Saying the code is open means nothing if you cannot confirm the app you installed was built from it. So we publish the source and make the build reproducible.
Why open source
A social app that asks you to trust its privacy must let you audit that privacy. Closed code is a promise. Open code is evidence. Anyone can read the protocol, find a flaw, and report it, which makes the whole system stronger.
How to verify
The published release artifact is built from the tagged source in a fixed environment. Reproduce it yourself with the same tag and compare the hashes.
git clone https://lightspeedmedia.org/code light-speed
cd light-speed
git checkout v1.0.0
./scripts/repro-build.sh
sha256sum dist/app.binIf your hash matches the one published alongside the release, the binary you run is the binary we built from the code you can read. If they differ, stop and tell us.
Reproducible builds turn trust into arithmetic. Either the numbers match, or they do not.
That is the standard we hold ourselves to, and the standard we invite you to hold us to as well.