How can users confidently verify that a FOSS application is running from its published source code? Is there a easy way to check this, or is this based of checksum and hashes?

you are viewing a single comment's thread
view the rest of the comments

[–] jet@hackertalks.com 25 points 1 year ago (1 children)

F Droid is as close as you're going to get. They take open source projects and build them independently and then publish. So if you trust f Droid, then the code you get from f Droid is the right code, and the binary you get from Android is the right binary.

[–] SpeakinTelnet@sh.itjust.works 6 points 1 year ago (1 children)

Fdroid is great but OPs question is even more important then, installing an installer app without knowing its legitimacy could lead to many apps being infected.

[–] jet@hackertalks.com 4 points 1 year ago

Sure, its about who you trust in this scenario. once you introduce a compiler it becomes unprovable. So what your threat model is, and who you can trust.