Documentation on how to build from source

[hugoender]

What would you like to add or change?:

Please add documentation on how to build Portmaster from source. One of the selling points of Portmaster over the competition is that it's open source and can't be built from source (don't trust, verify). However, there's no documentation on how to go about doing this.

Why do you and others need this?:

For a program this powerful that has this much control over your system, building from source is a must as there is no guarantee that the files downloaded from the Safing website match what's publicly available in the Github repo.

[github-actions]

Greetings and welcome to our community! As this is the first issue you opened here, we wanted to share some useful infos with you:

• 🗣️ Our community on Discord is super helpful and active. We also have an AI-enabled support bot that knows Portmaster well and can give you immediate help.
• 📖 The Wiki answers all common questions and has many important details. If you can't find an answer there, let us know, so we can add anything that's missing.

[dhaavi]

Repos have a ./pack script at the root to build everything. 👌

If you want to build for Windows, the kernel extensions is a bit more tricky and also requires an EV cert to sign and install.

[dhaavi]

Also, reproducible builds in Go is quite new, and we haven't optimized anything yet for reproducible builds - if that is what you are trying to do.

[hugoender]

Repos have a ./pack script at the root to build everything. 👌

If you want to build for Windows, the kernel extensions is a bit more tricky and also requires an EV cert to sign and install.

I do want to build for Windows and seeing as though Windows is the most popular OS, it would make sense to create some documentation outlining how to build for it.

[hugoender]

Also, reproducible builds in Go is quite new, and we haven't optimized anything yet for reproducible builds - if that is what you are trying to do.

I don't really care too much about reproducible builds. They're nice to have in order for third parties to verify the binaries available for download from the site but for now, the first step would be just to be able to build from source for Windows even if it's not reproducible.

In my opinion, if a privacy/security program such as Portmaster does not have documentation outlining how to build from source, then it has no business calling itself "open-source" since there is no way for a privacy/security conscious user to be able to verify that what they are installing is indeed what is in the repo.

[Raphty]

I can assure you that individuals with the necessary expertise can successfully compile Portmaster. I'm aware that several distributions have begun packaging Portmaster, which, at times, can complicate support ticket management. Nevertheless, I believe the documentation adequately addresses its intended audience and proves effective in the scenarios where it is needed.

[hugoender]

I am sorry but there seems to be a misunderstanding, if you want to verify what we are distributing you would need reproducible builds... other wise you would just compile it for yourself and could not verify anything.

You've misunderstood me. I do not want to verify what Safing is distributing on the website. I want to build from source so that I know for sure that what I am installing/running is truly what exists in the Github repo and has been audited by others.

and I can assure you people can build Portmaster with the information provided.

Obviously there must be some people somewhere that have the knowledge to build Portmaster from source without any guide including people on the Safing team. So why not create documentation on the process?

As you are saying Portmaster is an advanced piece of software and only people who know what they are doing should start compiling it themselves.

So essentially what you are saying is that Safing is taking the stance that unless you know how to build from source without a guide, you're not worthy of doing so and have to trust Safing. That is a very pompous stance. I'm glad you've clarified that.

I've compiled plenty of truly open-source software from source using documentation provided from the developers without issue. But I guess in your eyes (and by extension Safing's), that's not knowledgeable enough and I have no business building from source.

I will now be removing Portmaster from my computers and cancelling my subscription. I've been a supporter since you guys first started and @Raphty 's comment confirmed what I suspected when his partner left the company. Good bye.

[Raphty]

For anyone reading this if you're thinking about embarking on the task of compiling Portmaster, we highly encourage you to document your process and share your findings. Documentation often represents a significant challenge in many open-source projects. Therefore, if you notice gaps or areas for improvement and you're passionate about the project, we urge you to contribute rather than merely requesting additional features or information. Your active involvement and contributions can make a substantial difference.