When using your app, the F-Droid interface doesn’t provide information about who built the app from source, who signed the app, or whether the app can be reproduced from source code. This information is only available on the website when viewed in a browser, but it’s not included in the main f-droid.apk app.
Please add important information: who compiled the app, who signed it, and how the compatibility check was performed. It’s possible that the app is open source, but the developer added unnecessary hidden functionality during compilation, then signed the app with their key and uploaded it to the f-droid directory. Without verifying that the app complies with the source code, its security cannot be guaranteed.
Versions 1.12.20 (616) and 1.12.14 (595) have not passed the reproducibility test, but they were published on the website and they are not signed by the f-droid developer. I don’t want to install such versions because there may be backdoors inside that were made by the app developer, and the f-droid company published possible malware. We need more information about the verification and who signed the application. The latest versions sing-box have not been tested for reproducibility at all over the last 2 months.
If F-Droid always checks the reproducibility of builds, then why is there no information about new versions on the page sing-box Reproducibility Status and why are applications that did NOT pass the verification in the repository?
This is purely informational. For example, historically there is a large number of apps that are signed by F-Droid. The Verification Server shows which of them are reproducible and could theoretically switch to developer-signed APKs.
The F-Droid build server has two options for publishing an app:
a. Build from source and sign by F-Droid.
b. Build from source, compare against upstream developer-signed APK, if matches publish that APK.
Observe that this means that there is no way for a developer to “hide functionality during compilation”. Everything that F-Droid publishes has been built from source.
Option b) is what the F-Droid project has historically called “Reproducible Builds”. But the main difference is in who is signing the APK in the end. Even in Option a) the app may be reproducible!
RB != developer-signed APK. RB is just a precondition for publishing a developer-signed APK on F-Droid.
Adding this info to fdroidclient
You’re not the first one asking for this. There are existing feature requests for both dimensions:
F-Droid is a community-run project, most work is done by volunteers. Stuff gets implemented when someone steps up to do it. Showing this kind of information requires changes to basically the entire stack (fdroidclient, index, fdroidserver).
Your case
In the cases that you raise above (sing-box Versions 1.12.20 (616) and 1.12.14 (595)) it is likely that the build server was able to reproduce them at the time – that’s why they were published with the developer signature – but later the Verification Server failed to. This can happen, RB can be fiddly.
Now, if you look at the diffoscopes, you will see that the diff is in the baseline.prof files. If you then read the docs, you see that this is documented as a common RB failure. For example:
Use the same CPU core number as upstream.
This is what I mean by “RB can be fiddle”. RB often just works. But when it doesn’t, it requires effort to dig in and debug it.
That’s also why RB is not a useful information to show most users. It requires technical knowledge to understand the implications, interpret the RB failure, and not just run away screaming. I have seen a large number of RB failures, and all of them were benign (false positives).