Very nice. I'll try to tackle this somehow. A bit more community ideas before.
Questions: I would tie this to source code, not APK. Problem is most don't do reproducible builds and we probably audit ...
Good point, and true there are few reproducible apps.
Would be nice to tag a version (as per Software Applications NIP) against which the latest analysis was run, rather than a git commit.
These reports also contribute to reputation to the keystore/certificate signing the APK so they help anyway.
Would be nice to tag a version (as per Software Applications NIP) against which the latest analysis was run, rather than a git commit.
These reports also contribute to reputation to the keystore/certificate signing the APK so they help anyway.
2❤️1
