F-Droid build servers can't build modern Android apps due to outdated CPUs

Re:F-Droid build servers can't build modern Android apps due... by WesolyKubeczek on Wednesday August 13, 2025 @05:58AM (#44886516)

Either they want to run on ideologically pure hardware too, without pesky management bits in it (or even indeed UEFI), or they are just "it used to work perfectly" guys.

In the former case, I fail to see how ME or its absence is relevant to building Android apps, which they do using Google-provided binaries that have even more opportunity to inject naughty bits into the software. In the latter case, I better forget they exist.

[ Parent | on HN ]

Re:F-Droid build servers can't build modern Android apps due... by fancythat on Wednesday August 13, 2025 @09:27AM (#44888177)

I agree with you. Unfortunately usually, the simplest explanation is often the truth, so they just probably ignored this issue, until it surfaced up.

[ Parent | on HN ]

Re:F-Droid build servers can't build modern Android apps due... by WesolyKubeczek on Wednesday August 13, 2025 @10:09AM (#44888675)

In other words,

> they are just "it used to work perfectly" guys.

[ Parent | on HN ]

Re:F-Droid build servers can't build modern Android apps due... by bill_mcgonigle on Wednesday August 13, 2025 @09:52AM (#44888464)

Well if you wanted to compromise F-Droid you could target their build server's ME or a cloud vm's hypervisor.

To do a supply-chain attack on Google's SDK would be much more expensive and less likely to succeed. Google isn't going to be the attacker.

The recent attack on AMI/Gigabyte's ME shows how a zero-day can bootkit a UEFI server quite easily.

There are newer Coreboot boards than Opteron, though. Some embedded-oriented BIOS'es let you fuse out the ME. You are warned this is permanent and irreversible.

F-Droid likely has upgrade options even in the all-open scenario.

[ Parent | on HN ]