Feature Request: Add to F-Droid Store about launcherhijack

[davidfi01]

Upload it to apkmirror

[BaronKiko]

Never heard of f-droid but it looks cool. Will probably do so if I put out another release.
Regardless it's not an issue so I'm closing it.

[Perflyst]

You should see it this way: A lot of people trust f-droid an their tools. If you release an apk nobody knows if it is really the source code from this repo here.
Very less people even build the source code. F-Droid does this for the people and they trust it because everything is transparent.

People may not trust you. Why? Because you are e.g. not a known developer.
Why is it easier if you control building? You need to build the app and you need to get trust from users first.

aptoid: Maybe aptoid is easy because you just need to upload the apk and you are done. But how can a user even trust aptoide? It is not open source and not transparent.

[Perflyst]

You don't need to fight with the F-Droid build system. I tested your app locally with the build system and everything worked.

Yes, you can select a version, but the issue we might have here is that only the current version gets published. Maybe you can create a own repo for all variants of the app for the different devices?
Yes, you can disable automatic updates in F-Droid. Anyway apps get never installed without users input if you do not have the priviliged extension addon from F-Droid installed.

[LuccoJ]

I only have 1 other concern, can you select the version you want to use as not all users can use every version.

All versions since you start making them available in F-Droid will be available in the repository and installable in the F-Droid client (by tapping on the particular version under "Versions"), although older version may be moved to the Archive repository at some point.

There is also a "suggested" version which is the one that will be installed if the user simply clicks on "Install". This is often the latest version, but if you have alpha/beta/unstable versions, you can "pin" an older version as the suggested one.

Here is an example using as a package the F-Droid client itself:

I have version 1.5-alpha0 "installed" because I selected that manually, but had I simply let the client select a version for me, it would have installed the "suggested" 1.4.

Along the same lines can you disable autoupdates as during the update you have to redo adb commands on TV devices so you need a computer near by.

You can either disable auto-updates globally in F-Droid, or select "Ignore all updates" in the ︙ menu of a specific package, like in this screenshot:

When you do that, a given update can still be installed manually if wanted.

Finally, since some people consider the F-Droid interface outdated or just not great, it's worth noting that since the platform is completely open, there can be alternative clients: I know of the G-Droid app, which is actually included in the main F-Droid repository, and of the Fossdroid website.

[Perflyst]

You don't need a new release to do this. If it is okay for you I can open the merge request on F-Droid. I just need permission from you to do so because this is how they do it on F-Droid

[BaronKiko]

I know a new release isn't needed but it before it goes up I need to understand how f-droid works so I can push updates and the like whereas if I'm to put more time into this project it would first resolve some fire TV issues I was having.

So not to be rude but it's just not up there on priority. I would also like to maintain control of all the permissions so I think it's best I do so myself.

[BaronKiko]

Well I spent the past couple hours looking into this and it's not trivial to release. Had to install a linux vm as it's only supported there and the app refuses to upload anything without giving me any feedback.
If you have any experience with this help would be appreciated as I'm simply lost.

[Perflyst]

"the app refuses to upload anything without giving me any feedback"
What do you mean with this?

You just need to create a txt file with the metadata of the app and try to build it locally. If succeeded open a merge request. I will try.

[BaronKiko]

I have been trying to use there publishing app listed here: https://f-droid.org/en/tutorials/create-repo/

I don't think this will be able to go onto the main repo as I don't believe it's buildable standalone and there is no signing going on. Nor is this repo super well maintained.
What I really want is to just give them an APK and when I have an update I can just give them a new APK.

[Perflyst]

Okay so you tried to create a own repo. This is not needed here.
You can submit it to the main repo, it does only update if you create a specific tag. At the moment you have V3, you can set it to check only VX (replace X with number) tags and than release an update on the fdroid store.

You do not need to sign this build, also you dont need to build anything. It will be builded by the fdroid buildserver after the merge.

@davidfi01 please do not ask this here. What are the benefits between apkmirror or apk download from github release page....

[BaronKiko]

Upload it to apkmirror

Please don't, if you have to download an APK then you can just get it from here

Signing is more important than you think, it ensures you are getting the code from me and not some random fork. It would take very little work to turn this project into a virus. It's also looking like I will have to make different builds for different platforms which that system may have a hard time with. Having my own repo is the best case but still not what I really want as getting a user to add the repo is a pain. I was planing on having a look at another user suggestion, aptoid, tomorrow as that may be able to do it.

[Perflyst]

I understand how important signing is. But what is the issue you have with the main repo from fdroid?

You can also release multiple versions or variants on fdroid for the same app

[BaronKiko]

I want to be on the main repo, I just want to retain control of building, it's just easier that way. As I can tell with F-Droid if you want to keep that control you simply have to make your own repo. On top of that I don't think I adhere to every section of their inclusion policy: https://f-droid.org/en/docs/Inclusion_Policy/

[BaronKiko]

Your aptoid reasoning is flawed, you can apply the same logic to the official app store and it seems silly. It's just a place for me to point at so users can be notified upon a new release. If they don't trust it then they can get the signed builds directly from here or build it themselves.

If you are worried about security I ask you how many times have you read the source code for something you have downloaded from f-droid? If you are going to that effort then compiling it yourself isn't a concern.

In short regardless of the situation you have to either trust me or read and compile the code yourself.

But I don't really care about who trusts who as this github will always contain the latest releases. My concerns are releasing an unsigned app is just dangerous, and externally controlled build tools are a pain. For me to use f-droid both of those issues would have to be resolved, it's as simple as that.

[LuccoJ]

Just for clarity, since reading this issue left me a little confused, although this represents my own understanding and I in no way claim to represent the F-Droid team:

• All the apps in F-Droid's main repository are built by F-Droid buildservers automatically based on provided "recipes".
• The resulting APKs are signed, but they are signed with keys that belong to F-Droid, not with the author's key (which the F-Droid team obviously doesn't hold).
• The one exception is when the build is made reproducible, in which case F-Droid can sign it using the author's own key as it will be identical, but this involves nontrivial steps in the build process.
• I believe this app as it is would not be accepted into F-Droid's main repository, because its license is either not a FOSS license, or its status as such is made unclear by the fact it's a short ad-hoc license written in what aren't really typical legal terms.

Your aptoid reasoning is flawed, you can apply the same logic to the official app store and it seems silly.

Well, to be fair, this doesn't seem silly to the users of F-Droid who decide to use free and open source apps from F-Droid exclusively and to avoid even keeping Play Store installed, precisely for reasons of trust. These users exist, and they're the reason https://microg.org and https://lineage.microg.org exist, for example.

[BaronKiko]

Ok that clarifies some things for me. I should be able to update the licence to something more serious pretty easy. Just need to pick one when I go for a new release.

Signing seems fine if they are managing all that.
If the build system just works for my android studio project then great, should be doable. I really don't want too fight with a remote build system.

I only have 1 other concern, can you select the version you want to use as not all users can use every version. Along the same lines can you disable autoupdates as during the update you have to redo adb commands on TV devices so you need a computer near by.

I think that's all my concerns.

[BaronKiko]

Ok seems like all the bases are covered. Just sorting these new fire tablet bugs atm. Cheers for all the info.