Is it possible to achieve bootstrapped builds on F-Droid?

,
1

I was reading this article Making reproducible builds visible | F-Droid - Free and Open Source Android App Repository and thought about if it was possible to have bootstrappable builds too? See Identifying software — 2024 — Blog — GNU Guix “Full-Source Bootstrap” part.

Reproducible builds alone cannot ensure the source-to-binary correspondence: the compiler could contain a backdoor, as demonstrated by Ken Thompson in Reflections on Trusting Trust. To address that, Guix goes further by implementing so-called full-source bootstrap: for the first time, literally every package in the distribution is built from source code, starting from a very small binary seed. This gives an unprecedented level of transparency, allowing code to be audited at all levels, and improving robustness against the “trusting-trust attack” described by Ken Thompson.

Also, the part about rewriting the *buildserver was very nice to hear, does it fix “any of the issues” mentioned in this article F-Droid Security Issues | PrivSec - A practical approach to Privacy and Security?

2

If you can package Android SDK/NDK for Guix, then bootstrappable build is possible.

I LMAO when I saw that they are talking about “harassment” again. I feel that I’m harassed by reading the article. :rofl: Though they said they just updated it today (what’s updated actually??? Can’t they fix their stupid website so that the modifed date is not updated everytime they re-generate the website?) they still said we have “very few reproducible builds” though about 20% apps in the main repo are reproducible build (Please update it if you are watching this forum).

If you find that there are valid points in this article, please put it here directly so that I don’t need to read it again.

2 Likes