Add reproducible builds

2026-05-15 12:50:37 +00:00 · 2026-04-11 18:32:24 +02:00 · 2026-04-11 18:32:24 +02:00 · 05c1d7bc99
commit 05c1d7bc99
parent d0ee90dbbc
12 changed files with 336 additions and 261 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@ -0,0 +1,57 @@
+name: build
+
+on:
+  push:
+    branches:
+      - "**"
+  pull_request:
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        # The "reproducible" entry is used to build the project with the LTS Java version used in reproducible builds script.
+        # More Java versions can be added to test compatibility, eg. "26".
+        java: ["reproducible", "26"]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build
+        run: |
+          if [ "${{ matrix.java }}" != "reproducible" ]; then
+            export OVERRIDE_JAVA_VERSION="${{ matrix.java }}"
+          fi
+          ./reproducible-builds/build.sh
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: signal-cli-${{ matrix.java }}-${{ github.job }}
+          path: dist/*
+
+  build-client:
+    strategy:
+      matrix:
+        os:
+          - ubuntu
+          - macos
+          - windows
+    runs-on: ${{ matrix.os }}-latest
+    defaults:
+      run:
+        working-directory: ./client
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install rust
+        run: rustup default stable
+      - name: Build client
+        run: cargo build --release --verbose
+      - name: Archive production artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: signal-cli-client-${{ matrix.os }}
+          path: |
+            client/target/release/signal-cli-client
+            client/target/release/signal-cli-client.exe
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -1,96 +0,0 @@
-name: signal-cli CI
-
-on:
-  push:
-    branches:
-      - '**'
-  pull_request:
-  workflow_call:
-
-permissions:
-  contents: write # to fetch code (actions/checkout) and submit dependency graph (gradle/gradle-build-action)
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        java: [ '25', '26' ]
-
-    steps:
-      - uses: actions/checkout@v6
-      - name: Set up JDK
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'zulu'
-          java-version: ${{ matrix.java }}
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
-        with:
-          dependency-graph: generate-and-submit
-      - name: Install asciidoc
-        run: sudo apt update && sudo apt --no-install-recommends install -y asciidoc-base
-      - name: Build with Gradle
-        run: ./gradlew --no-daemon build
-      - name: Build man page
-        run: |
-          cd man
-          make install
-      - name: Add man page to archive
-        run: |
-          version=$(tar tf build/distributions/signal-cli-*.tar | head -n1 | sed 's|signal-cli-\([^/]*\)/.*|\1|')
-          echo $version
-          tar --transform="flags=r;s|man|signal-cli-${version}/man|" -rf build/distributions/signal-cli-${version}.tar man/man{1,5}
-      - name: Compress archive
-        run: gzip -n -9 build/distributions/signal-cli-*.tar
-      - name: Archive production artifacts
-        uses: actions/upload-artifact@v7
-        with:
-          name: signal-cli-archive-${{ matrix.java }}
-          path: build/distributions/signal-cli-*.tar.gz
-
-  build-graalvm:
-
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v6
-      - uses: graalvm/setup-graalvm@v1
-        with:
-          distribution: 'graalvm'
-          java-version: '25'
-          cache: 'gradle'
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build with Gradle
-        run: ./gradlew --no-daemon nativeCompile
-      - name: Archive production artifacts
-        uses: actions/upload-artifact@v7
-        with:
-          name: signal-cli-native
-          path: build/native/nativeCompile/signal-cli
-
-  build-client:
-    strategy:
-      matrix:
-        os:
-          - ubuntu
-          - macos
-          - windows
-    runs-on: ${{ matrix.os }}-latest
-    defaults:
-      run:
-        working-directory: ./client
-    steps:
-      - uses: actions/checkout@v6
-      - name: Install rust
-        run: rustup default stable
-      - name: Build client
-        run: cargo build --release --verbose
-      - name: Archive production artifacts
-        uses: actions/upload-artifact@v7
-        with:
-          name: signal-cli-client-${{ matrix.os }}
-          path: |
-            client/target/release/signal-cli-client
-            client/target/release/signal-cli-client.exe
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -5,8 +5,7 @@ on:
    tags:
      - v*

