News for hackers. Stuff that matters.

A comment on Trust is good, control is better: Reproducible builds at F-Droid. Parent comment

Re:Trust is good, control is better: Reproducible builds at ... by akerl_ on Saturday July 20, 2019 @01:10PM (#20486979)
It’s not really a matter of “trying”. Signal’s issue has always been that regardless of reproducible builds, the packages served by F-Droid are signed by F-Droid, not the developer (Signal, in this example). I’m not sure what they could do on their end to change that practice from F-Droid.
[ Parent | on HN ]
Re:Trust is good, control is better: Reproducible builds at ... by jacoblambda on Saturday July 20, 2019 @01:31PM (#20487120)
F-droid has a method for serving upstream signed APKs along with F-droid signed APKs as well as a method for exclusively serving upstream signed APKs.
[ Parent | on HN ]
Re:Trust is good, control is better: Reproducible builds at ... by akerl_ on Saturday July 20, 2019 @01:43PM (#20487193)
Interesting; TIL. Do you happen to have a link handy for the docs on setting that up?
[ Parent | on HN ]
Re:Trust is good, control is better: Reproducible builds at ... by ardani on Saturday July 20, 2019 @04:40PM (#20488234)
A nephew comment posted the docs:

https://f-droid.org/en/docs/Reproducible_Builds/

[ Parent | on HN ]