4 ms·

Cool. But neither the audit nor the repository explains if it's possible to create the APK in a reproducible way. Google Play distributed APKs contain their sig

Cool. But neither the audit nor the repository explains if it's possible to create the APK in a reproducible way. Google Play distributed APKs contain their signatures, so in theory it wouldn't be possible to 1:1 reproduce the distributed ones. However for F-droid this would allow them to sign their own APKs and provide some additional security guarantees in their supply chain. Also a bit concerning that there is no tags yet in the repository.

McDev 6y ago
You can still upload the app with your signing key. But it's also true that Google now push developers to leave the APK signing process to them
WrtCdEvrydy 6y ago
You could try stripping the Google Play signatures... and just doing a hash check against an existing version you build yourself.
- Foxboron 6y ago
  You would need to repack the .APK, which would be a hurdle in the comparison.
  - jraph 6y ago
    Maybe you could compare the list of files and files in the APKs instead of comparing the APKs themselves?
gruez 6y ago
>Google Play distributed APKs contain their signatures https://support.google.com/googleplay/android-developer/answer/7384423?hl=en https://support.google.com/googleplay/android-developer/answ... >Note: Using app signing by Google Play is optional. You can still upload an APK and manage your own keys instead of using an app bundle
- Foxboron 6y ago
  That is not really the point. The signatures are embedded in the APK. Repacking it to remove, or add valid signatures, would be a problem.