F-Droid Build Status was updated to 5.6.4 and no one will get this update. Why? Well, the app is now built reproducibly so if you have it installed you need to uninstall it and then reinstall it. (Yes, we wish this switch to be easier to perform, but the UI is not there yet)

2 points

Has there been any previous apps we need to install and uninstall?

permalink
report
reply
3 points

I think the fdroid app will let you know if you need to do so when you try to update the app manually

permalink
report
parent
reply
0 points

Why should I care to install another app? Fdroid updates apps if needed.

permalink
report
reply
7 points
*

The update is for f-droid itself. It wont auto update itself to the new version.

Edit: ignore this. I was confused

permalink
report
parent
reply
10 points

If i read it correctly the uninstall/install part is for the F-Droid Build Status App and not for F-droid itself.

permalink
report
parent
reply
5 points

Ahh. I misunderstood.

permalink
report
parent
reply
12 points

I don’t understand why “the app is now built reproducibly” implies “you need to uninstall it and then reinstall”. What am I missing?

permalink
report
reply
3 points

android uses digital signatures as kind of a security measure. a digital signature is basically supposed to confirm that the apk was actually built by the developer, and most of the files in it were not tampered with.
besides being able to make permissions depend on it, you cannot install an app update that was signed with a different key to what you have already installed, because that basically means you are replacing it with a version that was built by someone else.

all apps are digitally signed. when an app becomes reproducibly built, from that point the app will be built by f-droid with their own digital signature.

also note that since google play has forced all developers to hand over their signing keys, when making app bundle based publishing mandatory, the security of this signature has been… less useful

permalink
report
parent
reply
4 points

[…], from that point the app will be built by f-droid with their own digital signature.

This part of your comment is not quite true. One of the advantages of reproducible builds is that the app can be signed by the developer but fdroid can still verify that it has been built from the correct source code. You can check out the documentation here: https://f-droid.org/docs/Reproducible_Builds/

permalink
report
parent
reply
2 points

you’re right, thanks for letting me know

This means that F-Droid can verify that an app is 100% free software while still using the original developer’s APK signatures.

then I don’t understand it either why it can’t be updated directly

permalink
report
parent
reply

F-Droid

!fdroid@lemmy.ml

Create post

F-Droid is an installable catalogue of FOSS (Free and Open Source Software) applications for the Android platform. The client makes it easy to browse, install, and keep track of updates on your device.

Website | GitLab | Mastodon

Matrix space | forum | IRC

Community stats

  • 734

    Monthly active users

  • 182

    Posts

  • 790

    Comments