Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is exactly how iOS works today; in fact Apple recommends you upload your LLVM IR to them and tag your assets as well so they can recompile and recombine your apps for hardware you don't know the existence of yet. Which is nice if you trust Apple…if you don't, then it is very difficult to actually verify that what you're downloading from the App Store is actually what you submitted to the company. With resigning and FairPlay and all the wrappers that Apple applies, it is really difficult to do any sort of verification here :(


Would it be possible to download the app from the store, decompile/unbundle it and compare it with your dev version?


Not easily, unfortunately. Accessing the app files itself is usually not possible on a normal iOS device, and even then they are encrypted with FairPlay DRM (which is easy to reverse–but only on a jailbroken device).


Not really and if I recall correctly, that's the main reason why AppStore is considered incompatible with GPL.


I believe the main reason that it was incompatible was a EULA that had incompatible sections and was unwaivable, although those parts are gone now so whether it's still incompatible is not clear.


It would still be incompatible with v3, wouldn't it?


Why?


IANAL and I have no involvement in the Apple ecosystem, so take with a grain of salt:

My understanding is that GPLv3 requires that anyone who gets a binary can also get the source to it, and can then build and run that source on the same device. Even if Apple now allows distribution of software that demands to also share its source code, it's my understanding that you can't build that code and run the result on your iPhone without either rebuilding/reinstalling every 7 days or paying Apple. That certainly seems to be against the intention of the license, although I admit it may technically squeak by the exact requirements.

On a different note, https://en.wikipedia.org/wiki/GNU_General_Public_License#Leg... also suggests that there's an issue around a person having a copy of an app not being able to share it with other people.


Yes it is with a jail broken device


Telegram does provide verifiable builds on iOS, but you need a jailbroken device to dump the decrypted executable.

https://core.telegram.org/reproducible-builds#reproducible-b...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: