I can understand that he sets his own priorities. But in this case someone else took the sourcecode, built the app and published it to F-Droid.
The only thing Moxie had to do was not threaten them with legal action.
The only thing Moxie had to do was not threaten them with legal action.
Instead, to publish an app there, you need to provide source code repository [2], and their build farm would build it, sort-of [3] providing guarantee that source code you can inspect is the same one you got running on your phone.
[1] There are exceptions, i.e. apps uploaded as binary-only (for example Firefox), but those come with big red warning that user sees before installing them.
[2] https://f-droid.org/wiki/page/FAQ_-_App_Developers#Will_my_a...
[3] Sort-of because reproducible builds for Android not here yet, so you can't just rebuilt it yourself and compare sha256, unfortunately.
Which you do anyway if you use Google Play Services.
...
(So the compromise of F-Droid that results in a signed, compromised binary can't happen on Google Play, the apk is signed before it is sent to the store)
You can sign with your own key on F-Droid, too – if you use their way of dealing with reproducible builds.