Comment by gruez
You can raise that gripe with even something like signal. Sure, it's open source, but when was the last time someone reproducibility built it?
You can raise that gripe with even something like signal. Sure, it's open source, but when was the last time someone reproducibility built it?
Pick a decently up-to-date fork of Signal on GitHub and look at its Actions. You can also just do it yourself if you'd like, the process is effectively just doing a build in a docker container and comparing the result.
https://github.com/signalapp/Signal-Android/blob/main/reprod...
There is a dedicated reproducible builds action that verifies that it does match (currently failing because of the aforementioned bug). I'm not sure why you're still litigating this when, again, you can not only just go look at it, you can very much do it yourself.
People reproducibly build Signal all the time. There's a bug right now that makes the play store version differ from the one you get by downloading off their website/build from source, but you can examine the differences to see they're minor.