6 ms·

See this issue talking about WireGuard and F-Droid. https://gitlab.com/fdroid/fdroiddata/-/issues/3110 https://gitlab.com/fdroid/fdroiddata/-/issues/3110 OpenA

See this issue talking about WireGuard and F-Droid. https://gitlab.com/fdroid/fdroiddata/-/issues/3110 https://gitlab.com/fdroid/fdroiddata/-/issues/3110 OpenAPK here seems to be linking directly to official binary downloads, whereas F-Droid insists on building the APKs for the apps.

blendergeek 2y ago
> F-Droid insists on building the APKs for the apps. You could say that OpenAPK blindly redistributes whatever APK upstream is peddling whereas F-Droid builds from source. I see the merits of both systems but prefer reproducible builds so that we can have the best of both worlds
- jqpabc123 2y ago
  Maybe it's just me but I'm kinda struggling to see much merit in blind distribution.
  - JavierFlores09 2y ago
    Well, for starters it is just a whole lot less work and money to distribute and maintain binaries up from the distributers' side, for the developers it comes down to a lower-barrier of entry to not have to adjust their workflow to whatever x platform may demand for building on their servers and in the end that gives the users more choices to work with. Of course, this is all in a perfect world where the chain of trust isn't broken so easily, which isn't an easy feat but given platforms like Windows thrive in spite of it, it is probably not as bad as many people may think. All of that said, not particularly speaking for OpenAPK here, given their motives seems rather unclear to me. If I am to be charitable, I guess they're just trying to provide a different platform than f-droid for discoverability, but for whatever reason they seem to be marketing the distribution-side of things more which is just odd to me, but alas.
    - em3rgent0rdr 2y ago
      > given platforms like Windows thrive in spite of it, it is probably not as bad as many people may think. There is a lot of extra work done behind the scenes to "thrive in spite of it". Windows Defender (built into Windows after XP) has to periodically download updated virus definitions and always scans programs for potential malware, and still can't catch them all.
  - whs 2y ago
    Shizuku's license disallow 3rd party recompilation of the APK, fork or not. Presumably this is done to provide an option to legally takedown fake Shizuku which could contains backdoor. (The original APK is redistributable) Hence Shizuku is not on F-Droid. F-Droid, however, allow the developer's binary to be reproduced if they have tested that the APK is reproducible when replacing the APK's signature with the original APK.
    - notpushkin 2y ago
      It allows recompilation, just not using the official logo. Similar to Firefox in Debian kind of issue. Reproducible builds would allow distributing Shizuku in F-Droid, that’s correct. (If Shizuku banned third party builds by the means of code license, it would not be FOSS and thus wouldn’t be eligible for inclusion in F-Droid altogether.)
- guappa 2y ago
  It's a reason why I don't really trust signal. They don't want to be recompiled by 3rd party. You must either trust them (or the app stores, which isn't better) or go through the hassle of figuring out how to build it yourself.
  - Y_Y 2y ago
    You don't need to run the binaries at all if you don't want, you can just get the standard VPN configs and use your OS's network stack. You won't get all the fancy features, but otherwise it works fine.
    - guappa 2y ago
      Uh?
      - Y_Y 2y ago
        Good question. I'd start here if I were you: https://protonvpn.com/support/wireguard-configurations https://protonvpn.com/support/wireguard-configurations
        fulafel 2y ago
        The context was Signal
        Y_Y 2y ago
        Oof. Thanks, I must have been switching tabs too quickly.
  - procaryote 2y ago
    It's fairly reasonable to discourage people from using random third-party compiled signal variants though. If you can't figure out building it yourself, using the official one will probably be safer.
- fc417fc802 2y ago
  F-Droid can also redistribute the signed upstream APK. The requirement for that is that the build is reproducible. This is the best of both worlds because the distributor (F-Droid) verifies that the published source matches the binary but does not possess the private key to sign the APK. This means the distributor cannot push a backdoored binary blob at some later date.
maxloh 2y ago
> OpenAPK here seems to be linking directly to official binary downloads, whereas F-Droid insists on building the APKs for the apps. F-Droid guarantees that the binaries it distributes always match the corresponding source, which adds another layer of security. To ensure transparency, it also provides an archive of the source code used to compile different versions.
johnisgood 2y ago
As others have said, it does not update automatically, you have to do that yourself.
fc417fc802 2y ago
After reading the issue you linked I came away very strongly in favor of continuing to use F-Droid. Why would I want to switch to an alternative distributor whose policies would permit the WireGuard devs "I don't want to provide a clear explanation to end users" antics? (Of course I happen to trust the WireGuard maintainer, but individual cases should generally be irrelevant when setting policy.) I am impressed to see the F-Droid maintainers sticking to their principles.

