Signal-iOS: the build chain the README never explains

The README points to BUILDING.md instead of listing a build path

This is a Swift iOS app distributed through the App Store, but its README never gives a build recipe. It states that instructions for configuring the development environment and building Signal iOS live in BUILDING.md, and that contributors should also read CONTRIBUTING.md. What the repository root actually contains is the evidence: Signal.xcodeproj, Signal.xcworkspace, a Podfile and Podfile.lock, a Gemfile and Gemfile.lock, a .ruby-version, a .xcode-version, .swiftformat, .clang-format, and a Pods directory that is its own git submodule alongside MAINTAINING.md and SECURITY.md. A clone of the top repository alone contains no dependency tree, so the dependency setup runs through the `make dependencies` Makefile target.

make dependencies fans out into pod setup, backup tests, and RingRTC

The Makefile sets SCHEME=Signal, PODS=Pods, and BACKUP_TESTS=SignalServiceKit/tests/MessageBackup/Signal-Message-Backup-Tests, then defines dependencies as pod-setup followed by backup-tests-setup and fetch-ringrtc. No xcodebuild invocation appears anywhere in it, so compilation still happens inside Xcode against Signal.xcworkspace, and release plumbing is left to the separate fastlane, ci_scripts, and Scripts directories rather than to this file. Note the ordering inside pod-setup: the Pods checkout is wiped and hard-reset before the submodules are updated, which discards any local edits a developer made inside that directory. Verbatim, pod-setup runs:

git -C ${PODS} clean -xfd
git -C ${PODS} reset --hard
./Scripts/setup_private_pods
git submodule update --init --progress ${PODS}

backup-tests-setup runs:

git submodule update --init --progress ${BACKUP_TESTS}

and fetch-ringrtc runs:

$(CURDIR)/Pods/SignalRingRTC/bin/set-up-for-cocoapods

setup_private_pods runs with no documented pod source or credential

The call to `./Scripts/setup_private_pods` sits between the hard reset of Pods and the submodule update in pod-setup. The README does not say what the script does, so read Scripts/setup_private_pods and BUILDING.md before running it. For troubleshooting, the README directs people to the support center at support.signal.org and the unofficial community forum at community.signalusers.org.

No analytics and no telemetry makes your own words the only crash report

The project states that Signal iOS collects no analytics or telemetry, and that it relies on your feedback to help troubleshoot and fix problems when something is not working correctly. That is a privacy decision with an operational cost, and the cost lands on the person holding the phone. The app cannot hand a crash signature or a usage breadcrumb back to maintainers on its own, so a misbehaving install has to be described in prose by whoever hit the problem, and the quality of that report is entirely in the reporter's hands. The README points to support.signal.org for bug reports and support requests, and separately offers a community forum at community.signalusers.org, which it labels unofficial rather than a supported channel.

A MessageBackup test suite exists with no backup or transfer documentation

BACKUP_TESTS resolves to SignalServiceKit/tests/MessageBackup/Signal-Message-Backup-Tests, and backup-tests-setup initializes that submodule, which places message backup inside the tested surface of the project rather than in a future bucket. The README does not explain how a backup is produced, where it is kept, how it is restored, or what happens to it when an iPhone is replaced or when someone moves to an Android handset. Linked devices are not described either, so a reader gets no statement of what a multi-device setup requires or how a second device is authorized. The consequence is concrete: a migration plan cannot be assembled from this README, and the support center plus the unofficial forum are the only named paths to those answers.

ECCN 5D002.C.1 and the TSU exception govern who may build this

The README carries a cryptography notice saying that the country in which you currently reside may place restrictions on the import, possession, use, and re-export of encryption software, and asking you to check your own laws before using any encryption software at all. It records the U.S. Department of Commerce Bureau of Industry and Security classification as Export Commodity Control Number 5D002.C.1, described as information security software that uses or performs cryptographic functions with asymmetric algorithms. It also states that the form of the distribution is eligible for export under the License Exception ENC Technology Software Unrestricted exception, cited to Section 740.13 of the BIS Export Administration Regulations, for both object code and source code. Building and moving this code across a border is a legal question here, not just a technical one.

Android and Desktop live in separate repositories with no shared contract

The README names signalapp/signal-android and signalapp/signal-desktop as the companion builds, each its own repository, and this repository covers the iPhone only. No statement anywhere describes which features track across the three, so a reader asking whether an iPhone capability exists on Android, or how far Desktop has diverged, has to visit those repositories directly. The iOS release cadence is visible in the tag numbers: 8.35.1.1964 on 2026-11-02, 8.35.0.1954 on 2026-10-28, and 8.34.0.1942 on 2026-10-22, with the most recent push landing 2026-11-02. Treat this tree as authoritative for iOS behavior alone, and treat any cross-platform claim as unverified until checked at the source.

Editorial conclusion

Use this repository if you are shipping the iPhone build or auditing what the app does at rest, since the source is complete and the last push landed 2026-11-02. Skip it if you want installation help, migration answers, or a feature comparison, because none of those exist here. Before you start, open BUILDING.md, find out where the private pods come from, and confirm your own country's rules on encryption software.

Frequently asked questions

Official sources

1. License: AGPL-3.0
2. Project website
3. README
4. Releases
5. signalapp/Signal-iOS on GitHub