News for hackers. Stuff that matters.

A comment on Trust is good, control is better: Reproducible builds at F-Droid. Parent comment

Re:Trust is good, control is better: Reproducible builds at ... by ardani on Saturday July 20, 2019 @04:39PM (#20488231)
Let me get this straight, this does not involve handing private keys to F-Droid? The app is verified reproducible minus the signature?

AFAIK it should work that way but I couldn't tell from the diagram and skimming the text.

[ Parent | on HN ]
Re:Trust is good, control is better: Reproducible builds at ... by Boulth on Sunday July 21, 2019 @03:05AM (#20490292)
Yes, F Droid builds it itself. Then compares with your build minus the signature. If it's the same it publishes with your signature. No need for any private key handling.
[ Parent | on HN ]