Will new versions be posted on F-Droid?
Somehow I don’t trust APK from GitHub
You should not trust not GitHub nor F-Droid.
Shortest and most trustfull trust path is reproduceable releases from devloper (team), signed by (their) key.
Pity it’s still not there.
1 Like
ArcaneChat offers this btw, if you need that level of security
yes, 2.x is detected at and waiting to be build - this may take several days, if not weeks. we do not have that under our control 
3 Likes
Release signing by devs is actually pretty standart these days.
You are building wonderful private messenger ecosystem - but your distribution is like not protected at all.
Now I must trust governments, ISPs and Microsoft to get your desktop app. And I normally don’t trust them all.
I can understand when dev teams not dealing with cryptography at all have some troubles with release signing - but you, guys… I can’t get it.
Here is discussion on SimpleX messenger release signing.
1 Like
I think you didn’t understood what I said, the apks are ofc signed, it is not normally possible at all to install an app without signing in android, if you already have the app installed and download an update from github it will not be possible to update at all if Microsoft manipulated it, also we publish the file hash in our site so you can verify the apk is the correct one
for f-droid, it was not possible in the past to publish ourselves and is signed by them but you can always just install our signed apk instead if you don’t trust f-droid
reproducible builds are another topic and it is when you don’t trust the developers, in that case even if the code matches nothing prevent the developers to still put some malware deep in the code, are you reading carefully the Rust source code every delta chat core release??? so some trust have to exist, you can always fork the app and review carefully the code you merge and compile it yourself tho
but please notice that this is a bit offtopic here, creator of the post was just asking about why/when there will be releases on f-droid
2 Likes
I’m talking about desktop situation.
ofc?
Noted, sorry 
Actually it seems all binaries on Index of /desktop/ are signed starting from 1.60.0.
I didn’t find it, because I still can’t update from 1.58.2 which was the last without signatures.
Shame on me.
My thanks to developers team!
2 Likes
ah you were talking about desktop all this time? “apk” is the apps for android, this thread is about f-droid, I was not talking about desktop at all, you were too deep in the offtopic rabbit whole, buddy! but good you figured it out! 
I assume you don’t trust Google either, so another advantage of the F-Droid version is that it doesn’t contain the proprietary code blobs from Google.
But I think your right to distrust GitHub. Even if Microsoft doesn’t put malware in it they’ve been known to censor projects on GitHub in the past, it restricts access and blocks accounts based on nationality and geolocation, and especially in the present climate we can expect to see more of this or worse. Codeberg seems to be a more open, trustworthy, and reliable alternative.
Or when the build system of the developers is compromised.
5 Likes