{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreicellja5eicrcflvn4xwfcmg7hgmi4ju43bepjna6dh6wzqev3q3i",
    "uri": "at://did:plc:34cg4tn4iwemk3v5k3n3adwf/app.bsky.feed.post/3mjmtdhgdfnf2"
  },
  "path": "/t/add-information-about-who-built-the-source-code-and-signatures-and-reproducibility/34271#post_6",
  "publishedAt": "2026-04-16T16:15:03.000Z",
  "site": "https://forum.f-droid.org",
  "tags": [
    "sing-box Reproducibility Status",
    "sing-box | F-Droid - Free and Open Source Android App Repository",
    "Build Log"
  ],
  "textContent": "Anna:\n\n> then why is there no information about new versions on the page sing-box Reproducibility Status\n\nbecause the verification server did not get to that version yet\n\nalso, that is not used to publish builds, that is to check AGAIN, specially for apps that are NOT setup as reproducible\n\n> why are applications that did NOT pass the verification in the repository?\n\nI’ve already answered that, that is never the case\n\neg. for version 1.3.22 you can look at the build log: sing-box | F-Droid - Free and Open Source Android App Repository → **Version 1.13.8** (654) → Build Log\n\n\n    ...\n    2026-04-15 22:33:58,947 DEBUG: Checking build/io.nekohasekai.sfa/clients/android/app/build/outputs/apk/other/release/SFA-1.13.8-unsigned.apk\n    2026-04-15 22:33:58,950 INFO: Successfully built io.nekohasekai.sfa:654 from d5adb54bc6c6b2c21ab6f748276c4ec62d9bb650\n    2026-04-15 22:33:58,975 INFO: Created directory for storing developer supplied reference binaries: 'unsigned/binaries'\n    2026-04-15 22:33:58,975 INFO: ...retrieving https://github.com/SagerNet/sing-box/releases/download/v1.13.8/SFA-1.13.8-universal.apk\n    2026-04-15 22:33:58,976 DEBUG: Starting new HTTPS connection (1): github.com:443\n    2026-04-15 22:33:59,251 DEBUG: https://github.com:443 \"GET /SagerNet/sing-box/releases/download/v1.13.8/SFA-1.13.8-universal.apk HTTP/1.1\" 302 0\n    2026-04-15 22:33:59,252 DEBUG: Starting new HTTPS connection (1): release-assets.githubusercontent.com:443\n    2026-04-15 22:33:59,343 DEBUG: https://release-assets.githubusercontent.com:443 \"GET /github-production-release-asset/509091576/8af438ac-505e-4b5b-a550-cb4b4d027c06?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-04-15T23%3A13%3A42Z&rscd=attachment%3B+filename%3DSFA-1.13.8-universal.apk&rsct=application%2Fvnd.android.package-archive&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-04-15T22%3A13%3A15Z&ske=2026-04-15T23%3A13%3A42Z&sks=b&skv=2018-11-09&sig=1Xc7asQDruKJclAr8zeV6Arw84E3OFg8PLAnpcFlGYM%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc3NjI5NDIzOSwibmJmIjoxNzc2MjkyNDM5LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.ZVCoXfsZlhWjgPTLHiE8aJbHrTo7ZWYv0dLx-yOkvDY&response-content-disposition=attachment%3B%20filename%3DSFA-1.13.8-universal.apk&response-content-type=application%2Fvnd.android.package-archive HTTP/1.1\" 200 96268999\n    2026-04-15 22:34:01,497 DEBUG: unsigned/binaries/io.nekohasekai.sfa_654.binary.apk: Verifies\n    Verified using v1 scheme (JAR signing): true\n    Verified using v2 scheme (APK Signature Scheme v2): true\n    Verified using v3 scheme (APK Signature Scheme v3): false\n    Verified using v3.1 scheme (APK Signature Scheme v3.1): false\n    Verified using v4 scheme (APK Signature Scheme v4): false\n    Verified for SourceStamp: false\n    Number of signers: 1\n\n    skip useless warnings\n\n    2026-04-15 22:34:02,408 DEBUG: /tmp/tmp6wdu9nh0/sigcp_io.nekohasekai.sfa_654.apk: Verifies\n    Verified using v1 scheme (JAR signing): true\n    Verified using v2 scheme (APK Signature Scheme v2): true\n    Verified using v3 scheme (APK Signature Scheme v3): false\n    Verified using v3.1 scheme (APK Signature Scheme v3.1): false\n    Verified using v4 scheme (APK Signature Scheme v4): false\n    Verified for SourceStamp: false\n    Number of signers: 1\n\n    skip useless warnings\n\n    2026-04-15 22:34:02,408 INFO: ...successfully verified\n    2026-04-15 22:34:02,408 INFO: compared built binary to supplied reference binary successfully\n    2026-04-15 22:34:02,552 DEBUG: Using APK Signature v2\n    2026-04-15 22:34:02,555 INFO: supplied reference binary has allowed signer 32250a4b5f3a6733df57a3b9ec16c38d2c7fc5f2f693a9636f8f7b3be3549641\n    2026-04-15 22:34:02,558 INFO: success: io.nekohasekai.sfa\n    2026-04-15 22:34:02,558 INFO: Finished\n    2026-04-15 22:34:02,558 INFO: 1 build succeeded\n",
  "title": "Add information about who built the source code and signatures and reproducibility"
}