F-Droid rebuilt PilcrowMD from source and got the same file, byte for byte

Every app asks you to trust that the thing on your phone is the thing the source code says it is. Almost none of them let you check.

PilcrowMD 1.0.5 was checked, by someone who does not work on it.

F-Droid's build system compiled our pinned source and compared the result against the APK we published, byte for byte. A volunteer F-Droid contributor, Miggi, took that build result and checked the published file himself, on a physical phone — the signature, our build tool, what is inside the app, and what it does to the network.

His report is below, in full and unedited. We asked his permission to quote it, and he asked us to keep it whole rather than lift out the flattering parts, because — his words — the caveats about what was not covered are the part that makes it accurate. He's right. So here is all of it.

Retested 1.0.5 (versionCode 6) on the physical Redmi Note 8T, Android 13 (SDK 33), arm64-v8a rather than last round's x86_64 emulator, installing app-release.apk from the Binaries URL of the v1.0.5 GitHub release, byte identical to the reference binary the fdroid build job fetched; that job logs compared built binary to supplied reference binary successfully and supplied reference binary has allowed signer 1e1b987942798e4589ca123dcd6327b3b39a2bc6c335ce37bc3780541657785c, which matches AllowedAPKSigningKeys, and apksigner on my download reports the same digest.

Both findings from my 1.0.3 report are fixed, as is the Gradle wrapper checksum (distributionSha256Sum at 965574fd equals Gradle's published sum for 8.11.1). The narrowed NonFreeNet wording holds up: five remote image references rendered as alt text with the Mermaid toggle off and on, no socket followed, and io.noties.markwon.image.ImagesPlugin is absent from all three dex, whose only remote URL is https://mermaid.ink/img/.

3. A wording call, not a defect: Settings carries a "PRO PLUGINS" heading and a "GitHub integration" row badged "Coming soon". Nothing there is paid, gated or networked, and the button only fires a mailto intent.

Network by uid in /proc/net/tcp{,6} and udp{,6}, sampled once a second: no socket on cold start plus 60 seconds idle, nor while reading, editing, searching or exporting PDF; with Mermaid on, exactly one to [2a06:98c1:3121::3]:443, a mermaid.ink AAAA record. Untested: share sheet and email attachment, since this phone has no mail client.

The rename is linsui's call, not a tester's. Nothing above should hold the merge up.

Review driven with Claude Code; every result verified on the device, and I answer follow up questions myself.

In plain terms: the rebuild ran on F-Droid's machines, not ours, and the file it produced was identical to the one we published, down to the byte. Miggi took that result and checked the published file himself, on his own phone. He confirmed the signature matched the key F-Droid pins for us. He checked that our build tool was itself unmodified. He looked inside the app's compiled code for the image-loading component that would have contradicted what we say about the network, and it is not there. And he watched the app's network activity once a second — cold start, idle, reading, editing, searching, exporting a PDF — and saw nothing leave the phone. With Mermaid diagrams switched on, which is off by default, he saw exactly one connection, to the service that renders them.

He also flagged a "Coming soon" label in our settings that he thought read oddly. That's in there too. It's his report, not our advertisement.

Now the part most posts like this leave out.

PilcrowMD is written with AI assistance. I direct the work, I review every change, and nothing ships that I have not read. Each release goes through a review pass, a full test suite, and hand-testing on a physical phone before it goes out. I am saying this here rather than leaving you to find it, because a post about whether claims can be checked is a strange place to leave something out.

There is a second reason this post exists. The app is small. The thing I am trying to prove to myself, and to anyone else who is interested, is bigger than the app: that AI agents can produce the highest quality code and solutions when they are given proper care, structure, process and a real harness around them.

I believe they can. But only while a person is monitoring and controlling the work. That part is not optional and I do not want it read as a detail. Take the human out and the quality goes out with them.

Miggi disclosed his own tooling too, unprompted, in the last line above. Neither disclosure changes anything about the result. A checksum comparison, a signing digest and a kernel socket table are true or false regardless of what wrote the commands that produced them. A person ran them, on his own phone, and put his name to it.

Two things this does not say. The share sheet and email attachment were never tested — he says so himself. And the build you get from Google Play is signed by Google, not by us, so it is not byte-for-byte this file. The reproducible artifact is the one on GitHub and the one F-Droid serves.

None of this makes PilcrowMD a better Markdown reader. It makes the claims on this page checkable, which is a different and rarer thing.

The full review is public: F-Droid merge request !43788.

Correction, 7 September 2026. An earlier version of this page said Miggi compiled our source himself and repeated F-Droid's build by hand on his phone. That was wrong. It was our sentence, not his — his report never claimed it. F-Droid's build system does the rebuild and the byte-for-byte comparison; Miggi used that result and verified the published file on his own device. He pointed the error out on !43788. The headline, the meta description, two sentences on this page and one on the privacy page have been corrected. His report is unchanged.