Binary hash verification

[mythofechelon]

Summary

I'm trying to manually build the icloudpd Windows binary to verify that published binary matches the source.

Context

Trying to follow the instructions, I've basically run the following commands: sudo apt-get update sudo apt -y upgrade python3 -V. This outputted Python 3.10.12. sudo apt install python3-pip

wget https://github.com/icloud-photos-downloader/icloud_photos_downloader/archive/refs/tags/v1.15.1.zip unzip v1.15.1.zip

set -euo pipefail python3 -m pip install -r /home/vboxuser/icloud_photos_downloader-1.15.1/requirements-pip.txt pip3 install -e .[test,dev]

/home/vboxuser/.local/bin/pyinstaller --collect-all keyrings.alt --hidden-import pkgutil --collect-all tzdata --onefile /home/vboxuser/icloud_photos_downloader-1.15.1/src/starters/icloudpd.py /home/vboxuser/icloud_photos_downloader-1.15.1/src/starters/icloud.py --name icloudpd-1.15.1-windows-amd64.exe

md5sum /home/vboxuser/dist/icloudpd-1.15.1-windows-amd64.exe. This outputted 6e7ae67fa99e912498189cda27b352a.

However, on Windows, downloading https://github.com/icloud-photos-downloader/icloud_photos_downloader/releases/download/v1.15.1/icloudpd-1.15.1-windows-amd64.exe and running Get-FileHash -Algorithm MD5 icloudpd-1.15.1-windows-amd64.exe outputs 300A03EFA68157280B3CE38061790F61.

Am I doing something wrong?

[AndreyNikiforov]

I follow Release guide for publishing new versions - everything is built and published through Github actions, so you can follow them for exact commands.

Notes:

• pyinstaller that we use for preparing binaries does not support cross compiling, so to prepare windows binaries, you have to run it on windows platform
• python dependencies are defined as ranges, so there is a chance subsequent build produces different binary

What is your goal with binary verification? (==What do you want to verify)

[mythofechelon]

Thanks, @AndreyNikiforov. I basically tried doing the same thing on Windows with Python 3.11.4 and pip-23.2.1, but I still got a different MD5 hash (300A03EFA68157280B3CE38061790F61), probably due to the dependency ranges you mentioned.

A question was put to me on the security of the code in the pre-compiled binaries, and I guess the best way to know that is to review the source, compile it, and compare the hash values.

[AndreyNikiforov]

I am pinning direct dependencies in next PR, but that will not affect indirect dependencies, so there is still a chance for dependencies drift.

Please keep this task update with your progress and conclusions.