F-droid?

[CaptechOmar]

Guidelines

• I have searched searched open and closed issues for duplicates
• I am submitting a bug report for existing functionality that does not work as intended
• This isn't a feature request or a discussion topic

Bug description

It would be awesome to be able to install and update the app from f-droid instead of downloading the apk every couple of days

Screenshots

No response

Device

No response

Android version

No response

Signal version

No response

Link to debug log

No response

It will be a very complex task because he has to make his own F-Droid repo because the F-Droid team will not accept this app because it has some proprietary blobs (It has Google services as an example for push notifications),

Didn't you try Obtainium ? Pretty easy to setup

[CaptechOmar]

I did try it but I was kinda only using it for signal as most of my other foss apps are available on fdroid

I made an F-Droid repo hosted on GitHub and I can help the developer in making one too, it will update everything automatically using GitHub Actions , set a description and screenshots...

Let's see what the dev has to say about it.

My repo, and this is a screenshot of my personal Signal fork that I added.

[CaptechOmar]

that would actually be amazing

[tockudex]

@celecoxib couldn't the proprietary blobs be removed? Signal notification also work without Google Services, because the app makes use of its own notification server.

Do you think there it could be feasible to have both AMOLED theme and material colours at the same time?

[greensheeps]

F-Droid has major security and trust issues: https://privsec.dev/posts/android/f-droid-security-issues/

Consider submitting it to Accrescent instead.

Accrescent doesn't have arbitrary rules against proprietary code so you won't need to make any modifications beyond probably needing to change the package name as it's the same as the official Signal app.

It's currently in alpha with a whitelist for developers to submit apps so you have to contact them and be okay with there currently being a lack of automation for submitting updates, etc.

[tockudex]

While F-Droid is not perfect, Accrescent isn't either, as no project could ever be.

Yet, I still think that F-Droid has it's right to exist and therefore distribute good FOSS apps, potentially Signal-You.

[greensheeps]

While F-Droid is not perfect, Accrescent isn't either, as no project could ever be.

Yet, I still think that F-Droid has it's right to exist and therefore distribute good FOSS apps, potentially Signal-You.

Accrescent doesn't completely disregard basic security practices and have a history of covering up vulnerabilities and attacking people who dare to point them out.

It was never a good idea to have a group of untrustworthy people managing the building and signing of open source apps and is likely to end very badly.

Accrescent will have a filter for open source apps, reproducible builds, etc. so it will obsolete F-Droid in that sense.

If you think Accrescent is doing something incorrect then please leave an issue: https://github.com/accrescent/accrescent/issues

[lucasmz-dev]

F-Droid itself never will distribute Signal in any form. It has been said already they don't want third party app stores other than the Play Store. This is technically also the case for Accrescent with the inclusion of Molly.

There's no harm in having a repo for the F-Droid client, e.g. Obtainium still doesn't manage unattended updates.

[greensheeps]

It's better for the app to have a self-update system than an F-Droid repository. Verifying the initial install via AppVerifier is similar to including a repository with a key fingerprint, but doesn't get locked into using a key without key rotation and other problems.

An app can ask for the request install permission to update themselves and has permission to do unattended updates based on that by default, which permits unattended updates of the app itself and apps with it as the current installer.

[lucasmz-dev]

Signal has a self-update mechanism. It sucks and constantly breaks, though, as well as not working if you're not logged in already.

and other problems.

Get into them. I don't see any reason why it would be insecure to use an F-Droid repo. Especially with index v2.

[greensheeps]

Signal has a self-update mechanism. It sucks and constantly breaks, though, as well as not working if you're not logged in already.

and other problems.

Ideally there would be a library that can be used across apps that handles this well.

Get into them. I don't see any reason why it would be insecure to use an F-Droid repo. Especially with index v2.

The repository key can't be rotated without telling users to add a new repo.