3 ms·
F-droid is a blessing and a curse. Many devs experience this 'F-droid catching up with releases' due to the manual signing process. The userbase is always confu
by vanous 5y ago
F-droid is a blessing and a curse. Many devs experience this 'F-droid catching up with releases' due to the manual signing process. The userbase is always confused about that. Reproducible builds are claimed to be the possible solution but almost nobody is doing that due to the complex setup.
- smichel17 5y agoAre reproducible builds the solution? Seems like the fdroid folks would still have to build ("reproduce") the apk to verify that it matches the one provided by the developer. Then they'd sign it and distribute the double-signed apk. I was under the impression that reproducible builds guard against the "fdroid build servers got compromised" attack vector, (or "developer got compromised", as compared to dev-signed releases) and nothing else.
- danhor 5y agoMy understanding is that the level of trust toward the build server can change. Currently, most things are signed by F-Droid, so distributed building is harder. But later less trusted servers could build the apps and check, leading to a consensus system.