build log should be included in index-v2 with SHA-256 sum
The build log provides an important source of information about how the APK was built. It should be verifible also. If it is included via a index-v2 "file" entry, then it'll have a SHA-256, and will be signed via entry.jar.
This will slow down fdroid update
a bit since it'll have to checksum another large file, but the results should be cached, so it would only happen for new build logs.