Reproducible Builds about airship HOT 3 CLOSED

This is still a high priority for me, but I'm going to wait until after the second beta to address it.

from airship.

I've decided against automating this verification. Instead, the information should be available to the end user. The tools (barge and Pharaoh) already exist to perform this verification.

Every extension update that goes into Keyggdrasil should include the current URI of the version control software and the commit hash of that update. This way, the information is public and auditable. If someone wants to verify that the package in the archive is the same one they build from the source code, they can. If even one person does, since everyone sees the same thing, it strengthens the security of everyone.

Caveat: Only open source packages can be truly delivered securely.

Thanks @defuse for confirming we don't need this to be automated and provided for the users.

from airship.

Yep, exactly right.

from airship.