Skip to content

Separate "dev signature retrieval method" from "wether F-Droid signs too or not"

According to the flowchart at https://f-droid.org/docs/Reproducible_Builds/ I cannot use the "signature in metadata" approach if I want a reproducible build with only my signature. I think this is bad, because it irreversibly ties two orthogonal aspects together:

  1. Dev signature retrieval: I think the "Binaries:" download method should be deprecated, because it's unreliable and potentially breaks reproducibility. Furthermore, it requires devs to find a webspace for their binaries which might be difficult depending on where you live and your personal situation. Therefore, I propose all reproducible builds to migrate towards the cleaner "signature in metadata" approach.

  2. Should F-Droid sign too: I suggest to put this into another metadata inside the build section (rather than derive it from the presence of "Binaries:"). Could be any combination of "dev" and "fdroid".

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information