-permissions:
-  contents: write # to fetch code (actions/checkout) and create release
+permissions: {}

 env:
  IMAGE_NAME: signal-cli
@ -15,96 +14,25 @@ env:
  REGISTRY_PASSWORD: ${{ github.token }}

 jobs:
+  build:
+    uses: AsamK/signal-cli/.github/workflows/build.yml@master

-  ci_wf:
-    permissions:
-      contents: write
-    uses: AsamK/signal-cli/.github/workflows/ci.yml@master
-    # ${{ github.repository }} not accepted here
-
-  lib_to_jar:
-    needs: ci_wf
+  release:
+    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
-
    outputs:
-      signal_cli_version: ${{ steps.cli_ver.outputs.version }}
-      release_id: ${{ steps.create_release.outputs.id }}
-
+      version: ${{ steps.version.outputs.version }}
    steps:
-
      - name: Download signal-cli build from CI workflow
        uses: actions/download-artifact@v8

      - name: Get signal-cli version
-        id: cli_ver
+        id: version
        run: |
-          ver="${GITHUB_REF_NAME#v}"
-          echo "version=${ver}" >> $GITHUB_OUTPUT
-
-      - name: Extract archive
-        run: |
-          tree .
-          ARCHIVE_DIR=$(ls signal-cli-archive-*/ -d | tail -n1)
-          tar -xzf ./"${ARCHIVE_DIR}"/*.tar.gz
-          mv ./"${ARCHIVE_DIR}"/*.tar.gz signal-cli-${{ steps.cli_ver.outputs.version }}.tar.gz
-          rm -rf signal-cli-archive-*/
-
-#      - name: Get signal-client jar version
-#        id: lib_ver
-#        run: |
-#          JAR_PREFIX=libsignal-client-
-#          jar_file=$(find ./signal-cli-*/lib/ -name "$JAR_PREFIX*.jar")
-#          jar_version=$(echo "$jar_file" | xargs basename | sed "s/$JAR_PREFIX//; s/.jar//")
-#          echo "$jar_version"
-#          echo "signal_client_version=${jar_version}" >> $GITHUB_OUTPUT
-#
-#      - name: Download signal-client builds
-#        env:
-#          RELEASES_URL: https://github.com/signalapp/libsignal/releases/download/
-#          FILE_NAMES: signal_jni.dll libsignal_jni.dylib
-#          SIGNAL_CLIENT_VER: ${{ steps.lib_ver.outputs.signal_client_version }}
-#        run: |
-#          for file_name in $FILE_NAMES; do
-#            curl -sOL "${RELEASES_URL}/v${SIGNAL_CLIENT_VER}/${file_name}"  # note: added v
-#          done
-#          tree .
-
-      - name: Compress native app
-        env:
-          SIGNAL_CLI_VER: ${{ steps.cli_ver.outputs.version }}
-        run: |
-          chmod +x signal-cli-native/signal-cli
-          tar -czf signal-cli-${SIGNAL_CLI_VER}-Linux-native.tar.gz -C signal-cli-native signal-cli
-          rm -rf signal-cli-native/
-
-      - name: Compress client app
-        env:
-          SIGNAL_CLI_VER: ${{ steps.cli_ver.outputs.version }}
-        run: |
-          chmod +x signal-cli-client-ubuntu/signal-cli-client
-          tar -czf signal-cli-${SIGNAL_CLI_VER}-Linux-client.tar.gz -C signal-cli-client-ubuntu signal-cli-client
-          rm -rf signal-cli-client-ubuntu/
-
-#      - name: Replace Windows lib
-#        env:
-#          SIGNAL_CLI_VER: ${{ steps.cli_ver.outputs.version }}
-#          SIGNAL_CLIENT_VER: ${{ steps.lib_ver.outputs.signal_client_version }}
-#        run: |
-#          mv signal_jni.dll libsignal_jni.so
-#          zip -u ./signal-cli-*/lib/libsignal-client-${SIGNAL_CLIENT_VER}.jar  ./libsignal_jni.so
-#          tar -czf signal-cli-${SIGNAL_CLI_VER}-Windows.tar.gz signal-cli-*/
-#
-#      - name: Replace macOS lib
-#        env:
-#          SIGNAL_CLI_VER: ${{ steps.cli_ver.outputs.version }}
-#          SIGNAL_CLIENT_VER: ${{ steps.lib_ver.outputs.signal_client_version }}
-#        run: |
-#          jar_file=./signal-cli-*/lib/libsignal-client-${SIGNAL_CLIENT_VER}.jar
-#          zip -d $jar_file libsignal_jni.so
-#          zip $jar_file libsignal_jni.dylib
-#          tar -czf signal-cli-${SIGNAL_CLI_VER}-macOS.tar.gz signal-cli-*/
+          mv ./signal-cli-reproducible-build/* .
+          echo "version=$(cat VERSION)" >> $GITHUB_OUTPUT

