@fdroidorg @tehstu @cy8aer of course. It's a battle we fight together regardless of preference for app stores or ROMs. Ty for attaching sources!

@tehstu @cy8aer @fdroidorg @marcprux yeah, it's a technical discussion, sorry I assumed more than I should have (it's an xkcd 2501 situation, look it up lol). However, I have to say that relying on GitHub releases is not that bad of a deal with an app store like Obtainium, which streamlines app updates. It's actually a quite secure model since it comes as straight from the developer as it possibly can.

@fdroidorg @cy8aer tysm! I didn't know this was the case.

@cy8aer @fdroidorg @marcprux iirc grapheneos disagrees with fdroid's signature model (where all apps are signed by fdroid and builds aren't really reproducible), among other things. However, I don't think this is the case here. You may ping them and ask if you want.
Here is some insight of you wanna go down the rabbit hole: https://discuss.grapheneos.org/d/7519-f-droid-security/10