F-Droid: Our build and release infrastructure, and upcoming updates

Posted May 31, 2022 9:50 UTC (Tue) by agateau (subscriber, #57569)
In reply to: F-Droid: Our build and release infrastructure, and upcoming updates by mathstuf
Parent article: F-Droid: Our build and release infrastructure, and upcoming updates

I don't think F-Droid reuses the developer's signing key. They sign all builds with their own key.

I have one game hosted on F-Droid and I am sure F-Droid does not have my signing key.

This is why when you try to switch from a Google Play version (signed with the developer key) to an F-Droid version (signed with F-Droid key) or the other way around, Android warns you and the new version cannot access data stored by the old version.

F-Droid: Our build and release infrastructure, and upcoming updates

Posted May 31, 2022 13:15 UTC (Tue) by mathstuf (subscriber, #69389) [Link] (2 responses)

Ah, they *support* using developer signatures (they don't get your key). Basically, they can take your source and your signature, and if they can reproduce the same binary, apply your signature to the application.

https://f-droid.org/docs/Reproducible_Builds/

F-Droid: Our build and release infrastructure, and upcoming updates

Posted Jun 1, 2022 16:20 UTC (Wed) by agateau (subscriber, #57569) [Link] (1 responses)

Oh, nice! I didn't know about this.

I guess it would not be a good idea to apply it to apps which have already been published using F-Droid key, though, since existing users would not be able to update.

F-Droid: Our build and release infrastructure, and upcoming updates

Posted Jun 1, 2022 16:38 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

I think I've seen a few apps "migrate" keys with an explicit opt-in. The F-Droid maintainers may have a path to use here (though save data may be lost, so an export/import option may be warranted).