      - name: Create release
        id: create_release
@ -112,8 +40,8 @@ jobs:
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
-          tag_name: v${{ steps.cli_ver.outputs.version }}  # note: added `v`
-          release_name: v${{ steps.cli_ver.outputs.version }}  # note: added `v`
+          tag_name: v${{ steps.version.outputs.version }} # note: added `v`
+          release_name: v${{ steps.version.outputs.version }} # note: added `v`
          draft: true

      - name: Upload archive
@ -122,19 +50,9 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}.tar.gz
-          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}.tar.gz
-          asset_content_type: application/x-compressed-tar  # .tar.gz
-
-#      - name: Upload Linux archive
-#        uses: actions/upload-release-asset@v1
-#        env:
-#          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-#        with:
-#          upload_url: ${{ steps.create_release.outputs.upload_url }}
-#          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}-Linux.tar.gz
-#          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}-Linux.tar.gz
-#          asset_content_type: application/x-compressed-tar  # .tar.gz
+          asset_path: signal-cli-${{ steps.version.outputs.version }}.tar.gz
+          asset_name: signal-cli-${{ steps.version.outputs.version }}.tar.gz
+          asset_content_type: application/x-compressed-tar # .tar.gz

      - name: Upload Linux native archive
        uses: actions/upload-release-asset@v1
@ -142,9 +60,9 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}-Linux-native.tar.gz
-          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}-Linux-native.tar.gz
-          asset_content_type: application/x-compressed-tar  # .tar.gz
+          asset_path: signal-cli-${{ steps.version.outputs.version }}-Linux-native.tar.gz
+          asset_name: signal-cli-${{ steps.version.outputs.version }}-Linux-native.tar.gz
+          asset_content_type: application/x-compressed-tar # .tar.gz

      - name: Upload Linux client archive
        uses: actions/upload-release-asset@v1
@ -152,35 +70,14 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}-Linux-client.tar.gz
-          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}-Linux-client.tar.gz
-          asset_content_type: application/x-compressed-tar  # .tar.gz
-
-#      - name: Upload windows archive
-#        uses: actions/upload-release-asset@v1
-#        env:
-#          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-#        with:
-#          upload_url: ${{ steps.create_release.outputs.upload_url }}
-#          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}-Windows.tar.gz
-#          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}-Windows.tar.gz
-#          asset_content_type: application/x-compressed-tar  # .tar.gz
-#
-#      - name: Upload macos archive
-#        uses: actions/upload-release-asset@v1
-#        env:
-#          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-#        with:
-#          upload_url: ${{ steps.create_release.outputs.upload_url }}
-#          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}-macOS.tar.gz
-#          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}-macOS.tar.gz
-#          asset_content_type: application/x-compressed-tar  # .tar.gz
+          asset_path: signal-cli-${{ steps.version.outputs.version }}-Linux-client.tar.gz
+          asset_name: signal-cli-${{ steps.version.outputs.version }}-Linux-client.tar.gz
+          asset_content_type: application/x-compressed-tar # .tar.gz

  build-container:
-    needs: ci_wf
+    needs: release
    runs-on: ubuntu-latest
    permissions:
-      contents: read
      packages: write

    steps:
@ -188,28 +85,19 @@ jobs:
      - name: Download signal-cli build from CI workflow
        uses: actions/download-artifact@v8

-      - name: Get signal-cli version
-        id: cli_ver
-        run: |
-          ver="${GITHUB_REF_NAME#v}"
-          echo "version=${ver}" >> $GITHUB_OUTPUT
-
      - name: Move archive file
        run: |
-          ARCHIVE_DIR=$(ls signal-cli-archive-*/ -d | tail -n1)
-          tar xf ./"${ARCHIVE_DIR}"/*.tar.gz
-          rm -r signal-cli-archive-* signal-cli-native
+          tar xf ./signal-cli-reproducible-build/signal-cli-${{ needs.release.outputs.version }}.tar.gz
          mkdir -p build/install/
-          mv ./signal-cli-"${GITHUB_REF_NAME#v}"/ build/install/signal-cli
+          mv ./signal-cli-"${{ needs.release.outputs.version }}"/ build/install/signal-cli

