Syncthing fork community raises alarm over unclear key handover

The GitHub repository for a popular Android fork of the Syncthing file synchronization software has disappeared and resurfaced under unclear circumstances, raising concerns within the open-source community.

Developer Catfriend1's repository initially vanished, and the developer has been unreachable since, with their profile set to private. Syncthing enables decentralized file synchronization between devices without a cloud provider. Given the application's full file system access, the sudden disappearance of the repository has caused considerable uncertainty.

According to community reports, this is not the first such incident. A previous occurrence involved rewriting the repository's history to remove inappropriate content. However, the current situation differs as a new GitHub account, "researchxxl," appears to have taken over the project without a clear, verifiable handover from the original developer.

This presents a security concern, as the new maintainer could theoretically push arbitrary code under the project's previous signature to numerous devices. The community perceives the new project manager's communication as evasive and lacking transparency. While initial technical reviews have not revealed obvious malicious modifications, and F-Droid builds the app reproducibly, future changes remain a point of concern.

Organizational matters, including build processes and potential project renaming, are being publicly discussed on GitHub. Developer nel0x has joined efforts, aiming to contribute to further development and hoping for future F-Droid builds to be trusted.