Post #2740825
2026-02-26 07:20 UTC
@gillesmertens@hostux.social @asterisk@social.linux.pizza
Some of these are rather opinionated takes. Don't let perfect be the enemy of good.
One of the takes is that F-Droid signs apps themselves. This is only true if reproducible builds don't work. As a developer you can have your app listed in F-Droid with your own signing key, by making it reproducible and providing a source for your own signed updates (so their server can take your signature from it rather than providing its own).
Replies (1)
-
@pixelschubsi@troet.cafe 2026-02-26 07:27
@gillesmertens@hostux.social @asterisk@social.linux.pizza I'm not saying F-Droid has no bugs or flaws. All software has. But it's also a known thing in the scene the F-Droid is receiving hate from "security experts" for very stupid cult mentality reasons. F-Droid is/was included in CalyxOS. GrapheneOS lead hates against CalyxOS and everything that is remotely related to it, so F-Droid is also a target. And the cult about GrapheneOS is following their lead.