Reproducible builds of E2EE-messengers for Android using Nix hermetic builds

This thesis explores the implementation of verifiable, Reproducible Builds for End-to-End encrypted (E2EE) messaging applications for Android. The topic is part of the research field of Reproducible Builds, which aims to increase trust in software and to improve the security of Software Supply Chains. Reproducible builds aim to enhance trust in software by allowing users to verify that the binary of the software has been created from the exact source code and dependencies specified in the build process. The thesis focuses on providing a reproducible build process for two open-source E2EE messaging applications: Signal and Wire. The motivation to ensure reproducibility—and thereby the integrity—of E2EE messaging applications stems from their central role as essential tools for modern digital privacy. These applications provide confidentiality for private and sensitive communications, and their compromise could undermine encryption mechanisms, potentially leaking sensitive data to third parties. Ensuring the integrity of E2EE apps is not only critical for individual privacy but also for upholding broader principles of freedom, security, and trust in the digital age.
Due to time constraints, only a small subset of the available E2EE messaging apps could be selected for this work. Signal Android and Wire Android were chosen as two of the most popular E2EE messaging applications. However, the intention is to extend the set of reproducibly built applications to include many more in the future. The applications are built in a hermetically isolated build environment, which is configured using a Nix expression. The implementation consists of a CI/CD pipeline, which is called at regular intervals and checks for new versions of the Android applications. If a new version of one of the applications has been released, the pipeline will update the Nix scripts and verify the reproducibility of the new version of the application by building the derivation, which fetches the new source code, retrieves the dependencies, and builds the APK. The resulting APK is compared to the vendor-published APK using the tool Diffoscope to identify any differences. The self-built APK, its hash value, and a build attestation are published as pipeline artifacts of the GitLab instance and logged in a transparency log to allow further external verification of the supply chain. This work contributes to improving the security and integrity of software supply chains, particularly for E2EE applications, by ensuring that no unauthorized modifications occur during the build process.