Comments (23)
@momobobe the repro idea is "the app is reproducible and F-Droid hosts the APK from the developer AFTER it verifies that reproducibilty"
An in-app updater bypasses any verification, so users that put their trust in F-Droid get "lied" (strong word, bare with me) that all the app updates were verified.
FYI, almost every F-Droid cycle there's a repro app that fails verification.
So, to make things clear, an opt-in app updater is okay, as long as the user turns it on and gets informed that then the update comes straight from the developer.
from obtainium.
Perhaps a separate repo that can be added to F-Droid would be a solution for now?
Obtainium is now on the IzzyOnDroid repo: https://apt.izzysoft.de/fdroid/index/apk/dev.imranr.obtainium
from obtainium.
Thanks for the links, I forgot where the issue was. I'll include F-Droid builds with the next release.
from obtainium.
Great, thanks!
from obtainium.
(because F-Droid apps have their own signature)
That's not a problem if the app is reproducible... but
Obtainium would not be able to update itself
F-Droid would like this to be opt-in :)
from obtainium.
Merged in F-Droid and reproducible? Congrats 🎉
from obtainium.
Live on F-Droid : https://f-droid.org/packages/dev.imranr.obtainium.fdroid/
Feel free to use their badge: https://gitlab.com/fdroid/artwork/-/blob/master/badge/README.md
from obtainium.
Perhaps a separate repo that can be added to F-Droid would be a solution for now?
from obtainium.
IIUC, we need to have the fdroid flavor build and uploaded somewhere.
from obtainium.
It automatically grabs everything from GitHub, so you don't have to worry about it.
from obtainium.
@ImranR98 can you please build and attach fdroid flavor builds as well to regular ones when you upload new releases?
from obtainium.
@ImranR98 Weird, I thought that F-Droid maintainers are currently waiting for you to publish f-droid flavor apks so they can set up reproducible builds (so apks signed by you are published in f-droid), with the only changes that f-droid flavor has, is that the package id is different and obtainium doesn't add itself to app list automatically #236.
(Here's fdroiddata merge request: https://gitlab.com/fdroid/fdroiddata/-/merge_requests/12514)
from obtainium.
https://github.com/ImranR98/Obtainium/releases/tag/v0.16.0-beta
from obtainium.
If it was on F-Droid, Obtainium would not be able to update itself (because F-Droid apps have their own signature). That's fine, but it means there would have to be a separate build of the which does not automatically include Obtainium as a tracked App out of the box (because then it would try to update itself from GitHub and fail). Right now that's hardcoded but can probably be changed to be optional based on a build option or something.
But is not a priority especially since part of the motivation for this app was to move away from F-Droid. Will leave the issue open but may not get around to it anytime soon.
from obtainium.
@rollingmoai does this require any maintenance when the app is updated? Or does it automatically grab everything from GitHub?
from obtainium.
Obtainium would not be able to update itself
F-Droid would like this to be opt-in :)
@licaon-kter Maybe some misunderstanding about this? Obtainium "updates" itself just the same as an app store does, like F-Droid and its forks. It just makes use of its core feature and ability of downloading and installing any app added by users. Except for the fact that Obtainium is added on list in advance (a workaround is to replace the GitHub url for F-Droid url upon publishing on F-Droid, or ask users to choose upon initialisation), I don't feel it a real problem since it doesn't exclusively add a module for self update like how common apps typically do.
@ImranR98 Maybe we can review this since signature is not a problem now as licaon-kter mentioned. And if you don't reject this idea, it's should be not hard since licaon-kter can help with it.
from obtainium.
It there any update?
from obtainium.
@ClockGen I can't build fdroid flavours (i mean i can build it, but it wouldn't actually be signed by f-droid). That needs to be done by f-droid when/if the app is published there.
from obtainium.
@ImranR98 Do you want reproducible build for the F-Droid build? I'm not sure if it's what you want. With reproducible build the apk signed by you will be published directly. I ask because the PR for that was merged but the target branch is removed. For reproducible build we still need that to ensure the same flutter version is used. You can also declare the flutter version somewhere else though. Currently you always use the latest stable flutter version.
from obtainium.
Since F-Droid needs to build background_fetch
from source not sure we can hope for reproducibility
from obtainium.
Do you want reproducible build for the F-Droid build?
The F-Droid inclusion issue has been pushed by other contributors from the start (I've only been merging PRs etc.) so I'm not sure. Sounds like reproducible builds may not be possible?
I'll remove the F-Droid APKs from the release assets since it isn't clear whether they will actually be used or if F-Droid will be doing their own signed builds, and they are just causing confusion right now (people accidentally downloading them, causing App ID issues). Instead I can attach the builds to the GitLab issue for now.
from obtainium.
I ask because #253 was merged but the target branch is removed.
Sorry, I must have deleted the branch thinking whatever it was for had already been merged to main. I can re-merge it into main (#1324) if someone indicates that I should do so (not sure if we're still going for repro builds since @licaon-kter mentioned it might not be possible due to background_fetch
).
from obtainium.
I've merged that PR and updated the Flutter submodule to make sure it's on the commit for Flutter's latest stable branch. I've also updated the GitHub actions CI to crash if I ever forget to update the submodule, leading to a mismatch between latest/stable and the submodule (haven't confirmed it works yet).
from obtainium.
Related Issues (20)
- Check if repository got archived and add visual indicator or notification HOT 1
- PathAccessException #2 (on secondary user profiles)
- AIMP
- Test version as a update HOT 3
- Add Search Button HOT 4
- Check if shizuku service is enabled before starting download HOT 1
- InflateException HOT 1
- Support more date formats
- Switch to the Wix Madefor Text font
- Fetch app description from repo HOT 2
- French translation completely revised HOT 2
- Filtering based on latest (embedded) date HOT 1
- Unable to download any app
- can't install StandardNotes HOT 2
- Skip updating apps that can't be updated
- how do you configure obtainium to only see one app HOT 1
- Can't find suitable release
- Remember collapse state of category groupings HOT 1
- Could not get ID from APK - GitLab source app Key Driver HOT 1
- Superuser installation support HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from obtainium.