Snap: large differences between published and self-built version

[george-hopkins]

In the light of CVE-2024-3094 I took a closer look at the distributed Snap (v.1.12.3/revision 31). I do not want to spread any unfounded accusations or leap to any conclusions. However, there are some large differences if the Snap is built from the source (d20de4da0af5195c34ff05d7906e6bb238d854a7):

resources/app.asar left: expected/source, right: distributed

package.json left: expected/source, right: distributed

The build process is fragile and I do not expect it to be reproducible bit-by-bit. Are there any plans to reduce the amount of differences or plans to automate the publishing process?

[Its-treason]

Hey @george-hopkins, the Build published by Anoop on the Snap-Store, GitHub Release etc. includes the proprietary code for the "Golden Edition". That's why there are more files/file changes in the Final build. Because the Code is not Open Source, it is very unlucky to get any reproducibly builds.