The most prominent red flag about Signal is that, for all its purported commitment to "developing open source privacy technology", a real, working open-source app is not on F-Droid.

https://forum.f-droid.org/t/we-can-include-signal-in-f-droid...

I don't think availability via any particular distribution mechanism is a reasonable litmus test for "open sourcedness." Such a test would have excluded Linux for most of its development history, prior to migration to git.

This particular distribution (F-Droid) requires that the source be build-able from strictly source files, without bundling binaries.

You can download the APK directly from Signal: https://signal.org/android/apk/

When a new version is released, the Signal app notifies you.

Problem is, the APK is a closed-source binary. What they include there might be completely different from what is in the source.

Not with reproducible builds, no.

I agree it can be frustrating; the bot does seem to need tweaking.

The first issue was only closed two days ago and presumably it'll be reopened since it's effectively by design. The second issue you linked was not closed at all, and in fact looks to be been acknowledged. I don't like to nit pick but this just proves that the statement is indeed hyperbole: the Signal devs are paying attention, tickets aren't always closed and when they are closed I almost always see them re-opened.

> The second issue you linked was not closed at all

The only reason it's not closed is because I kept replying!

Had I not succumbed to the bot, it would have likely been closed before the acknowledgement, and never been looked at again.