Elysium So if you copy the source code, make your own project maybe on Codeberg instead of GitHub, publish it on F-Droid, submit the hash, make a second Github account, submit same hash - it might be committed (even though its a cloned app from a fake dev).
It is unclear to me what the issue is here.
If I understand you correctly the idea is
- Person A makes App A.
- Person B clones App A as App B on GitHub.
- Person B gets App B on F-Droid and Codeberg.
- Person submits App B to Verified Apps.
The point of the database is to help users verify that the app they downloaded has the signing certificate they expect. In this scenario all that would mean is, if you download App B and use AppVerifier BG or Verified Apps and saw it was matched in the internal database, then the App B you downloaded has the expected signing certificate.
Just because you clone App A source code does not mean your app would have the same signing certificate. That would only be possible if the credentials of the keystore used to sign the app were stolen from the original developer or the developer of App A used the debug certificate where the credentials are publicly available.
App A is not going to match to App B if both are in the database. If App A and App B have the same package name (ie com.AppA) then it would be impossible to install both on the same phone (Android does not allow it) and it would not get in the database as seen here.