5 ms·
> they don't want to publish on F-Droid at this time precisely because it wouldn't be signed by their own key Actually developers can sign with their own key i
by Boulth 7y ago
> they don't want to publish on F-Droid at this time precisely because it wouldn't be signed by their own key
Actually developers can sign with their own key if the build is reproducible (in an FDroid build system) and F-Droid would have no issues with distributing this app.
See the diagram here: https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
- ardani 7y agoLet me get this straight, this does not involve handing private keys to F-Droid? The app is verified reproducible minus the signature? AFAIK it should work that way but I couldn't tell from the diagram and skimming the text.
- Boulth 7y agoYes, F Droid builds it itself. Then compares with your build minus the signature. If it's the same it publishes with your signature. No need for any private key handling.