>This is… not true? Signal builds are reproducible. You can verify that the apk in the app store corresponds to a specific point in git history, and if you don't trust Google you can sideload that.
A better way to verify this is latest Signal build in F-Droid? Last time I checked it is behind quit few version. If Signal can satisfy the F-Droid build check to be open and free, then it is legit. Most people don't have time to go through the git commit to verify the build.
I don't think Signal was ever on F-Droid? IIRC its code does contain some proprietary blobs and Signal doesn't want non-official clients to connect to their servers, so it'd be against Signal's wishes to have a fork on F-Droid without those proprietary blobs.
The F-Droid issue mentioned nothing about blobs as I recall, the reason was they want to be able to push security updates in a timely manner. F-Droid makes it far too easy for people to keep using an old version.
>F-Droid makes it far too easy for people to keep using an old version.
Being open/free is to allow people to have any version they chose. I've pushed both in App Store and Google Play Store, if the software is truly free/open it shouldn't be hard to publish it on F-Droid. The problem is when there are mixxed proprietary code in the project then F-Droid tend to reject it.
Agree though making it faster or more convenient would be a benefit. But I disagree that most people don't have time to check. It's just inconvenient or not important enough for those who choose not to.
A better way to verify this is latest Signal build in F-Droid? Last time I checked it is behind quit few version. If Signal can satisfy the F-Droid build check to be open and free, then it is legit. Most people don't have time to go through the git commit to verify the build.