Hashes, signatures, reproducible builds and audits answer different questions.
Being open source makes code inspection possible, but does not by itself prove that the installed app is that same code or that it has no vulnerabilities. When evaluating a messenger, it is better to distinguish several kinds of evidence: source code, the build process, file signatures, protocol tests and audit reports.
What exactly does each piece of evidence show?
| Evidence | Main contribution | What it does not prove by itself |
|---|---|---|
| Readable source code | Enables inspection of design and implementation | A match with the installation file or the absence of all bugs |
| Reproducible build | Enables comparison of output from a specified source and environment | The security of the code itself |
| APK signature | Checks the signature and the file’s connection to a trusted signing key | That the app’s behavior is harmless |
| SHA-256 hash | Detects byte differences against a trusted digest | Authenticity when an attacker has replaced both the file and digest |
| Test vector | Checks a specified behavior for given inputs and outputs | Coverage of every state and execution path |
| Independent audit | Findings from examining a specified scope and version | A permanent guarantee for all future versions |
A reproducible build is not the same as downloading a file with a matching hash
According to the Reproducible Builds definition, reproducibility concerns producing identical output from specified source code, an environment and instructions. If you only compare a downloaded file with the hash published by its developer, you have performed an integrity check; you have not yet built the file yourself from the code.
To evaluate a reproducibility claim, ask for the code version, dependencies, build instructions and a report from someone else who reproduced the result. Saying “the source is available on GitHub” does not replace this evidence.
How should APK checks be interpreted?
- Obtain the file from the official source and for a specific version.
- Obtain the digest and signer information from a source whose authenticity you trust.
- Calculate the file’s hash and compare it against that same version.
- In a technical check, validate the signature too; the official apksigner tool supports this.
- If you find a mismatch, stop installation and clarify the cause; do not re-sign the file to get past the error.
An example verification command for an expert with Android SDK Build Tools:
apksigner verify --verbose --print-certs app.apk
The name app.apk is only an example. A successful command does not remove the need to know the publisher’s trusted key.
What role does Proof Lab play?
Livara’s Proof Lab provides tools for specific checks. Read the scope of each test: a file hash, an example key agreement and rejection of tampered data address different questions. A successful cryptographic demonstration is not an audit of the entire installed app, server, updates or account management.
Livara’s threat model also explicitly states that if an attacker replaces both the APK file and the displayed digest, a matching hash alone does not establish authenticity. This is a general limitation of hash checks, not a feature of one particular messenger.
What should you ask when reading an audit report?
- Which organizations or individuals performed the examination, and where is the public report?
- Which version and commit were examined?
- Which parts were outside the scope?
- How were important findings fixed and retested?
- Is your installed version the same version, or does it include those fixes?
Do not draw firm conclusions from words such as “approved” without answers to these questions. Using a standard algorithm is not equivalent to standards certification of the entire product, either.
What this means when choosing a messenger
Open source and verifiability are not competitors; they are complementary evidence. Prefer a product whose claims are precise, traceable and clearly scoped. Then extend the same examination to your particular use, such as groups, the web version, backups and linked devices, rather than concluding absolute security from one successful test.
