Yeah. Basically it builds and then sign the app with their own keys, not the developer’s. The problem people has with this approach is that if F-Droid suffers an hacking attempt, the attackers could mess with the apps.
The team behind F-Droid is already trying to fix that with reproducible builds. It means that an APK downloaded through F-Droid could be compared to a GitHub release, for example, and they would have the same key.
Yeah. Basically it builds and then sign the app with their own keys, not the developer’s. The problem people has with this approach is that if F-Droid suffers an hacking attempt, the attackers could mess with the apps.
The team behind F-Droid is already trying to fix that with reproducible builds. It means that an APK downloaded through F-Droid could be compared to a GitHub release, for example, and they would have the same key.