It wants me to uninstall and reinstall since the signature of different, which makes sense as it from a different source, but it doesn't mention anything in the changelog.
It didn't change the repo. F-droid has always slower updates, because they're compiling every app themselves. Izzy is release directly from app developer, so it's newer. I'd stick to F-droid, so app dev can't push anything malicious in the official app build.
Jerboa is provided by both repositories. Izzy's pushed the update before F-Droid's is all. You can switch to Izzy's or wait or DL the apk from GitHub but signatures are different for all three.
Do you know why the signatures would be different? At my company we release our app on Google play, galaxy and Amazon store and I'm pretty sure we use the same signing key for each
Interesting, I was not aware of that. sounds like a security risk, as you don't know who actually published it, but I guess since its open source that doesn't really matter as much
It's actually the opposite, an evil developer could upload in GitHub an apk with malware not included in the source, while fdroid guarantees that it matches with the source published
Privsec.dev is a libel slinger and an anonymity abuser on Reddit who is also Daniel Micay's equivalent of left hand. He is supportive of GrapheneOS and Micay's actions, and only went silent after Louis Rossmann exposed Micay.
GrapheneOS members, Micay and his friends like Wonderfall have attacked F-Droid in the name of security, only to push using Google Play Store that annihilates all privacy of people. Google Play Services gather every possible metric about your phone which includes sensor, location, IP address, telephone number, IMEI and so on every 7 minutes. Just to be fair, Apple does the same things and is far worse. This theme of evangelising Google products at the cost of bashing all other projects is a thumb rule for GrapheneOS community.
You know who published it. It's the fdroid devs. Fdroid follows very much the old Linux repository philophosy where the owner of the repo acts as a middleman, providing the central layer of trust. You don't have to trust the developers because the distributor has done their due diligence and checked it. That's why fdroid takes a couple of days to push updates. They are doing some basic quality control first.
This model made a lot of sense in the world of traditional Linux packaging, where every obscure distribution has their own package format and developers couldn't possibly be expected to support all of these. It makes less sense on Android (or in a word where flatpak exists for that matter).
Quite the opposite. From the user perspective, it's much easier to trust the repository than trusting every single developer not losing their password. In case of OSS it also ensures reproducible builds.
Add comment