Binary release from github

[fph]

Would it be possible to set up a build process on Github, and release a .deb / .rpm package directly in the Github release? This would allow a security-concerned user to install your package without trusting your binary repositories and your build (which as far as I understand is not reproducible.

[devzbysiu]

Hi, regarding having the build process on GitHub, there was a discussion about this, but it was decided no to do it this way. We have self-hosted CI solution that gives us full control during build and the produced packages are also signed.

Regarding reproducible builds, we actually have a reproducible build on our CI. Please keep in mind that the build process on CI and building manually from GitHub repository is a different process.

If you prefer to have full control here, then you can build the app on your own following the instructions here.

Let us know in case of any further questions

[fph]

Thanks. What do you mean with "Please keep in mind that the build process on CI and building manually from GitHub repository is a different process"? Do they not produce the same files byte-by-byte? If so, are there instructions to reproduce the build in your repositories byte-by-byte?

[devzbysiu]

So basically there are proprietary parts and protocols we don't want to have open-sourced, e.g. NordWhisper, remote configuration libraries and others. These libraries won't be linked to the final application when build from source so it's not possible to have an artifact that is byte-by-byte as the app we have in repositories

[fph]

Is it at least possible to use only the open source Github code to connect to your VPN, or are these proprietary extensions required? There was a big announcement stating that the Linux client is open source, but now you are writing that there are proprietary parts. This seems problematic. I would like to use my open source VPN client without having to run untrusted binaries; is there a way to do that?

[devzbysiu]

Hi, sorry for the delayed response. Yes, it's totally possible. We are maintaining two "types" of build - one, the internal, with proprietary parts and second - public build from source, without proprietary parts. You can build from source and you'll have fully working application which is able to connect to our servers.
You'll loose the functionality of the proprietary libraries, but feature-wise it's only NordWhisper protocol right now