Where download Telegram FOSS and verify APK

GOS21606

I have downloaded Telegram FOSS from F-Droid and verified the APK with AppVerifier but it did not match (App list)

When I downloaded the the APK from GitHub it does not match either? (Verify APK file)

Does anyone know the correct Hash and the right place to download the APK file?

By the way Telegram is the only file that is ¨red" from my FOSS apps in AppVerifier.

Dumdum

GOS21606
Where are you downloading the APKs from? Could you provide a link to the Github repo you used?

I've just downloaded and tested the 4 most recent APKs from their Github and they:

Showed as "Not Found" in AppVerifier's database
Were all a match when I verified the 4 APKs against each other.

Pocketstar

SimpleX, Briar and Molly do give me a green verified status, (these are no Telegram apps) but none of the Telegram forks did. (Nekogram X, Mercurygram and Forkgram)

GOS21606

Pocketstar

So it seems to be ¨normal" or are the APK compromised?

axl

I'll suggest you don't use Telegram's apk at all, since it comes with trackers.

Instead opt in for a private alternative that also works better and has more features. Nekogram/NekoX are popular alternatives. Forkgram also holds well. Many more out there; check F-Droid but make sure the app is still continuously updated.

The one I use is AyuGram. It has tons more features like Ghost Mode but it's technically rule-breaking, so keep that in mind.

Goes without saying, Telegram isn't private to begin with, its chats aren't E2EE, its CEO has been giving governments users data, etc.

GOS21606

[https://github.com/Telegram-FOSS-Team/Telegram-FOSS/releases/tag/v10.14.3]

Indeed not found regarding the : Verify APK file (why Beta file?)

But the file from F-Droid does not match:

[https://f-droid.org/packages/org.telegram.messenger/]

org.telegram.messenger versionCode 49279 (App info)

Dumdum

GOS21606 But the file from F-Droid does not match:

[https://f-droid.org/packages/org.telegram.messenger/]

Does not match with what? The Github APKs? Fdroid signs APKs with their own keys, so they're going to mismatch with the Github APKs. I've just tested and the Fdroid APK also shows as both "Failure" in the database, and a mismatch with the Github APK.

GOS21606

Dumdum

The Github APK is NOT FOUND in the Database

But the F-DROiD APK is ¨red" with a ! when a verified it with the Applist button

I have I have two APK's on my phone to be clear. (one installed)

I mean with NO Match a RED

Pocketstar

GOS21606 These are not neccesarily compromised, but merely unavailable to verify.
Red means the apk is not equal to the source, it does not mean it is compromised neccesarily.
If the apk file can be obtained from a different source (like the official github) or another way perhaps a verification might be possible.
An unverified (not green nor red) status does not equal compromised apps, however, a green status does indicate the apk is equal to the source.
Yet, if that source is compromised the app might also, verified or not, like when the developer got hacked and signatures were compromised.
I might not have the full knowledge on how this works, and I am sure there are plenty of sources that can explain this better to you, but this is my two cents on the subject as far as I am aware.
In short: App verifyer gives you more certainty of the apk being equal to the source, it provides more likelyhood of not being compromised, not a guarantee, however, it is not a virus scanner, merely a verification tool.
It seems that reproducable builds from fdroid are more likely to be verified.

Pocketstar

Pocketstar
I've just looked into the subject further.
The apps are not compared to the source code, but to another APK from the original website, like the pre-build APKs on their respective Github pages. (Make sure it is the original appmaker Github page)
This way, if an app is compromised and reinstalled by a blackhat hacker (or an APk installed from an unknown source like a website that does not compare to the APK on the Github/creators page) using a different hash, that it means you will recieve an "unverified" (red) status, the hashes do not compare in that case.
Please correct me if I'm wrong.
Here is some more info on Appverifyer:
https://github.com/soupslurpr/AppVerifier
If apps cannot be verified, it does not neccesarily mean they are compromised, but it might be an indiction of that.
Reproducable apps on F-Droid seem to have a better chance of verification.