Advice for app developers: how should they sign & build their apps to support GOS & the larger FOSS mOS movement?
There are plenty of honorable, competent, well-intentioned developers out there. Ive been speaking to one recently, who had historically been building & publishing apks themself, as well as through FDroid & Play. Recently, they've begun to consider abandoning the self-signed version in lieu of Play signed apps, believing Play's combination of convenience & security would be a better value than their home-brewed build server
This argument may have merit, but we also know that Play builds are not reproducible, as they inject some amount of proprietary play blobbage in.
We also know that (without once again revisiting the merits & opposition to this argument, do not rehash here) some amount of folks take issue with the security of FDroid's build servers, and would prefer an app built elsewhere
So, what is the official guidance for devs? Is FDroid the best game in town? Can Play-signed apps be distributed without compromising privacy? Is there a better alternative for reliable, secure, reproducible builds that doesnt place a tremendous burden on the developer?