3 ms·
Which means I have to trust them to do that verification correctly. Which is the whole problem with them signing the APKs in the first place. On edit: What I m
by Hizonner 4y ago
Which means I have to trust them to do that verification correctly. Which is the whole problem with them signing the APKs in the first place.
On edit: What I meant by "unless something is checking" was that something independent had to be checking. Thought that was obvious.
- notpushkin 4y agoIn this scheme, they don't sign the APKs – the developer does. They just verify that the APK corresponds to the source code. I don't think there's any point in adding an independent auditing thing to this – is three pairs of (automated) eyes that better than two? But of course you can do that, the tooling for verifying it is open source. (Of course, all of that doesn't work if the app doesn't support reproducible building, which is the majority of apps on F-Droid now – hence this post calling for a change)
- Hizonner 4y agoOK, if that's the case I retract everything and apologize. I must have misread it. Thank you.