15 ms·
>these reproducible builds apps run a high risk of being signed with the same key that Google has That's a great point. Someone should submit a request to add
by Vt71fcAqt7 3y ago
>these reproducible builds apps run a high risk of being signed with the same key that Google has
That's a great point. Someone should submit a request to add language to their docs[0] letting developers know about that if it doesn't exist already. I breifly looked through that page just now and didn't see it pointed out explicitly. There should also be a way to let users know.
[0] https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
- g-b-r 3y agoAbout the fact that Google could have the signing key, you mean? Yeah I haven't followed much F-Droid lately, I wonder if they ever realized that... I think that the project never settled on a specific security model, to be honest, and the current one is mostly the result of happenstance. And I don't know what will happen to F-Droid now that some of the most important people left.