search

truefedex / tv-bro

Simple web browser for android optimized to use with TV remote
https://play.google.com/store/apps/details?id=com.phlox.tvwebbrowser
Other
965 stars 106 forks source link

How feasible would reproducible builds of TV-Bro be? #148

Open MailYouLater opened 1 year ago

MailYouLater commented 1 year ago

Hello. In issue #134 there's discussion of getting TV-Bro added to F-Droid. I'm very much in favour of this happing, but I'm concerned about how it happens. Specifically, I'm aware of some projects having complications arise with people trying to switch between versions, (i.e. the APK from Google Play, F-Droid or GitHub releases) without losing their data. This is mainly caused by the different versions using different signing keys.

Currently the Google Play releases, and the APKs on the GitHub releases use the same signing key, so if Google delays or rejects an update, the user has the option to just go to the GitHub release page and update without too much hassle. F-Droid releases sometimes have delays as well, so It would be really nice if this option was available for people that find TV-Bro through F-Droid as well.

F-Droid has documentation to help developers understand and get their projects configured such that builds can be reproducible at https://f-droid.org/en/docs/Reproducible_Builds/.

truefedex commented 1 year ago

It seems to me that it is not necessary to strive for interchangeability of builds. Judging by the reviews, few people need it. I think the backup / restore user data (bookmarks and settings) are in higher priority. This is a much more requested feature. And regarding the f-droid, it seems to me that it's ok if it will use a different signature key.

It might be better to also use a modified package name for foss build - so that the versions can be installed in parallel and the update mechanism of Google Play and F-Droid do not conflict.

MailYouLater commented 1 year ago

Personally, I also feel like using reproducible builds with F-Droid adds value in that it proves that the published binary actually came from the published source. (After all, if you and F-Droid are able to build the same exact APK, it's obviously from the same source.)

And yes, a separate package id for the entirely floss builds might be a good idea whether or not TV Bro adopts reproducible builds.