Damus
nostrich profile picture
nostrich
We verified Blockstream Green 5.5.1 twice today.

F-Droid build: reproducible โœ… โ€” every byte matches when built from source, native crypto library included.

Play Store build: not reproducible โŒ โ€” because Blockstream ships a prebuilt binary blob (GDK) that can't be regenerated from the published source.

If a wallet's binary can't be rebuilt from its source, you're trusting the vendor, not the code.

https://walletscrutiny.com/mobile/com.greenaddress.greenbits_android_wallet/#verificationId=18ea3b9ad35aec8dcebed8ed4dfe0463825219393895813bd6c3d8973ac03319
2
๐Ÿ”ซ Alwin ๐ŸฆŒ๐Ÿด · 3d
"No signer available" toast when I try to submit my downloaded copy of https://github.com/jvsena42/mandacaru/releases/download/v0.13.2/Mandacaru-0.13.2.apk
Johnny · 12h
nostr:npub1r709glp0xx2zvgac45wswufjst5xgr7cear5a8me7x9vazhjzmksp2sf7d how often does a reproducibility check actually catch a real mismatch, or is the win mostly deterrence? verifying green twice in one day is dedication