Which APK build is best?
N00b Perspective: GitHub Repo (Obtainium) v Izzy Repo v F-Droid Repo
Please correct where I'm wrong; gently, I'm trying to learn to fish.
With the posts about the signing issues and delays via F-Droid Repo app versions, I went with Obtainium which primarily pulled apk from websites or GitHub. Get it right from the source.
It was great. Many of the common apps successfully passed AppVerifier (all installed apps should be checksum verified; by store or you).
Play Store kept trying to update an app from github because the package name and the signing key matched.
Its only registering in my understanding now. If Play Store can update the app, it was Signed by Google. To be in Play Store, devs hand over their signing key, and Google can muck about. Do they? Unsure.
This means tho that play store version has the Google signing block (I think seen marked on Izzy repo), and Google crash analytics, and potentially other Google requirements.
I thought that I don't want a Google play store version in my degoogled profiles, however I'm learning its not as simple. Tuta and Proton mail are two examples. We trust them to be private and secure. Is there a privacy or security issue from a play store version without Play Services? Unsure.
I re evaluate how I install my apps:
1) App Store and 2) Acrescent are said to be priority trust installs. I'm unsure why we implicitly trust Acrescent tho?
3) IzzyDroid Repo because they validate the dev signature for me, less trying to find it, and break down any concerning features. IzzyDroid Repo can be pulled by Droidify or Neo Store; store and repo are different entities.
4) GitHub or Website version that doesn't match the Play Store's verification checksum in AppVerifier. It wasn't obvious for me, but installing AppVerifier on stock Android and comparing was helpful.
5) I'm still hazy if I should prefer the Google Play Store version or the F-Droid Repo version.
While F-Droid checks for open-source/free aspects, I don't see that it focuses on privacy, security or safety. Not all source codes have signed commits or signed directories.
While play store will check on integrity and for maliciousness, with F-Droid you rely on the community to suss it out.
Rules of thumb we see:
- Install from devs you trust; most put their apps in playstore or in dual Izzy/F-droid Repo.
- Only install apps recently updated with thousands of stars.
I am writing this because I just installed an F-Droid Repo App with 3 stars last update last year, because I couldn't find a better solution.
During that journey I read many github pages, lost a lot of sleep trying to verify app checksums before installing and watching my marbles roll out the door because it shouldn't be so hard.