      - name: Build Image
        id: build_image
        uses: redhat-actions/buildah-build@v2
        with:
          image: ${{ env.IMAGE_NAME }}
-          tags: latest ${{ github.sha }} ${{ steps.cli_ver.outputs.version }}
-          containerfiles:
-            ./Containerfile
+          tags: latest ${{ github.sha }} ${{ needs.release.outputs.version }}
+          containerfiles: ./Containerfile
          oci: true

      - name: Push To GHCR
@ -227,10 +115,9 @@ jobs:
          echo "${{ toJSON(steps.push.outputs) }}"

  build-container-native:
-    needs: ci_wf
+    needs: release
    runs-on: ubuntu-latest
    permissions:
-      contents: read
      packages: write

    steps:
@ -238,26 +125,20 @@ jobs:
      - name: Download signal-cli build from CI workflow
        uses: actions/download-artifact@v8

-      - name: Get signal-cli version
-        id: cli_ver
-        run: |
-          ver="${GITHUB_REF_NAME#v}"
-          echo "version=${ver}" >> $GITHUB_OUTPUT
-
      - name: Move archive file
        run: |
+          tar xf ./signal-cli-reproducible-build/signal-cli-${{ needs.release.outputs.version }}-Linux-native.tar.gz
          mkdir -p build/native/nativeCompile/
-          chmod +x ./signal-cli-native/signal-cli
-          mv ./signal-cli-native/signal-cli build/native/nativeCompile/
+          mv signal-cli build/native/nativeCompile/
+          chmod +x build/native/nativeCompile/signal-cli

      - name: Build Image
        id: build_image
        uses: redhat-actions/buildah-build@v2
        with:
          image: ${{ env.IMAGE_NAME }}
-          tags: latest-native ${{ github.sha }}-native ${{ steps.cli_ver.outputs.version }}-native
-          containerfiles:
-            ./native.Containerfile
+          tags: latest-native ${{ github.sha }}-native ${{ needs.release.outputs.version }}-native
+          containerfiles: ./native.Containerfile
          oci: true

      - name: Push To GHCR
@ -275,10 +156,9 @@ jobs:
          echo "${{ toJSON(steps.push.outputs) }}"

  build-container-client:
-    needs: ci_wf
+    needs: release
    runs-on: ubuntu-latest
    permissions:
-      contents: read
      packages: write

    steps:
@ -286,26 +166,20 @@ jobs:
      - name: Download signal-cli build from CI workflow
        uses: actions/download-artifact@v8

-      - name: Get signal-cli version
-        id: cli_ver
-        run: |
-          ver="${GITHUB_REF_NAME#v}"
-          echo "version=${ver}" >> $GITHUB_OUTPUT
-
      - name: Move archive file
        run: |
+          tar xf ./signal-cli-reproducible-build/signal-cli-${{ needs.release.outputs.version }}-Linux-client.tar.gz
          mkdir -p client/target/release/
-          chmod +x ./signal-cli-client-ubuntu/signal-cli-client
-          mv ./signal-cli-client-ubuntu/signal-cli-client client/target/release/
+          mv signal-cli-client client/target/release/
+          chmod +x client/target/release/signal-cli-client

      - name: Build Image
        id: build_image
        uses: redhat-actions/buildah-build@v2
        with:
          image: ${{ env.IMAGE_NAME }}
-          tags: latest-client ${{ github.sha }}-client ${{ steps.cli_ver.outputs.version }}-client
-          containerfiles:
-            ./client.Containerfile
+          tags: latest-client ${{ github.sha }}-client ${{ needs.release.outputs.version }}-client
+          containerfiles: ./client.Containerfile
          oci: true

