On 2/27/19 4:54 AM, Georg Koppen wrote:
Torsten Grote:
On 2/26/19 11:19 AM, Georg Koppen wrote:
I think we should be able to provide that with our Tor Browser builds once we have all the PT pieces sorted out (which is rather soon).
That would be nice!
So, probably the easiest way would then be to just copy the respective binaries we produce over to include them in the Briar software
I assume these binaries are reproducible?
They would be used for Tor Browser which has reproducibility as a hard requirement, so yes.
We are currently not including these binaries directly, but publish them as a library (gradle/maven to jcenter) where Briar and other projects can get them from.
Okay, good to know.
It seems to me that Tor Browser should instead perhaps rely on the Briar build process, at least for Android. I will be switching Orbot and our AndroidPT library over to the Briar dependency in the next release.
We should also figure out who is doing the source builds, how these are published as public modules, and who is monitoring and verifying the reproducibility. This is for both PT's and the current tor-android binary project that I manage (https://github.com/n8fr8/tor-android). It would be great to have Tor to be the source for trustworthy binary builds, available through direct downloads and gradle/maven/cocoapods, etc. We have talked about this many times in the past.
Related to this, we are also building and publishing PT's as shared libraries, instead of binaries, which is eventually going to be required on Android for both tor and obfs4proxy. It isn't all quite working yet, but will be soon. At some point, we'll have to talk about that whole transition.
Our goptlib shared library build project is here: https://gitlab.com/eighthave/goptbundle which is being made available to app developers here: https://github.com/guardianproject/AndroidPluggableTransports
+n