[fancythat]

I don't know how much servers are they using or server specs besides ancient Opterons, but how is this even an issue in 2025?

On Hetnzer (not affiliated), at this moment, i7-8700 (AVX2 supported) with 128 GB RAM, 2x1 TB SSD and 1 Gbit uplink costs 42.48 eur per month, VAT included, in their server auction section.

What are we missing here, besides that build farm was left to decay?

[WesolyKubeczek]

Either they want to run on ideologically pure hardware too, without pesky management bits in it (or even indeed UEFI), or they are just "it used to work perfectly" guys.

In the former case, I fail to see how ME or its absence is relevant to building Android apps, which they do using Google-provided binaries that have even more opportunity to inject naughty bits into the software. In the latter case, I better forget they exist.

[fancythat]

I agree with you. Unfortunately usually, the simplest explanation is often the truth, so they just probably ignored this issue, until it surfaced up.

[bill_mcgonigle]

Well if you wanted to compromise F-Droid you could target their build server's ME or a cloud vm's hypervisor.

To do a supply-chain attack on Google's SDK would be much more expensive and less likely to succeed. Google isn't going to be the attacker.

The recent attack on AMI/Gigabyte's ME shows how a zero-day can bootkit a UEFI server quite easily.

There are newer Coreboot boards than Opteron, though. Some embedded-oriented BIOS'es let you fuse out the ME. You are warned this is permanent and irreversible.

F-Droid likely has upgrade options even in the all-open scenario.