5

Historically, Google did not mess with Android apps installed via the open source F-Droid project.

Suddenly, however, Google's Play Store is now trying to update apps installed via F-Droid.

There are obvious privacy implications (Google is now likely aware of which F-Droid apps you have installed), but also significant security implications (F-Droid has a stellar security reputation, whereas Google has a deplorable security reputation). Given that, to my knowledge, Google's Play Store does not obtain files from F-Droid repositories, it stands to reason that it likely overrides F-Droid's APK trusted files with Google's untrusted APK files during any updates.

Can anyone confirm this hypothesis and shed any light on why Google's Play Store is suddenly trying to update apps installed that the user installed via F-Droid?

6
  • 2
    I understood that the signatures of files on F-Droid were different than the same app on Google Play, preventing the ability to do updates this way. Is this broad and across the board, or only a select few? If only some apps happened this way, I would guess that Google Play doesn't honor the difference, since the developer(s) didn't segregate them.
    – wbogacz
    Oct 24, 2023 at 12:38
  • Possibly related/duplicate: Will Play Store update a sideloaded APK?. Similar: F-Droid keeps downloading apps that were installed from other stores. AFAIK, this is possible only if the APK has the same signature.
    – Andrew T.
    Oct 24, 2023 at 14:22
  • Can you give some examples of apps affected? I could then check if they use "reproducible builds" at F-Droid, which is the only way the signature could match (disclosure: I'm one of the F-Droid maintainers).
    – Izzy
    Oct 24, 2023 at 23:09
  • 1
    @Izzy Hi Izzy. Yes, I will get a few examples for you. The likely lack of signatures matching is what makes this even more unwelcome. I have no Android devices with me at the moment, but I will write back when I do (or can contact someone who does). Oct 25, 2023 at 7:52
  • @Izzy As promised, here are examples (in alphabetic order): Cache Cleaner, DAVx5, and DuckDuckGo Private Browser. All were installed via F-Droid, but Google's Play Store is now wanting to update them. Oct 27, 2023 at 8:22

0

You must log in to answer this question.