So I am trying to get into these OSes like Graphene, Callyx, e OS…etc. If need be, I will try to de Google the phone too. Anyway, I understand that you can install apps using stores like Amazo, Fdroid, Acrescent, Aurora…etc, instead of relying on Google Play Store.
If an app I need relies on Play Store, then so be it; I think OS like Graphene allows you to run a profile with Google Play stuff?
Otherwise, I can just use apps from Fdroid, Aurora…etc. Say I have Firefox installed from Fdroid and it requires a serious security update, which store will get the update first: the Play Store or they come at the same time even to Fdroid?
Or I am a dev and I need to send an update for my app, where do I send it first?
F-droid doesn’t just check for reproducibility, they build and sign apps themselves. They don’t take apks from devs, only source code (this also means that F-Droid apks are not compatible with play store apks and can’t be mutually updated die to different signatures. I.e. you can’t install app from play store or directly from dev and update it from f-droid, and vice versa).
On f-droid.org, the app’s metadata can include a Binaries: URL where the original developer can post their own signed releases. The build process downloads the signed release from there in order to compare it to the version that was just built on our buildserver.
Sounds a lot like reproducible builds to me…
You can also see this in practice in their regular blog posts like recently:
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
F-droid doesn’t just check for reproducibility, they build and sign apps themselves. They don’t take apks from devs, only source code (this also means that F-Droid apks are not compatible with play store apks and can’t be mutually updated die to different signatures. I.e. you can’t install app from play store or directly from dev and update it from f-droid, and vice versa).
What do they mean by “reproducible builds” then? https://f-droid.org/en/2025/05/21/making-reproducible-builds-visible.html
Sounds a lot like reproducible builds to me…
You can also see this in practice in their regular blog posts like recently:
https://f-droid.org/en/2025/08/21/twif.html