A common criticism directed at F-Droid is that F-Droid signs published APKs
with its own keys. Using our own keys doesn’t mean insecure — we have a good
track record (and keep the keys on a dedicated, air-gapped, offline
machine) whilst
others may not — but this does mean that our users need to trust a third
party other than the upstream developers.
Having a different signature can also inconvenience users by making it
impossible to install updates from other channels; this can be especially
inconvenient when we have difficulty providing an update for an
app. Developers also sometimes need to tweak their setup for F-Droid,
e.g. disabling an in-app updater or adding the F-Droid signature for
verification.
F-Droid is not the only app store publishing APKs signed with its own key —
Google Play does the same now. With “code transparency for app
bundles”,
Google provides a means to verify that the DEX files and native libraries in
an APK are identical to those the developer provided. This does address some
of these concerns, but code transparency does not protect many other
important files in the APK, like interpreted code or assets. And unlike APK
signatures, it is entirely optional (and an extra burden for developers) and
verification must be performed manually. It also does not solve the
inconvenience of being unable to install an APK with a different signature.
F-Droid has had a better solution for these problems for quite a
while:
reproducible
builds. However, it was
never widely used. One of the reasons is that it sounds difficult to
achieve. We had few reproducible apps (to be precise: only 6) and some of
them suffered from problems because of the use of reproducible
builds. Basically, we didn’t bother to mention reproducible builds unless
the upstream developers showed an interest. As a result, many developers
never even heard of reproducible builds, let alone that F-Droid supports
them, or attempted to use them for their own apps.
In response to some of those criticisms, we started encouraging new apps to
enable reproducible
builds. It turns out
that reproducible builds are not so difficult to achieve for many apps. In
the past few months we’ve gotten many more reproducible apps in F-Droid than
before. Currently we
can’t highlight which apps are reproducible in the client, so maybe you
haven’t noticed that there are many new apps signed with upstream
developers’ keys. If you have some third-party repositories enabled,
e.g. the IzzySoft one, you may find that sometimes you can update the app
from the main repository even if you installed it from another one.
Meanwhile, now that we’ve encountered many more test cases than before, we
also found many
new
problems
that affect reproducibility. Fortunately we also found workarounds for most
of them and developed some tools to make APKs
reproducible, mainly
thanks to @obfusk’s contributions. There are still some open issues and we
are still working hard to solve them. If you are interested in reproducible
builds, contributions are always welcome.