Install apps from Gplay rep, Fdoid rep, or github/website?

Schiller

dirksche
Thank you, it worked without any flaws.
Seems to be .zip to .apk isn't a thing nowadays, my bad :)

unwat

User2288 So then my worry of "apps from playstore = contaminated" is pretty much false then?
No privacy/security difference between app from github and same app from Gplay?

Some app devs will build different versions of the same app. Like, for example, a FOSS version and a Google Play version. The Google Play version might depend on Google Play being installed on the phone for things like embedded maps or push notifications. And, to be clear, in this kind of situation this stuff is added by the app developer, not Google.

Since so much depends on how the app developer builds and releases their app, it's impossible to say which download method is better. Sometimes I prefer to download the Google Play version. Other times I prefer to download the FOSS version. Sometimes the dev pushes the same app to both Github and Google Play.

So, it's up to you to decide which way is best for you, but both ways should be safe.

User2288

unwat Thanks you for the well explained answer. Much appreciated.
Also, I mistype the word "Droid" In the title of this thread, but I can't fix it. You (an admin) might wanna fix this for future user searchability purposes.

dirksche Thank you, I downloaded and its really great.

Volen

Sorry for hijacking the thread but I can't find Obtanium apk on their github page, only the source code.

Can you please advice where did you download it from? Thx.

matchboxbananasynergy

Volen https://github.com/ImranR98/Obtainium/releases under "Assets". app-arm64-v8a-release.apk of the latest release is what you want.

Volen

matchboxbananasynergy

Thanks a lot, somehow did not manage to find it myself.

Whatnoww

unwat

Many developers choose to sign their own apps. It's impossible for Google to add stuff to the app after the developer signed the app. Some devs allow Google to sign the apps for them, but I've never heard of nor seen any evidence that Google messes with the original code.

To be clear, isn't this changing in the future for newer apps, since Google is changing the signing methodology for newly submitted Play Store apps?

matchboxbananasynergy

Whatnoww New apps require Play app signing, yes.

User2288

After having done a lot of research, I have discovered that best place to install an app from depends on the app. So no clear categorical answer.
For example OsmAnd+ is best from fdroid, because you get the full pro app without limitation and without any proprietary stuff.
Same for Geometric Weather. The most blob free one is only available from fdroid.
Brave is only available from Play.
Telegram for example, best option (for foss) is the unofficial foss version from github.

So the decision is per app dependent and you have to figure it out for each app, unfortunately. Its not categorically the case that github is best, or fdroid is bad. Even Gplay sometimes is the best option. It just depends.

Sometimes github version contains blobs you may want to avoid. Sometimes the official website contains blobs in the apk that other sources may not (telegram for example).

Whatnoww

matchboxbananasynergy
How does this change the trust structure?

Reading: https://support.google.com/googleplay/android-developer/answer/9842756?hl=en#zippy=%2Cdescriptions-of-keys-artifacts-and-tools
It seems that you upload your key and give Google the ability to sign any package they want, is that right?