Hacker News Reader

F-droid is a blessing and a curse. Many devs experience this 'F-droid catching up with releases' due to the manual signing process. The userbase is always confused about that. Reproducible builds are claimed to be the possible solution but almost nobody is doing that due to the complex setup.

View on HN

Are reproducible builds the solution? Seems like the fdroid folks would still have to build ("reproduce") the apk to verify that it matches the one provided by the developer. Then they'd sign it and distribute the double-signed apk.

I was under the impression that reproducible builds guard against the "fdroid build servers got compromised" attack vector, (or "developer got compromised", as compared to dev-signed releases) and nothing else.

My understanding is that the level of trust toward the build server can change.

Currently, most things are signed by F-Droid, so distributed building is harder. But later less trusted servers could build the apps and check, leading to a consensus system.

Reply on news.ycombinator.com