4 ms·
Fdroid maintainers require shipped apk's to have 0 non-free components. The only way to ensure that is to build the apps themselves (so that they can verify cod
by Iolaum 8y ago
Fdroid maintainers require shipped apk's to have 0 non-free components. The only way to ensure that is to build the apps themselves (so that they can verify code and control dependencies). This means that they can only use their own keys.
- levosmetalo 8y agoDebian is also signing all Debian packages with in their own repositories with their own keys, and nobody takes this as an issue.
- Arnt 8y agoNo it doesn't. They could check the developer's signature against an APK built from source. It's not that difficult. BTW. In my case the app they urged me to replace the stock keyboard with a version that had been built without support for Norwegian. Is the language data in Android non-free?
- kuschku 8y agoThey can, and they offer that, if the developer supports reproducible builds. Most apps aren’t possible to be built reproducibly, though, as the Android developer toolkit was never designed for reproducible builds and relies on stuff like filesystem ordering of files (which differs between machines).
- kuschku 8y agoYou’re even able to ship your own builds signed with your own developer key on F-Droid if F-Droid is able to build the exact same APK themselves. Reproducible builds are the best option for such a store :)