On: How RubyGems.org protects OSS infrastructure

[notpushkin]

Oh, I got it – apparently Play App Signing is mandatory now: https://developer.android.com/studio/publish/preparing#publi...

This makes it a bit trickier, yeah, though if the developer can get an APK signed with their Play App Signing key, and the app in question is a reproducible build, they can then publish it in F-Droid: https://fdroid.gitlab.io/jekyll-fdroid/docs/Reproducible_Bui...

(and probably they can upload it to their GitHub releases or something so that F-Droid picks it up from there)