Comment

Comment by svat

I looked into it, and it seems there are two issues:

- Only a (growing) minority (maybe 15%?) of apps on F-Droid (the "reproducible builds" ones?) are signed with the developer's own keys (rather than being signed by F-Droid), so to avoid the user having to do the 24-hour cooldown, the developer of the app would need to have done developer verification and signed the app with their own keys,

- F-Droid is in principle opposed to developer verification so the F-Droid client itself would probably not count as by a verified developer.

So in principle a user could avoid the 24-hour cooldown by installing the F-Droid client using adb, then installing from F-Droid only the apps signed by developers who have gone through the developer verification flow, but in practice I imagine most of us (as users) will be doing the "Advanced" flow, i.e. the one-time 24-hour cooldown.

parent svat 7 days ago

No comments yet

Be the first to share your thoughts.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton