3 ms·
Only for reproducible builds, a lot of work has been done to encourage and facilitate them in the last years, but they're still a minority of the apps. By the
by g-b-r 3y ago
Only for reproducible builds, a lot of work has been done to encourage and facilitate them in the last years, but they're still a minority of the apps.
By the way, these reproducible builds apps run a high risk of being signed with the same key that Google has
- Vt71fcAqt7 3y ago>these reproducible builds apps run a high risk of being signed with the same key that Google has That's a great point. Someone should submit a request to add language to their docs[0] letting developers know about that if it doesn't exist already. I breifly looked through that page just now and didn't see it pointed out explicitly. There should also be a way to let users know. [0] https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
- g-b-r 3y agoAbout the fact that Google could have the signing key, you mean? Yeah I haven't followed much F-Droid lately, I wonder if they ever realized that... I think that the project never settled on a specific security model, to be honest, and the current one is mostly the result of happenstance. And I don't know what will happen to F-Droid now that some of the most important people left.