3 ms·

I also heavily heavily hate the idea that they sign everything, the app stores must not be trusted. They should only be signing over packages already reproducib

I also heavily heavily hate the idea that they sign everything, the app stores must not be trusted. They should only be signing over packages already reproducibly compiled.

ubercow13 8y ago
Why? Isn't that how signatures of any Linux distro work too? The packager signs the package not the developer.
- Avamander 8y ago
  Because they force users to trust them unnecessarily.
opencl 8y ago
What are you expecting them to do, not host non-reproducible builds at all? Android will not run unsigned apps. This would result in F-Droid having exactly 3 apps. They're working on getting more reproducible builds but the build system is not exactly great for it.
- Avamander 8y ago
  > What are you expecting them to do, not host non-reproducible builds at all? Yes.
  - opencl 8y ago
    Well you can start your own F-Droid repo only hosting reproducible builds and build them yourself. It is a very large amount of work which is why it's happening so slowly.