Signal Desktop Builder For Debian:trixie-arm64

signal-desktop_7.68.0_arm64.deb

This project reproducibly builds Signal Desktop for Debian:trixie-arm64, currently targeting tag 7.68.x

Now with an optional update client: auto-update-cron.sh

This is the latest release: builds/release/signal-desktop_7.68.0_arm64.deb

Sha512Sum: Results/release.sha512sum

Full chain/(“Full Scope”) SBOMs and Attestations

Firmware SBOM’s: U-Boot:/Results

System SBOM: Results/ubuntu.spdx.json

• Grype Scan: Results/ubuntu.grype.status(https://github.com/0mniteck/Signal-Desktop-Reproducible/blob/708b3a5e538546e7c23cd26c5fa3d1260ce7d42d/Results/ubuntu.grype.status#L1-L3)

Docker SBOM: Results/signal.spdx.json

• Grype Scan: Results/signal.grype.status(https://github.com/0mniteck/Signal-Desktop-Reproducible/blob/71cac5a24f2abf71af5fdefb0b08cea8a391b91d/Results/signal.grype.status#L1-L3)

0mniteck’s Current GPG Key ID: 287EE837E6ED2DD3

^{*Vigilant Mode is on for this repo so all remote pushes/tags should be signed with a verified key.}

Build Instructions/Usage:

Usage:

Installation:

1. Download the .deb to your device
2. verify the sha512sum [Current sha512sum] (https://github.com/0mniteck/Signal-Desktop-Reproducible/blob/708b3a5e538546e7c23cd26c5fa3d1260ce7d42d/Results/release.sha512sum#L2)
   • sha512sum signal-desktop_7.68.0_arm64.deb
3. install:
   • pkexec apt install ./signal-desktop_7.68.0_arm64.deb

Optional Installer/Updater:

Install updater auto-update-cron.sh by running:

sudo su && \
curl -sSL https://raw.githubusercontent.com/0mniteck/Signal-Desktop-Reproducible/master/auto-update-cron.sh | bash

Build:

buildscript.sh:

• -c {Cross Compile: Yes/no}
• -d {Date: Source_date_epoch/today}
• -i {Increment: .version}
• -m {Mount Luks partition: mmcblk1p1}
• -p {Push-branch: branch}
• -r {Release-tag: tagname}
• -t {run-Tests: yes/No}

A. First build and push the upcoming branch:

git clone --depth 1 https://github.com/$REPO/Signal-Desktop-Reproducible.git && \
cd Signal-Desktop-Reproducible && \
./buildscript.sh -i'.01' -p'8.x.x' -d'today'

---

B. Then rebuild the current branch and release:

git clone --depth 1 git@github.com:$REPO/Signal-Desktop-Reproducible.git -b 8.x.x && \
cd Signal-Desktop-Reproducible && \
./buildscript.sh -p'main' -r'8.x.0'

---

C. To build a past release (8.0.0+) for reproducibility:

git clone --depth 1 git@github.com:0mniteck/Signal-Desktop-Reproducible.git -b 8.x.x && \
cd Signal-Desktop-Reproducible && \
./buildscript.sh

Current Status:‎‎‏‏‎‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ _{^{signalapp/Signal-Desktop}}

WIP

• Built with 0mniteck/debian-slim:02-18-2026
• Signal Desktop builds - preparing for v8.x.x
• Base image builds and pushes to Docker Hub
• Rootless builds
• CC’d base images available for amd64
• Zero CVE build environment
• Auto-Update script
• Reproducible builds
• Generate/Scan/Attest SBOM at buildtime

Release Cycle:

Currently building upstream releases twice to improve reproducibility/reliability:

build/release to branch 8.x.x –> test on hardware, document, pull request –> build/release to main branch

See also:

• The Sovereignty Ephemerality Reproducibility (SER) framework
• https://snapshot.debian.org
• https://hub.docker.com/_/debian/tags
• https://hub.docker.com/r/0mniteck/tags
• https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md
• https://github.com/signalapp/Signal-Desktop/blob/development/CONTRIBUTING.md