App Stores

RedHenry

For Graphene OS Apps we have Droidify or Fdroid. Which is better or "safer"? Does it matter?

akc3n

RedHenry Fdroid

As for F-Droid, (privsec.dev) does have a published article that is a bit dated, but insightful:
https://privsec.dev/posts/android/f-droid-security-issues/

ErnestThornhill

Those aren't your only opinions.

mmmm

You could also investigate things like sandboxed Google Play, Aurora, Web apps, direct from GitHub. There are plenty of options and all have their pros and cons.

RedHenry

I've seen different things on YouTube......One opinion is Droid-ify is more updated with secure measures than F-Droid

23Sha-ger

I would recommend looking at Obtainium. A big advantage is that you can "pin" github
releases page for specific FOSS apps, and eliminate the potential attack surface from F-Droid.

Since F-Droid repos and all apks there are compiled by F-Droid, it doesn't matter what do you use,
F-droid, Drodify, AuroraOSS, Neostore - you get the apps from the same F-Droid repos.
While most FOSS projects there have a github "releases", Obtainium can install directly from there,
or fallback to F-Droid repos as an option. Also the UX seems better.

The risk of F-Droid build server getting hacked and malicious apps pushed to their repo might be
small, but it's there.

Eagle_Owl

23Sha-ger
Not all of them are compiled by F-Droid themself, but we know what you mean.

Developers can offer their apps via own repos at F-Droid!
They are in separate folders.
These devs use F-Droid as platform to deliver their own stuff, not “manipulated” by F-Droid.
Examples: Bitwarden, Session Messenger, SimpleX Chat, Threema Libre, NewPipe.

I use Neo Store to get these apps (In the Neo Store app, you can easily select these repositories and add missing ones yourself).
Other apps I download regular directly on GitHub and check the hashes via the app Hash Droid.
I only get a few apps from the F-Droid repository via Neo Store that are not available any other way.

23Sha-ger

Eagle_Owl

I understand what you mean but it's more like an exception, 99% of apps are packaged by F-Droid.
The reason I recommended Obtainium is that it automates both NeoStore and your manual download
process from Github in a single app, so you don't have to manually check for new versions on Github.

Dumdum

Eagle_Owl Not all of them are compiled by F-Droid themself, but we know what you mean.

Developers can offer their apps via own repos at F-Droid!
They are in separate folders.
These devs use F-Droid as platform to deliver their own stuff, not “manipulated” by F-Droid.
Examples: Bitwarden, Session Messenger, SimpleX Chat, Threema Libre, NewPipe.

When 23Sha-ger (or anyone else) talks about Fdroid compiling apps, they're talking about the main Fdroid repo, where most / all(?) apps are compiled by Fdroid to my knowledge.

And to be quite frank, third party repos on Fdroid are pretty pointless unless the app you want is specifically available only through the repo. Most of the time, an app from a third party repo is just the app from Github (e.g. Bitwarden, NewPipe). Essentially a third party repo "adds apps" to Fdroid the same as users would add apps to Obtainium.

akc3n

Another good one is https://accrescent.app/
https://github.com/accrescent/accrescent

Edit: additionally, see https://privsec.dev/posts/android/android-tips/#where-to-get-your-applications

Eagle_Owl

akc3n
Thank you for this tip, but after long time searching Accrescent's SHA-256 signing certificate hash I found only the one on their website (FAQ) and on their GitHub page, which doesn't fit to the hash of their app!

Website/GitHub: 067a40c4193aad51ac87f9ddfdebb15e24a1850babfa4821c28c5c25c3fdc071
Real App hash: 51d729972416d57c4548d45954489e16e3bfb4125608f3aa69df138db520bb45

Eagle_Owl

Dumdum
I did not claim otherwise.
The thread creator asked for sources of apps and I shared my experiences.
Nothing more.

BTW: I will also test Accrescent, which now seems to be the best solution. ;-)

akc3n

Eagle_Owl one moment please, I'll mention it to the developer now.

matchboxbananasynergy

Eagle_Owl 067a40c4193aad51ac87f9ddfdebb15e24a1850babfa4821c28c5c25c3fdc071 is the correct hash. Where did you download the app from, and more importantly, how are you checking it?

Something tells me you're looking at the wrong thing.

Eagle_Owl

matchboxbananasynergy
akc3n
Thanks for your fast answerings!

I have used the download link on the website of Accrescent: https://accrescent.app/accrescent.apk
Then I have tested the hash (as always) with the app Hash Droid (v4.3).

matchboxbananasynergy

Eagle_Owl Download this app from the GitHub Releases page and try the APK there. This app will give you the hash of the signing certificate, which is what you need to be checking, not the hash of the file:

https://github.com/soupslurpr/AppVerifier

Eagle_Owl

matchboxbananasynergy
Sorry, but there is mentioned:
DO NOT use AppVerifier to verify itself!
Also DO NOT use AppVerifier to verify Accrescent if you downloaded AppVerifier from it.

~~And there is no download link for the Accrescent app on GitHub (can't find it).~~
In the meantime I have made a second search on GitHub and have finally found the right page, where the download link is. :-)
And there is the hash. And it fits to the hash of the downloaded file named accrescent-0.17.0.apk :)

matchboxbananasynergy

Eagle_Owl It says "Also DO NOT use AppVerifier to verify Accrescent if you downloaded AppVerifier from it."

I suggested getting AppVerifier from GitHub, not from Accrescent:

https://github.com/soupslurpr/AppVerifier/releases
https://github.com/accrescent/accrescent/releases

ErnestThornhill

Eagle_Owl And there is no download link for the Accrescent app on GitHub (can't find it).

Yes, there is. https://github.com/accrescent/accrescent/releases

lberrymage

ErnestThornhill The APK download was previously missing from the latest release. It's been uploaded now.

ErnestThornhill

lberrymage Okay.