Moving to distributing self-signed APKs

,
1

I currently distribute my app ( Orgro | F-Droid - Free and Open Source Android App Repository ) on Google Play and on F-Droid. With the Google Android developer verification process I have claimed the package name for my private key. I understand that means that in the (near?) future, some users may have difficulty running or installing my app if it is not signed with my key.

Currently the F-Droid builds are signed by F-Droid. I understand that I can get F-Droid to distribute my own APKs as long as they are reproducible against the F-Droid APKs (“Publishing APKs with the upstream developer’s signature” on Reproducible Builds | F-Droid - Free and Open Source Android App Repository).

I do my development on a Mac. Is there any guidance for how to reproduce the F-Droid build environment such as in a Docker image?

2

do this for the F-Droid signed one too then lol

read: Google developer verification - apps signed by F-Droid from devs that registered (#665) · Issues · F-Droid / admin · GitLab

3

yes, the issue is that users need to be informed, they need to backup, uninstall, reinstall new, import backup

app appears to build deterministically (when we rebuild it again later): Orgro Reproducibility Status fyi

4

It doesn’t appear to let you claim more than a single signature for a package name, so as I understand it this isn’t possible now that I have claimed the package name with my own key’s signature.

5

Yes, you can reproduce the same APK when building twice on your infrastructure.

But if I understand your docs at Reproducible Builds | F-Droid - Free and Open Source Android App Repository , I need my APK to reproduce with your APK and that doesn’t look to be trivial.

6

I linked to the topic where 2 developers tell us that it worked for them

why does not work for you? better post in Google developer verification - apps signed by F-Droid from devs that registered (#665) · Issues · F-Droid / admin · GitLab so we have all experiences in one single place

7

Sorry, I missed in the Google Play Console UI that you can indeed “Add key” to an existing package. Then the steps are indeed as described on the ticket you linked:

  1. Add the F-Droid key’s signature (d9423d31b482bc1638bf553b6ac1a5fdf07e85ac197de6f0d796b1a0f8912273)
  2. Publish a new version to F-Droid that includes your adi-registration.properties
  3. Upload the resulting APK to complete verification

To be clear that would seem to remove the need to move to self-signed APKs.