Hi all, new GrapheneOS user here, long time on AOSP.
Being mostly in the Google ecosystem and trying to de-google, it stood out how unreliable, inconvenient and fragmented it is to get apps from other sources. I'm I missing something or the current state is really that sad? That's a huge adoption barrier to anything not Goog related, not to mention a security risk.
Before GrapheneOS: I trusted Google (and by extension the developers).
After GrapheneOS: I trust select developers, but want to verify that the apps really come untampered from them.
There are many sources without clear trustworthiness (F-Droid, APKPure, APKMirror, Amazon Store, Aurora, github repos, etc) and almost no way of being sure that the apps that come from any of these sources are untampered with (unless I'm missing it) for the first install (I understand that updates are checked by Android itself).
There's some tools like Guardian Checkey but very out of date. There's also command line apksigner, inconvenient for daily use but okay-ish.
The biggest problem by far is that there's no "know good" database of signatures. APKSCAN.org was shut down years ago, that backed androidobservatory.org and checkey. There's androidobservatory.com but AFAIK that's for a different purpose.
I can code my own scripts in whatever to check my APKs, as inconvenient as it sounds, but there's no actual database of dev trusted certificates to check against (hey, that's a CA does btw). And I'd like a lot to avoid doing my own custom, hackish, incomplete and inconvenient solution that would only benefit myself. The thought of that is enough to make me think going back to Google, I don't want to invest that amount of my free time on my mobile phone. There's life after all!
And that's not even thinking about binary transparency logs (bottom of page)
To be clear, I'm not surprised that there are dozens of different "stores" (although annoying) or other security aspects. I'm not worried about trusting a rando developer - that's a different problem.
I'm surprised there's no app that comes from GrapheneOS or other (good) paranoid people out there that goes "hey, let's check every single one of these APKs for know-good verifiable signatures".
I'm I missing something or that's the actual state of things outside the Google ecosystem? We install an app downloaded from F-Droid, apkpure or whatever and then just trust that whatever comes from it hasn't been tampered with?
Just asking as I'm sure I must be missing something obvious. Any thoughts and directions appreciated. And thanks for the outstanding project that is GrapheneOS!