mastodon - Link to source

Hey @fdroidorg,

Could you please explain to me why Catima is marked as reproducible on verification.f-droid.org/packa…, despite you shipping a version you build and sign yourself to users? I also don't see anything in the metadata on gitlab.com/fdroid/fdroiddata/-… listing what upstream APK file to compare against.

#IzzyOnDroid correctly compares the APK files I put on GitHub with a local build, which is what I hope you're doing too but given I see no reference to the APK in the metadata... are you?


metadata/me.hackerchick.catima.yml · master · F-Droid / Data · GitLab

Data for the main F-Droid repository at https://f-droid.org
GitLab
#izzyondroid @F-Droid

IzzyOnDroid ✅ reshared this.

in reply to Sylvia

mastodon - Link to source

Sylvia

Most bafflingly, 2.28.0 is known to not be RB: github.com/CatimaLoyalty/Andro…

Yet verification.f-droid.org/packa… lists it as a reproducible build.

Clearly something is not right here...


Release 2.28.0 · CatimaLoyalty/Android

Note: This release is not reproducible, see #1781 for more details. Target Android 14 Open card icon in gallery on touch Improve design of Photos tab in edit view Update spending screen to also su...
GitHub
in reply to F-Droid

mastodon - Link to source

Sylvia

That's definitely very misleading text. The term "APK Signature" makes no sense in this context.

You could say something like "The APK file built by F-Droid was verified" but... verified by who? Compared to what? If you just rebuild it twice yourself that is not a proof of RB (you didn't confirm your build matches what upstream claims should be the result or building the source code), that is determinism of your own build at best.

Also, just compare to the APK I publish? :)

This entry was edited (3 months ago)
in reply to Sylvia

mastodon - Link to source

IzzyOnDroid ✅

sorry, but I had to boost this again now. @fdroidorg can you please make optically clear which APKs you reproduced? Developers knock our doors wondering why we say their app is not RB, while you claim it is – and checking, EACH SINGLE TIME we find the app is NOT set up RB at your end, and the JSON at your verification server clearly states you verified YOUR OWN build. Yes, that might show your build is deterministic – but not that theirs is RB. It's confusing.

#reproducibleBuilds

#reproduciblebuilds @F-Droid

Sylvia reshared this.

in reply to Laus🐜

mastodon - Link to source

IzzyOnDroid ✅

@Fettlaus Let me explain by example.

Say, Joe provides you with the APK of his FOSS app. You have to believe him he built it from his FOSS source code, but you have no proof.

Now Joe builds it 50 times resulting in the same APK – what does that prove? That his build was deterministic. Maybe, as you still can't tell if it really was built from there.

Comes Jane, not related to Joe, builds from his source, and gets the same APK. Now you now: (1/2)

@Laus🐜
in reply to IzzyOnDroid ✅

mastodon - Link to source

IzzyOnDroid ✅

(2/2) both must have used the same code. You no longer have to trust Joe for that. Now Jerry confirms as well… we can prolong the line. That is RB.

Now, you certainly can trust @fdroidorg builds from the right source. But if they then build again with the same result, what does it prove? Only that it's deterministic. If they however get the same APK as Joe, that again is RB. This is the case for apps set up as RB there, AFAIK ~15%; but how to tell them apart?

That was our request. @Fettlaus

@Laus🐜 @F-Droid
in reply to IzzyOnDroid ✅

mastodon - Link to source

IzzyOnDroid ✅

(3/2) Joe, Jane, Jerry, Jake: that's the line we build at #IzzyOnDroid. We run our "Janes" here to confirm "Joe's" builds – and we have "Jerrys" like Ben: independent builders. A builder is set up within 5 minutes thanks to codeberg.org/IzzyOnDroid/rbuil… – so everyone who wants can become a Jake.

@fdroidorg provides their verification builder setup as well, but that depends on the original builder providing the proof – so it only works with "source repos" like theirs and Guardian. Not independently.


rbuilder_setup

Scripts to automate setup of rbtlog, rbhelper, and their dependencies
Codeberg.org
#izzyondroid @F-Droid

Sylvia reshared this.

in reply to IzzyOnDroid ✅

mastodon - Link to source

IzzyOnDroid ✅

(4/2) so you can use codeberg.org/IzzyOnDroid/rbtlo… to confirm builds from anywhere: F-Droid, IzzyOnDroid, just some random Android app at Codeberg, GitLab, Github or self-hosted Forgejo, Gitea, GitLab. And you can use F-Droid's verification builder to confirm their builds, and Guardian's – and from other F-Droid repos using fdroidserver to build from source.

rbtlog

Reproducible Builds Transparency Log for IzzyOnDroid
Codeberg.org
in reply to Laus🐜

mastodon - Link to source

IzzyOnDroid ✅

@Fettlaus oh, @fdroidorg DOES provide real reproducible builds, covering about 15% of their apps. The problem shown here is that, at the verification server visualization, you cannot tell those apart from the "just deterministic ones". Does a green checkmark mean the APK of the developer was confirmed RB – or just the one F-Droid built themselves? You can figure out manually by checking the app's YAML file to see if RB was set up. But that requires some technical knowledge.
@Laus🐜 @F-Droid
in reply to Laus🐜

mastodon - Link to source

IzzyOnDroid ✅

@Fettlaus that. Or draw a border around the checkmarks when it was "not just the own build" – to symbolize the "higher level". Or use a double-checkmark, as e.g. Conversation uses: 1 check = sent successfully, 2 checks = sent and read.

There are ways. But you need to go them. Not doing it and just say nothing, makes it look like you really want to pretend the higher numbers, for some reason.

@Laus🐜
in reply to Peter

mastodon - Link to source

IzzyOnDroid ✅

@storchp does not really look like that will be processed anytime soon. And it's about the F-Droid client, while we referred to their verification server here. Example: verification.f-droid.org/packa… shows AppManager being reproducible, while it definitely is not, see github.com/MuntashirAkon/AppMa… and the following comments. And see F-Droid's announcement here: f-droid.org/en/2025/05/21/maki…

It's good that they do it, but it needs differentiation – or it leads to confusion, as in the case of AppManager & many more

Screenshot from the issue inked in the previous toot, showing it was opened 2018-08-14 and is still open

Publish on F-Droid

@IzzySoft Please help me.
MuntashirAkon (GitHub)
@Peter
⇧