      - name: Push To GHCR
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +1,5 @@
 .gradle/
+.kotlin/
 .idea/*
 !.idea/codeStyles/
 build/
@ -13,3 +14,9 @@ out/
 .DS_Store
 /bin/
 /test-config/
+/dist/
+/github/
+man/*.1
+man/*.5
+man/man1
+man/man5
--- a/man/Makefile
+++ b/man/Makefile
@ -14,8 +14,8 @@ all: $(MANPAGESRC)
 .PHONY: install
 install: all
 	$(MKDIR) -p man1 man5
-	for f in *.1; do $(GZIP) < "$$f" > man1/"$$f".gz ; done
-	for f in *.5; do $(GZIP) < "$$f" > man5/"$$f".gz ; done
+	for f in *.1; do $(GZIP) -n < "$$f" > man1/"$$f".gz ; done
+	for f in *.5; do $(GZIP) -n < "$$f" > man5/"$$f".gz ; done

 .PHONY: clean
 clean:
--- a/reproducible-builds/README.md
+++ b/reproducible-builds/README.md
@ -0,0 +1,34 @@
+# Reproducible builds
+
+This process lets you verify that the version of signal-cli that was downloaded from the Github Releases matches the source code in the public repository.
+
+This is achieved by replicating the build environment as Docker images.
+
+Currently, only the following binaries are reproducible:
+
+- [x] JAR package (`signal-cli-XXX.tar.gz`)
+- [ ] Native binary (`signal-cli-XXX-Linux-native.tar.gz`)
+- [x] Rust client binary (`signal-cli-XXX-Linux-client.tar.gz`)
+
+In the following section, we will use signal-cli version 0.14.2 as the reference example. Simply replace all occurrences of 0.14.2 with the version number you are about to verify.
+
+## Step-by-step instructions
+
+### 0. Prerequisites
+
+Before you begin, ensure you have the following installed:
+
+- git
+- docker (or podman)
+
+### 1. Verifying reproducibility
+
+```bash
+git clone --depth 1 --branch v0.14.2 https://github.com/AsamK/signal-cli
+cd ./signal-cli
+./reproducible-builds/verify.sh
+```
+
+If each one ends with `... matches!` for every binary (except the native one for now), you're good to go! You've successfully verified that the Github Release binaries were built from exactly the same code as is in the signal-cli git repository.
+
+If you get `... doesn't match!`, it means something went wrong (except for the native one for now). Please [open an issue](https://github.com/AsamK/signal-cli/issues/new/choose).
--- a/reproducible-builds/build.Containerfile
+++ b/reproducible-builds/build.Containerfile
@ -0,0 +1,13 @@
+ARG ZULU_TAG="25.0.2-jdk@sha256:9582df6c4415d9c770eb5ff8fce426ebba53631149c9eb083ee126568d32fab3"
+
+FROM docker.io/azul/zulu-openjdk:$ZULU_TAG
+ENV SOURCE_DATE_EPOCH=1767225600
+ENV LANG=C.UTF-8
+ENV LC_CTYPE=en_US.UTF-8
+ARG SNAPSHOT=20260101T000000Z
+RUN echo "deb http://snapshot.ubuntu.com/ubuntu/${SNAPSHOT}/ jammy main" > /etc/apt/sources.list \
+    && echo "deb http://snapshot.ubuntu.com/ubuntu/${SNAPSHOT}/ jammy universe" >> /etc/apt/sources.list
+RUN apt update && apt install -y make asciidoc-base
+COPY --chmod=0700 reproducible-builds/entrypoint.sh /usr/local/bin/entrypoint.sh
+WORKDIR /signal-cli
+ENTRYPOINT [ "/usr/local/bin/entrypoint.sh", "build" ]
--- a/reproducible-builds/build.sh
+++ b/reproducible-builds/build.sh
@ -0,0 +1,50 @@
+#!/bin/bash
+
+set -eu
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/../"
+cd "$ROOT_DIR"
+rm -rf "$ROOT_DIR/dist"
+mkdir -p "$ROOT_DIR/dist"
+
+if command -v podman >/dev/null; then
+	ENGINE=podman
+	USER=
+else
+	ENGINE=docker
+	USER="--user $(id -u):$(id -g)"
+fi
+
