Hi there, Signal Android dev here. We have reproducible build steps, so you actually can verify the code is the same :)

https://github.com/signalapp/Signal-Android/tree/master/repr...

Reproducible builds do not help to determine if the version you download via the Play Store (or, for those on enterprise devices, any pre-installed corporate stores) is the same as you build - Play Store presents no real means to verify that. This includes any auto-updates if they are enabled.

It's an issue with Play Store as a delivery channel, the individual app in question can't do much about that.

Reproducible builds help if you: - download the APK separately (includng from the Signal website, or some of the other sources) - install the file locally via sideload - disable updates (!)

The instructions posted by the dev directly include instructions for pulling the APK from your phone which was installed through the Play Store.

https://github.com/signalapp/Signal-Android/tree/master/repr...

This is very true. Reproducible builds for mobile apps would be far superior. You can build Signal from source for Android if you wish, although obviously this is a massive pain to do for each update, there’s absolutely nothing stopping you from doing it.

On iOS it's a lot more difficult to get the required certificates from Apple but you can run your own build in Xcode and deploy it to your personal device if you are a registered Apple developer.

While reproducible builds are obviously the gold standard, for apps you install from the Play Store or the App Store, developers sign the apps that get distributed with their own private keys. As Google and Apple don’t have access to these it should be verifiable that the apps are not tampered with.

There is an exception here with the Play Store, where there is an opt-in option for Google to sign the app on your behalf [1], but I think we can safely assume Signal are manually signing with their own private keys.

In any case it's easy to just grab an APK from an Android device and check signatures for yourself.

For iOS though, no surprises here it’s locked down. Although from what I gather reading Apple’s security documentation, it confirms that apps must be signed by developers with their private keys. [2] But unlike Android there’s sadly no way I can tell for the user to independently verify this without jailbreaking.

But ultimately, short of building each version yourself, all this is moot if you distrust the developers.

[1] https://developer.android.com/studio/publish/app-signing [2] https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...

Are there any instructions to build the app yourself for signal?

Yes, they have some docs on GitHub for how to do it: https://github.com/signalapp/Signal-Android/wiki/How-to-buil...

You can build the iOS version too for development: https://github.com/signalapp/Signal-iOS/blob/master/BUILDING...

I haven't done it before but you should even be able to deploy that build to your phone in theory: https://codewithchris.com/deploy-your-app-on-an-iphone/

It's unclear to me if there are any restrictions on iOS that would prevent you from doing that.

I spent a few hours trying to get a local build of signal-ios working a few weeks ago, in order to write a PR fix a bug with lost voice messages. The xcode project uses a plethora of device entitlements I'm not allowed to have (since I don't have the proper signal signing key). Even after a couple hours of tweaking to get it building and deployed to my device, its currently crashing on startup because it can't access some special signal local device store.

You can certainly get your own build working (without notifications and other features). But personally I found it prohibitively difficult to do so.

I think you will have a problem when it comes to push notifications. I doubt a local build would be able to receive push notifications addressed to App Store builds.

I just realized one issue with this is that their latest production branch is private so you would receive delayed updates.