blendergeek 2y ago

> F-Droid insists on building the APKs for the apps. You could say that OpenAPK blindly redistributes whatever APK upstream is peddling whereas F-Droid builds from source. I see the merits of both systems but prefer reproducible builds so that we can have the best of both worlds

jqpabc123 2y ago
Maybe it's just me but I'm kinda struggling to see much merit in blind distribution.
- JavierFlores09 2y ago
  Well, for starters it is just a whole lot less work and money to distribute and maintain binaries up from the distributers' side, for the developers it comes down to a lower-barrier of entry to not have to adjust their workflow to whatever x platform may demand for building on their servers and in the end that gives the users more choices to work with. Of course, this is all in a perfect world where the chain of trust isn't broken so easily, which isn't an easy feat but given platforms like Windows thrive in spite of it, it is probably not as bad as many people may think. All of that said, not particularly speaking for OpenAPK here, given their motives seems rather unclear to me. If I am to be charitable, I guess they're just trying to provide a different platform than f-droid for discoverability, but for whatever reason they seem to be marketing the distribution-side of things more which is just odd to me, but alas.
  - em3rgent0rdr 2y ago
    > given platforms like Windows thrive in spite of it, it is probably not as bad as many people may think. There is a lot of extra work done behind the scenes to "thrive in spite of it". Windows Defender (built into Windows after XP) has to periodically download updated virus definitions and always scans programs for potential malware, and still can't catch them all.
- whs 2y ago
  Shizuku's license disallow 3rd party recompilation of the APK, fork or not. Presumably this is done to provide an option to legally takedown fake Shizuku which could contains backdoor. (The original APK is redistributable) Hence Shizuku is not on F-Droid. F-Droid, however, allow the developer's binary to be reproduced if they have tested that the APK is reproducible when replacing the APK's signature with the original APK.
  - notpushkin 2y ago
    It allows recompilation, just not using the official logo. Similar to Firefox in Debian kind of issue. Reproducible builds would allow distributing Shizuku in F-Droid, that’s correct. (If Shizuku banned third party builds by the means of code license, it would not be FOSS and thus wouldn’t be eligible for inclusion in F-Droid altogether.)
guappa 2y ago
It's a reason why I don't really trust signal. They don't want to be recompiled by 3rd party. You must either trust them (or the app stores, which isn't better) or go through the hassle of figuring out how to build it yourself.
- Y_Y 2y ago
  You don't need to run the binaries at all if you don't want, you can just get the standard VPN configs and use your OS's network stack. You won't get all the fancy features, but otherwise it works fine.
  - guappa 2y ago
    Uh?
    - Y_Y 2y ago
      Good question. I'd start here if I were you: https://protonvpn.com/support/wireguard-configurations https://protonvpn.com/support/wireguard-configurations
      - fulafel 2y ago
        The context was Signal
        Y_Y 2y ago
        Oof. Thanks, I must have been switching tabs too quickly.
- procaryote 2y ago
  It's fairly reasonable to discourage people from using random third-party compiled signal variants though. If you can't figure out building it yourself, using the official one will probably be safer.
fc417fc802 2y ago
F-Droid can also redistribute the signed upstream APK. The requirement for that is that the build is reproducible. This is the best of both worlds because the distributor (F-Droid) verifies that the published source matches the binary but does not possess the private key to sign the APK. This means the distributor cannot push a backdoored binary blob at some later date.

maxloh 2y ago

> OpenAPK here seems to be linking directly to official binary downloads, whereas F-Droid insists on building the APKs for the apps. F-Droid guarantees that the binaries it distributes always match the corresponding source, which adds another layer of security. To ensure transparency, it also provides an archive of the source code used to compile different versions.

johnisgood 2y ago

As others have said, it does not update automatically, you have to do that yourself.

fc417fc802 2y ago

After reading the issue you linked I came away very strongly in favor of continuing to use F-Droid. Why would I want to switch to an alternative distributor whose policies would permit the WireGuard devs "I don't want to provide a clear explanation to end users" antics? (Of course I happen to trust the WireGuard maintainer, but individual cases should generally be irrelevant when setting policy.) I am impressed to see the F-Droid maintainers sticking to their principles.