Ask HN: Why don't we create checksum for source code?

1 points by franzwong 5y ago ↗ HN

Suppose a developer puts the source code of an App in Github, so that we can review the source code to ensure it is securely safe for users. I know we create checksum for the binaries. But how can we know the App in App store is built from the source code in Github?

3 comments

[ 3.3 ms ] story [ 14.2 ms ] thread

bloak 5y ago ↗

https://en.wikipedia.org/wiki/Reproducible_builds ?

smt88 5y ago ↗

The majority of useful software will not build into identical binary files each time.

If you trust the source code, it's usually easy enough to build a mature FOSS app yourself.

remexre 5y ago ↗

https://nixos.org/ and https://guix.gnu.org/ are both angling to do this, but... it's hard.