4 ms·
> unless something is actually checking that what's "reproduced" is the same as what the original developer originally produced They do. The way it works is,
by notpushkin 4y ago
> unless something is actually checking that what's "reproduced" is the same as what the original developer originally produced
They do.
The way it works is, developer builds and signs the APK and sends it to F-Droid. F-Droid then builds the app from source again, and if it gets the same APK, it publishes the one with the developer's signature.
- Hizonner 4y agoWhich means I have to trust them to do that verification correctly. Which is the whole problem with them signing the APKs in the first place. On edit: What I meant by "unless something is checking" was that something independent had to be checking. Thought that was obvious.
- notpushkin 4y agoIn this scheme, they don't sign the APKs – the developer does. They just verify that the APK corresponds to the source code. I don't think there's any point in adding an independent auditing thing to this – is three pairs of (automated) eyes that better than two? But of course you can do that, the tooling for verifying it is open source. (Of course, all of that doesn't work if the app doesn't support reproducible building, which is the majority of apps on F-Droid now – hence this post calling for a change)
- Hizonner 4y agoOK, if that's the case I retract everything and apologize. I must have misread it. Thank you.