+VERSION=$(sed -n 's/\s*version\s*=\s*"\(.*\)".*/\1/p' build.gradle.kts | tail -n1)
+echo "$VERSION" >dist/VERSION
+
+$ENGINE build -t signal-cli:build ${OVERRIDE_JAVA_VERSION:+--build-arg ZULU_TAG=$OVERRIDE_JAVA_VERSION} -f reproducible-builds/build.Containerfile .
+$ENGINE build -t signal-cli:native -f reproducible-builds/native.Containerfile .
+$ENGINE build -t signal-cli:client -f reproducible-builds/client.Containerfile .
+
+# Build jar
+git clean -Xfd -e '!/dist/' -e '!/dist/**' -e '!/github/' -e '!/github/**'
+# shellcheck disable=SC2086
+$ENGINE run --pull=never --rm -v "$(pwd)":/signal-cli:Z -e VERSION="$VERSION" $USER signal-cli:build
+mv build/distributions/signal-cli-*.tar.gz dist/
+
+if [ -n "${OVERRIDE_JAVA_VERSION:-}" ]; then
+	echo -e "\e[33mBuild was performed with overridden Java version $OVERRIDE_JAVA_VERSION, native-image and client will not be built.\e[0m"
+	exit 0
+fi
+
+# Build native-image
+git clean -Xfd -e '!/dist/' -e '!/dist/**' -e '!/github/' -e '!/github/**'
+# shellcheck disable=SC2086
+$ENGINE run --pull=never --rm -v "$(pwd)":/signal-cli:Z -e VERSION="$VERSION" $USER signal-cli:native
+mv build/signal-cli-*-Linux-native.tar.gz dist/
+
+# Build rust client
+git clean -Xfd -e '!/dist/' -e '!/dist/**' -e '!/github/' -e '!/github/**'
+# shellcheck disable=SC2086
+$ENGINE run --pull=never --rm -v "$(pwd)":/signal-cli:Z -e VERSION="$VERSION" $USER signal-cli:client
+mv build/signal-cli-*-Linux-client.tar.gz dist/
+
+ls -lsh dist/
+
+echo -e "\e[32mBuild successful!\e[0m"
--- a/reproducible-builds/client.Containerfile
+++ b/reproducible-builds/client.Containerfile
@ -0,0 +1,7 @@
+FROM docker.io/rust:1.94.1-slim-trixie@sha256:c6a474d7164ea2455e09b60a759b1edca38db7373c5689c1dae31780de4e71ac
+ENV SOURCE_DATE_EPOCH=1767225600
+ENV LANG=C.UTF-8
+ENV LC_CTYPE=en_US.UTF-8
+COPY --chmod=0700 reproducible-builds/entrypoint.sh /usr/local/bin/entrypoint.sh
+WORKDIR /signal-cli
+ENTRYPOINT [ "/usr/local/bin/entrypoint.sh", "client" ]
--- a/reproducible-builds/entrypoint.sh
+++ b/reproducible-builds/entrypoint.sh
@ -0,0 +1,78 @@
+#!/bin/bash
+
+set -eu
+
+echo "Build '$1' variant $VERSION ..."
+
+function reset_file_dates() {
+	find . -exec touch -m -d "@$SOURCE_DATE_EPOCH" {} \;
+}
+
+reset_file_dates
+
+if [ "$1" == "build" ]; then
+
+	./gradlew build \
+		--no-daemon \
+		--max-workers=1 \
+		-Dkotlin.compiler.execution.strategy=in-process \
+		--no-build-cache \
+		-Dorg.gradle.caching=false \
+		-Porg.gradle.java.installations.auto-download=false \
+		-Porg.gradle.java.installations.auto-detect=false
+	cd man
+	make install
+	cd ..
+	tar_archive="build/distributions/signal-cli-${VERSION}.tar"
+	tar --transform="flags=r;s|man|signal-cli-${VERSION}/man|" -rf "$tar_archive" man/man{1,5}
+
+	# Remake the tarball to ensure reproducible file order and timestamps
+	mkdir -p build/extracted
+	tar -xf "$tar_archive" -C build/extracted/
+	reset_file_dates
+	rm -f "$tar_archive"
+	tar --sort=name --mtime="@$SOURCE_DATE_EPOCH" --transform='s|^\./||' --owner=0 --group=0 --numeric-owner -cf "$tar_archive" -C build/extracted .
+
+	gzip -n -9 "$tar_archive"
+
+elif [ "$1" == "native" ]; then
+
+	./gradlew nativeCompile \
+		--no-daemon \
+		--max-workers=1 \
+		-Dkotlin.compiler.execution.strategy=in-process \
+		--no-build-cache \
