Quote from: josephbisch on July 07, 2015, 08:13:06 PM

We are working on reproducible builds for Armory. The goals are Linux deb packages and a Raspberry Pi package for the next version of Armory (0.94). Right now the only way to be 100% certain that the binaries came from the source code is to build Armory from source yourself. After the reproducible builds exist, you will be able to verify the signatures of people you trust to be sure that the binaries came from the source code without needing to build Armory yourself. You will also be able to follow the reproducible build process to make your own build and sign off on it, so that people that trust you can verify your signature.

The Raspberry Pi package uses Gitian, but the Linux deb packages will use a script that uses the Debian Reproducible Toolchain. We will have instructions for reproducible builds using both systems. The Debian Reproducible Toolchain produces a buildinfo file instead of an assert file, but the idea is more or less the same.

It looks like 0.94 will just be using the signatures to verify that multiple people were able to get the same hash of the binaries. Only if a certain number of signatures are correct will the usual signing process continue. There will probably be a separate repository for signatures, like the Bitcoin gitian.sigs repo, so that ambitious users can verify the signatures themselves.

It seems like the ultimate goal is to have the Secure Downloader (that is part of Armory) verifying the signatures of multiple ATI employees, so that there is not a single computer doing the build and a single key signing the builds. But that won't happen for 0.94.

Work is also being done for OS X and Windows using Gitian. But those definitely won't be a part of 0.94.

Let me know if you have any more you want to know about this. Hopefully we will have 0.94 testing releases soon and then people will be able to try out the reproducible build process.

When is 0.94 (with reproducable builds for Linux and Raspberry Pi) due approximately? Are we talking 3 weeks, 3 months, or longer?