![](/static/253f0d9b/assets/icons/icon-96x96.png)
![](https://lemmy.world/pictrs/image/8286e071-7449-4413-a084-1eb5242e2cf4.png)
7·
1 year agoI’m interested as well. I hope there’s a different answer than Amazon Kindle, as I refuse to buy anything from them
I’m interested as well. I hope there’s a different answer than Amazon Kindle, as I refuse to buy anything from them
Just yesterday 😅 there’s a bug in the main branch of Lemmy itself that I was trying to pinpoint (introduced after 0.18.0 was tagged). Instead of walking through all recent commits manually, I used bisect. Bisect is not a magic bullet, and you could do the same manually, but it’s a good tool in the toolbox to know sometimes.
I’m not on the experimental build, so will have to wait until it gets a stable release, but I wonder if it’s a similar scheme to the Switch version?
As far as I’m aware, there is no way to fully know there wasn’t any tampering or swapping of executables that were produced by a workflow. As most things on the internet, I believe there needs to be a degree of trust towards the original author and original owner of the repository that what they published is indeed a built executable from the original source. If there is any doubt about this, the only verifiable way to know for sure, if for a potential user to build from source themselves.
I can think of ways where there is a trusted third party that provides a public key with which to sign the built executable, after which it can be checked by the third party (with its private key) whether it is still the same executable. Specially if a different key pair is used for every signing operation. But there are still flaws there, and would, ultimately, still rely on a degree of trust in the third party.