META: Pilot alternative app distribution platform

[patcon]

Flock struck me as the best app to consider for distribution via F-Droid. (Please call me out if you disagree.) Reasons:

• small install base
• no GCM requirements

These are the main places where Moxie has explained what he would need to see to be comfortable with alternative distribution:

1. github.com/WhisperSystems/TextSecure/issues/127#issuecomment-13335689
2. github.com/WhisperSystems/TextSecure/issues/281#issuecomment-21762482
3. github.com/WhisperSystems/RedPhone/issues/143#issuecomment-19152664

Summarized:

• [ ] built-in crash reporting solution with a web interface (Pending: libsupplychain)
• [ ] built-in statistics gathering solution with a web interface
• [ ] built-in auto-update or "pester" feature in app (Pending: libsupplychain)
• [ ] build toggle for above features (Pending)
• [x] server-side APK scanning (?)
• [x] server-side APK signature validation: developer's signatures and keys are preserved through reproducible builds
• [x] F-Droid should not expect users to enable "Settings > Security > Unknown sources"

(Unhyperlinked so the back-references don't overtly attract superfluous comment.)

Hopefully this repo won't get inundated with peanut gallerians like the other issues :)

cc: @mikeperry-tor @mvdan

[patcon]

@rhodey you tricky devil. You're way ahead of us :) https://github.com/WhisperSystems/Flock/tree/master/flock/src/nonplay

[rhodey]

@patcon hah, yeah I managed to sneak that in without much notice, surprised. also 9c2fa9e35ed72be31844dbc35bd4b84b60c63e0d

[ghost]

:+1:

Peanut gallerian here, patiently awaiting this.

[rhodey]

thanks for keeping track of this and adding the context here @patcon. at this moment, all of the client side work for this has been implemented into Flock, you can download the apk using this link as described in the repo readme.

with the exception of #94 all the remaining work to be done exists outside the Flock client, ex: server backend & dev front end. so I'm going to close this now because I feel it has been completed.

[patcon]

:heart:

[patcon]

Oh hey, is there set of endpoints that follow a pattern that's pinned (instead of always /current)? Working on a ROM and trying to make the build script deterministic for when we start signing