@KazukyAkayashi if you look at the repo metadata, you can see the name is "F-Droid" https://f-droid.org/repo/index-v2.json so it looks like it is a problem with your client app?
@KazukyAkayashi Actually I see the bug now: it only shows up in older versions of the index (index-v1.json and index.xml). We'll look into fixing that.
Which client app are you using?
@eighthave I use Droid-Ify
@KazukyAkayashi that means that Droid-ify is using the index-v1.jar, which has a weak SHA1 signature. They should upgrade to index-v2. We have libraries for apps like Droid-ify to do that with. If I were a user, I'd file an issue to make them aware.
@eighthave maybe