How do we know the updates our phones get is the same as what is on Github?

pizzadequeso

I would not be using GOS if I did not trust it, but just being wondering. and this can be a very dumb question.

How to verify the update we get over the air is the same as the publication on Github? Also how be it be sure that the OS image we flash the phone with is what is published, is anyone auditing these?

raccoondad

pizzadequeso How to verify the update we get over the air is the same as the publication on Github?

You can't, you could compare binaries but that may be different based on optimization and compiler types.

There is not really a way to audit them, realistically

thmf

pizzadequeso

Wikipedia: reproducible builds.

GrapheneOS builds are reproducible.

Please search the forum first, most likely your questions were already answered.

Eumenia

raccoondad You can't, you could compare binaries but that may be different based on optimization and compiler types.

You can indeed compile the exact same binaries as published cause GOS is reproducible

https://grapheneos.org/build#reproducible-builds

https://github.com/lucasbeiler/reproducible-builds-grapheneos