please point to right direction on how to verify apps? obtainium fails often

nervousball

Novalissoide i've been having this issue for months hence exhausted a lot of possibilities. being patient wont answer my questions in regards to how to verify signatures if i cant find them :) or how to get specific configs

but thanks for your help, hopefully someone can point me to right direction

Novalissoide

nervousball I've got used to opening Obtainium, refresh, if something shows up i increasingly open the update link since I'm afraid of be missing the changelog. Tuta kind of must be taken this 'semi-manual' way.

DeletedUser471

Novalissoide https://apps.obtainium.imranr.dev/ add tuta from here

Novalissoide

DeletedUser471 Yes that works, but take a look at the amount of work that adds to the search mechanism. Longpress on the 'tuta'-entry on that page, copy link and read it. A couple of months ago I applied several of those solutions, but reversed after I experienced a slowdown of Obtainium. This however might be negligible on newer faster devices.

nervousball

DeletedUser471 yes but have you read my thread? every other time apps got to be manually configured in obtainium settings, it just doesnt work normally by "Adding it"

MetropleX

App Verifier doesn't have an exhaustive database, however the app is not just a tool for that but also for self verification using published hashes.

A good grounding for it can be watched here: SideOfBurritos (Josh) https://www.youtube.com/watch?v=IkrujqcM-9Y

nervousball

MetropleX i will look into the hashes and how to verify them.

in regards to updating apps, is there a way/method to follow? not every app can be easily and automatically updated just by adding them to obtainium and it sort of frustrates me,

e.g. standard notes, tutanota etc

DeletedUser471

Novalissoide I think you misunderstood it, but anyway, just forget about previous method and add it manually from: https://github.com/tutao/tutanota

and only custom thing needed to always fetch mail client is adding "tutanota-app" to filter apks by regular expression

DeletedUser471

nervousball every other time apps got to be manually configured in obtainium settings, it just doesnt work normally by "Adding it"

I found few apps that are hard to catch, yes, but simple fetch tuning is easy, actually. and most apps I use are plug&play, anyway.

DeletedUser471

nervousball no problem eith adding snotes to obtainium

MetropleX

nervousball while Obtainium may not auto update it will certainly alert you, TO, an update. So you can tap the download/update button. I have Tuta in Obtainium and it does update on it's own. I'll often get the app update has been attempted or words to that effect for it and on opening Obtainium it has updated. Sometimes it doesn't due to some connection/dns issue but that's not an Obtainium problem.

nervousball

DeletedUser471 true. any idea on what shall i use for aurora/google store apps, meaning no FOSS? such as banking apps? shall i just try and get .apk file off their github as well?

DeletedUser471

nervousball I don't think banks have open source apps in repos. I personally use play market as latest vendor and have sepparate profile / private space for apps downloaded from play market that rely on network permission as I don't trust google and that they want to spy on my main profile even through other apps they compiled and signed. But one thing every advanced user of obtaining knows you should keep in mind – first install should be via vanadium downloaded apk and then if app downloaded through obtainium will be hijacked signature conflict will save you. but comparing hashes with appverifier works too

nervousball

DeletedUser471 thank you Ilgar, yes - i installed graphene 6 months ago and it is time to create profiles and slowly "harden" it bit by bit. only bad thing is that i still have to use whatsapp and gmail etc for work so was thinking of working profile, but not to get too much off topic, would you be kind to clarify for a dummy what you meant by your last comment?

if i understood you correctly, do i:

download .apk file for the app that i want to install first time and install it via vanadium first? and only then configure via obtainium to continue updating app versions moving forward?
wouldnt it be better to install it via obtainium, as it can automatically verify signature - since i will be getting most of .apk files from official github repos AND/OR https://apps.obtainium.imranr.dev/ ?

cant wrap my head around why i need to install same file lets say via vanadium first instead of obtainium, if i will be using same source/file to download and install it from? or did i misunderstand you

DeletedUser471

nervousball yes bro your understanding is correct, but I was wrong saying that download via obtainium is less secure. that say the main risk is source selection, when first install via file from repo you visually see what you installing and then if something goes wrong with update via obtaining you'll see signature conflict. but honesty, I myself installed apps with obtainium too and checked with appverifier many times with no issue. first direct file install is recommended because it's errorless by default.