Trust is good, control is better: Reproducible builds at F-Droid

Re:Trust is good, control is better: Reproducible builds at ... by Boulth on Saturday July 20, 2019 @01:11PM (#20486985)

> they don't want to publish on F-Droid at this time precisely because it wouldn't be signed by their own key

Actually developers can sign with their own key if the build is reproducible (in an FDroid build system) and F-Droid would have no issues with distributing this app.

See the diagram here: https://f-droid.org/en/docs/Reproducible_Builds/

[ Parent | on HN ]

Re:Trust is good, control is better: Reproducible builds at ... by ardani on Saturday July 20, 2019 @04:39PM (#20488231)

Let me get this straight, this does not involve handing private keys to F-Droid? The app is verified reproducible minus the signature?

AFAIK it should work that way but I couldn't tell from the diagram and skimming the text.

[ Parent | on HN ]

Re:Trust is good, control is better: Reproducible builds at ... by Boulth on Sunday July 21, 2019 @03:05AM (#20490292)

Yes, F Droid builds it itself. Then compares with your build minus the signature. If it's the same it publishes with your signature. No need for any private key handling.

[ Parent | on HN ]