News for hackers. Stuff that matters.

A comment on KDE Connect removed from Google Play store for violating new policy on SMS. Parent comment

Re:KDE Connect removed from Google Play store for violating ... by Iolaum on Tuesday March 19, 2019 @06:27AM (#19429549)
Fdroid maintainers require shipped apk's to have 0 non-free components. The only way to ensure that is to build the apps themselves (so that they can verify code and control dependencies). This means that they can only use their own keys.
[ Parent | on HN ]
Re:KDE Connect removed from Google Play store for violating ... by levosmetalo on Tuesday March 19, 2019 @06:44AM (#19429629)
Debian is also signing all Debian packages with in their own repositories with their own keys, and nobody takes this as an issue.
[ Parent | on HN ]
Re:KDE Connect removed from Google Play store for violating ... by Arnt on Tuesday March 19, 2019 @08:16AM (#19430068)
No it doesn't. They could check the developer's signature against an APK built from source. It's not that difficult.

BTW. In my case the app they urged me to replace the stock keyboard with a version that had been built without support for Norwegian. Is the language data in Android non-free?

[ Parent | on HN ]
Re:KDE Connect removed from Google Play store for violating ... by kuschku on Tuesday March 19, 2019 @08:19AM (#19430084)
They can, and they offer that, if the developer supports reproducible builds.

Most apps aren’t possible to be built reproducibly, though, as the Android developer toolkit was never designed for reproducible builds and relies on stuff like filesystem ordering of files (which differs between machines).

[ Parent | on HN ]
Re:KDE Connect removed from Google Play store for violating ... by kuschku on Tuesday March 19, 2019 @08:18AM (#19430074)
You’re even able to ship your own builds signed with your own developer key on F-Droid if F-Droid is able to build the exact same APK themselves.

Reproducible builds are the best option for such a store :)

[ Parent | on HN ]