Can we get reproducible builds?

[dennisguse]

Follow-up to the discussion on Mastodon https://chaos.social/@dennisguse/104818490105850432

[dennisguse]

Waiting for new builds on https://verification.f-droid.org

[dennisguse]

A lot of details: https://f-droid.org/docs/Reproducible_Builds/

[dennisguse]

OSMDashboard and also the Bahnhofsfoto App are now reproducible (thanks @pstorch)

Things that were done:

1. RailwayStations/RSAndroidApp@411426e
2. https://gitlab.com/fdroid/fdroiddata/-/merge_requests/16486

For OpenTracks, we will likely publish reproducible builds under a new package name and keep both versions in the F-Droid store.
This allows current user to migrate whenever they want while new users can directly use the reproducible version.
Otherwise, we would force existing users to re-install incl. backup and restore - this has the tendency to be error prone...

[dennisguse]

Could it be that the builds are already reproducible?
At least https://verification.f-droid.org reports that everything since versionCode 5683 could be verified.
Neat :D

For example: https://verification.f-droid.org/de.dennisguse.opentracks_5683.apk.json

[dennisguse]

PR for F-Droid created: https://gitlab.com/fdroid/fdroiddata/-/merge_requests/17921

However, F-Droid seems to have trouble with checkupdates by identifying the new package name.
In OpenTracks this is implemented using buildTypes (with applicationIdSuffix).
OSMDashboard uses product flavors - and this works.