, and how to make sure that the correct versions can be installed and linked by someone trying to reproduce the build 10 years from now. So it looks like a difficult project, but I will read more about it and hopefully it is not as complicated as it looks!

Ah. Cool. I was under the impression that docker images suffered from a similar issue - that one can't verify that the image is built from the source. I'm happy to be mistaken about that.

How does a docker distribution solve this problem? Is it because the build instructions are automated by the Dockerfile?

Thanks. In the future I work using the Reproducible Builds practices and use OpenBSD to sign my builds.

In the immediate situation I want to know whether there is a way to use GitHub as my trusted third-party builder. I would like to share something with people - some of who might not have the skills to replicate the build themselves, but I still would like to be able to point them to something that is easy to understand and give them argument.

My current argument is: "See, in the github logs you can see that github generated that hash internally during the workflow, and it matches the hash of the file that you have downloaded. So this way you can be sure that this build really comes from this source code, which was only changed here and there". Of course I need to make absolutely sure that my argument is solid. I know that I'm not being malicious, but I don't want to give them an argument of trust and then find out that I have mislead them about the argument, and that it was in fact possible to fake this.

I think you can even upload release files manually, independently of if you use actions or not, so it can never be guaranteed that it was built from the sources.

True, but that's why my current idea is the following:

As part of the wortkflow, GitHub will build the executable, compute a few different hashes (sha256sum, md5, etc..), and those hashes will be printed out in the GitHub logs. In that same workflow, GitHub will upload the files directly to the release.

So, if someone downloads the executable, they can compute the sha256sum and check that it matches the sha256 that was computed by github during the action.

Is this enough to prove that executable they are downloading the same executable that GitHub built during that workflow? Since a workflow is associated a specific push, it is possible to check the source code that was used for that workflow.

In this case, I think that the only one with the authority to fake the logs or mess with the source during the build process would be GitHub, and it would be really hard for them to do it because they would need to prepare in advance specifically for me. Once the workflow goes through, I can save the hashes too and after that both GitHub and I would need to conspire to trick the users.

So, I am trying to understand whether my idea is flawed and there is a way to fake the hashes in the logs, or if I am over-complicating things and there is already a mechanism in place to guarantee a build.

TIL. That's an interesting craft!

I think it is difficult for others to tell you whether it is "worth it", because that is very personal.

For me, personally, transferring my family and friends to Signal is not worth it because Signal requires a phone number. If I will invest such an effort, I would rather help them migrate to a service that does not require a phone number - such as Matrix or an XMPP server. But needing a phone number to register might not be a problem for you - in which case Signal could be a perfectly reasonable choice.

But... Even then - is it worth it? Again, it is up to you. I tried, but my success has been limited. The reality is that I still have a phone with WhatsApp that I leave at home and I check it every day or two. I tell people that if they want to reach me, the best is to use e-mail. And to my closest friends and some of my family I did convince them to use my XMPP chat so that we can be connected more often. No one really left WhatsApp, but at least we can have some fun conversations on our own server, which is nice.

But I am not going to lie, I am sacrificing a ton of functionality and convenience. For me, this is worth it because I think that it is GOOD not to be available through the phone all the time, and I am idealist when it comes to not giving big companies our data. But for some people these sacrifices might be unsustainable, and it might not be worth it.

So: I don't know. Maybe it's worth it?

There is also a "purge community" button. But I have learned that if I purge a non-local community the purge is so complete that your instamce forgets it ever existed... And it can simply be fetched again!

Noooope

Hairless cats are my favorite. So pink I guess.

I like to think that I am a good person...