Add to FDroid about trezor-android

[prusnak]

That is great! Woohoo!

[prusnak]

Ack!

[ligi]

MR is pending: https://gitlab.com/fdroid/fdroiddata/merge_requests/2307

[ligi]

MR is merged

[prusnak]

What happens next? Do we need to push builds somewhere or this happens automatically? What about the updates? Is it enough just to send another MR with updated tag?

[ligi]

It should be build by them in the next cycle (should be soonish). Also updates should happen automagically - but we should have an eye on that as this sometimes breaks - depending on the changes done to the app. So Ideally after doing an update to the app check a week after (to be safe) if the update is also on FDroid and if not: check why. But usually no further MR is needed.

[ligi]

FDroid signs with their signing key - not with the one from satoshilabs. I think this is where the confusion comes from - you might have installed 1.0.3 from play and want to update 1.0.5 from fdroid.
For now you will have to stick to one source - then you will get no warning.
In the future we might be able to use reproducible builds - but this is not yet ready for production (checking https://verification.f-droid.org/ regularly to see if the current version of the trezor app is able to build in a reproducible way)