+		-Dorg.gradle.caching=false \
+		-Dgraalvm.native-image.build-time=2026-01-01T00:00:00Z \
+		-Porg.gradle.java.installations.auto-download=false \
+		-Porg.gradle.java.installations.auto-detect=false
+
+	strip --strip-all \
+		--remove-section=.note.gnu.build-id \
+		--remove-section=.comment \
+		--remove-section=.gnu_debuglink \
+		--remove-section=.annobin.notes \
+		--remove-section=.gnu.build.attributes \
+		--remove-section=.note.ABI-tag \
+		build/native/nativeCompile/signal-cli
+
+	chmod +x build/native/nativeCompile/signal-cli
+	reset_file_dates
+	tar --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=0 --group=0 --numeric-owner -cf "build/signal-cli-${VERSION}-Linux-native.tar" -C build/native/nativeCompile signal-cli
+	gzip -n -9 "build/signal-cli-${VERSION}-Linux-native.tar"
+
+elif [ "$1" == "client" ]; then
+
+	cd client
+	cargo build --release --locked
+	cd ..
+	chmod +x client/target/release/signal-cli-client
+	mkdir -p build
+	reset_file_dates
+	tar --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=0 --group=0 --numeric-owner -cf "build/signal-cli-${VERSION}-Linux-client.tar" -C client/target/release signal-cli-client
+	gzip -n -9 "build/signal-cli-${VERSION}-Linux-client.tar"
+
+else
+	echo "Unknown build variant '$1'"
+	exit 1
+fi
--- a/reproducible-builds/native.Containerfile
+++ b/reproducible-builds/native.Containerfile
@ -0,0 +1,7 @@
+FROM container-registry.oracle.com/graalvm/native-image:25.0.2@sha256:4c0d5919f6840d89721274eb8cf81962faa2f870b816967e6732e2a151b150d8
+ENV SOURCE_DATE_EPOCH=1767225600
+ENV LANG=C.UTF-8
+ENV LC_CTYPE=en_US.UTF-8
+COPY --chmod=0700 reproducible-builds/entrypoint.sh /usr/local/bin/entrypoint.sh
+WORKDIR /signal-cli
+ENTRYPOINT [ "/usr/local/bin/entrypoint.sh", "native" ]
--- a/reproducible-builds/verify.sh
+++ b/reproducible-builds/verify.sh
@ -0,0 +1,44 @@
+#!/bin/bash
+
+set -eu
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/../"
+cd "$ROOT_DIR"
+rm -rf "$ROOT_DIR/github"
+mkdir -p "$ROOT_DIR/github"
+
+VERSION=$(sed -n 's/\s*version\s*=\s*"\(.*\)".*/\1/p' build.gradle.kts | tail -n1)
+
+echo "Download latest release from GitHub..."
+
+curl -L --fail "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}.tar.gz" -o "github/signal-cli-${VERSION}.tar.gz"
+curl -L --fail "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}-Linux-native.tar.gz" -o "github/signal-cli-${VERSION}-Linux-native.tar.gz"
+curl -L --fail "https://github.com/AsamK/signal-cli/releases/download/v${VERSION}/signal-cli-${VERSION}-Linux-client.tar.gz" -o "github/signal-cli-${VERSION}-Linux-client.tar.gz"
+
+./reproducible-builds/build.sh
+
+rm -f {github,dist}/VERSION
+
+echo "commit: $(git rev-parse HEAD)"
+
+echo "sha256 hashes of GitHub release:"
+sha256sum github/*
+echo "sha256 hashes of locally built files:"
+sha256sum dist/*
+
+reproducible=true
+for file in $(cd github && find . -type f); do
+	if diff "github/$file" "dist/$file" >/dev/null 2>&1; then
+		echo -e "\e[32m[+] '$(basename "$file")' matches!\e[0m"
+	elif [[ "$file" =~ "native" ]]; then
+		echo -e "\e[33m[-] '$(basename "$file")' doesn't match! (not supported yet)\e[0m"
+		reproducible=false
+	else
+		echo -e "\e[31m[-] '$(basename "$file")' doesn't match!\e[0m"
+		reproducible=false
+	fi
+done
+
+if [ "$reproducible" = false ]; then
+	exit 1
+fi