Add reproducible build functionality to F-Droid distributed apk #5041
Replies: 2 comments
-
|
I've already been considering this too, but since all users from F-Droid would need to reinstall the app I fear that this would probably very ugly for users that don't have much knowledge concerning LibreTube and I don't have the time to provide support to individuals on how to backup, restore, ... Even if we pin an explanatory issue, there would be many users opening duplicates etc as already known from the past (which I don't have time and motivation for either) |
Beta Was this translation helpful? Give feedback.
-
|
Makes sense! Was just something that popped into my head after the discussions in the other two issues/threads, and I only realized after that you of course had already implemented this functionality in your other projects. Thank you for all your work on this project, LibreTube is great 👍 |
Beta Was this translation helpful? Give feedback.
-
Describe your suggested feature
Per the discussion and comments in #4884 and #4991 concerning apk distribution, and how different people choose to obtain LibreTube (be it directly from GitHub, F-Droid, IzzyOnDroid, the aforementioned via Obtainium, etc.), perhaps it might be useful to utilize F-Droid's reproducible build functionality such that the signing key would be consistent across all platforms. Of course, the downside would be that users of the F-Droid signed apk would have to perform a quick settings backup/restore to switch to the new version. Personally, I think it is low-priority (maybe
wontfix), but would provide not only the benefit of users being able to freely alternate between distribution platforms in the event that there is an issue for example with F-Droid's build process (especially when a showstopper hotfix is pending in the pipeline), but also that for those users who prefer F-Droid's build process and FOSS stance, it will exist as a further verification of the developer's apk build, distributed with the developer's signature, and not F-Droid's.Example situation: Alice is using a build from F-Droid, a hotfix is issued, now Alice can switch her distribution repo and install a hotfix update while keeping all settings and developer signature chain-of-trust intact, if she so chooses to completely trust the developer. At a later point in time, once F-Droid's build process and release catches up, she can switch her distribution channel back to solely using F-Droid, if she so desires.
Edit: Noticed that Bnyro uses reproducible builds for several apks already, so perhaps there is a reason why LibreTube is not distributed in this manner.
Other details
No response
Acknowledgements
Beta Was this translation helpful? Give feedback.
All reactions