ubuntu-phone team mailing list archive

[Michael Zanetti <michael.zanetti@xxxxxxxxxxxxx>]

On Tuesday 15 October 2013 12:51:07 Robert Schroll wrote:
> On Tue, Oct 15, 2013 at 9:16 AM, Michael Zanetti
> 
> <michael.zanetti@xxxxxxxxxxxxx> wrote:
> > App Developers don't want to publish their code and the
> > vast majority of users doesn't seem to care about anything security
> > at all
> > anyways. It's a sad situation for people like us who actually DO care
> > about
> > security.
> > 
> > However, I haven't given up hope that at some point someone will set
> > up some
> > App Repository for Ubuntu Touch which requires developers to upload a
> > source
> > package, the binary will be built on the trusted server and the exact
> > same
> > source archive published along with the binary.
> 
> Personally, I'd much prefer to publish through this system.  Not only
> would it provide more assurance for my users that my source actually is
> my source, it would free me from having to play with pbuilder and
> chroots to build click packages.  I doubt that I'm typical in this
> regard, but one datum is better than none, right?

Well, tbh you'd need to care even more about pbuilder etc as it can be quite 
complex to make a remote server compile your stuff. In that case it's not just 
about somehow compiling a binary, but rather providing a fail-proof recipe for 
the server to build it. So actually this more complex.