Signal Desktop Builder For Debian:arm64

signal-desktop_7.68.0_arm64.deb

This project reproducibly builds Signal Desktop for Debian Trixie on ARM64, currently targeting tag 7.68.x

Now with an optional update client: auto-update-cron.sh

This is the latest release: builds/release/signal-desktop_7.68.0_arm64.deb

Sha512Sum: builds/release/release.sha512sum

Full chain Software Bill of Materials

Firmware SBOM's: U-Boot:/Results

System SBOM: builds/release/ubuntu.25.04.spdx.json

• Grype Scan: builds/release/ubuntu.25.04.grype.status(

  Signal-Desktop-Reproducible/builds/release/ubuntu.25.04.grype.status

  Lines 1 to 3 in 708b3a5

  	✔ Scanned for vulnerabilities [8063 vulnerability matches]
  	├── by severity: 0 critical, 0 high, 10986 medium, 415 low, 147 negligible
  	└── by status: 360 fixed, 11188 not-fixed, 3485 ignored

  )

Docker SBOM: builds/release/signal.spdx.json

• Grype Scan: builds/release/signal.grype.status(

  Signal-Desktop-Reproducible/builds/release/signal.grype.status

  Lines 1 to 3 in 71cac5a

  	✔ Scanned for vulnerabilities [485 vulnerability matches]
  	├── by severity: 0 critical, 31 high, 41 medium, 25 low, 467 negligible (168 unknown)
  	└── by status: 5 fixed, 727 not-fixed, 247 ignored

  )

0mniteck's Current GPG Key ID: 287EE837E6ED2DD3

^{*Vigilant Mode is on for this repo so all remote pushes/tags should be signed with a verified key.}

Build Instructions/Usage:

Build:

buildscript.sh:
  -c {Cross Compile: yes/No}
  -d {Date: source_date_epoch/today}
  -i {Increment: .version}
  -m {Mount Luks partition: mmcblk1p1}
  -p {Push-branch: debug}
  -r {Release-tag: tagname}
  -t {run-Tests: yes/No}

A. First build and push the upcoming branch:

git clone https://github.com/$REPO/Signal-Desktop-Reproducible.git && \
cd Signal-Desktop-Reproducible && \
./buildscript.sh -i'.01' -p'7.xx.x' -d'today'

B. Then rebuild the current branch for release:

git clone git@github.com:$REPO/Signal-Desktop-Reproducible.git -b 7.xx.x && \
cd Signal-Desktop-Reproducible && \
./buildscript.sh -p'main' -r'7.xx.0'

C. To build a past release for reproducibility:

git clone git@github.com:0mniteck/Signal-Desktop-Reproducible.git -b 7.xx.x && \
cd Signal-Desktop-Reproducible && \
./buildscript.sh

Usage:

Download the .deb to your device, verify the sha512sum, then install:

[Current Sha512sum] (

Signal-Desktop-Reproducible/builds/release/release.sha512sum

Line 2 in 708b3a5

7d569c9787c5da5cf7d111ee568ea14cf35a676aa9766edc32c605c177470ff4f91b6fdfd0f1ee11103f83a711f66756a721f5f5c70c98317e31cec7f6175c7b signal-desktop_7.68.0_arm64.deb

)

sha512sum signal-desktop_7.68.0_arm64.deb

sudo apt install ./signal-desktop_7.68.0_arm64.deb

Optional Installer/Updater:

Install updater auto-update-cron.sh by running:

sudo su && \
curl -sSL https://raw.githubusercontent.com/0mniteck/Signal-Desktop-Reproducible/master/auto-update-cron.sh | bash

Current Status:‎‎‏‏‎‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ _{^{signalapp/Signal-Desktop}}

• Built with 0mniteck/debian-slim:latest
• Signal Desktop builds
• Auto-Update script
• Reproducible builds
• Generate/Scan SBOM at buildtime

Release Cycle:

Currently building upstream releases twice to improve reproducibility/reliability:

build/release to branch 7.xx.x --> test on hardware, document, pull request --> build/release to master branch

See also:

• The Sovereignty Ephemerality Reproducibility (SER) framework
• https://snapshot.debian.org
• https://hub.docker.com/_/debian/tags
• https://hub.docker.com/r/0mniteck/tags
• https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md
• https://github.com/signalapp/Signal-Desktop/blob/development/CONTRIBUTING.md