Alternative download source

[IzzySoft]

Would you mind attaching the .apk to the corresponding releases/ for folks avoiding Playstore (or having no access to it)? I'd offer to pick it then and provide it via my F-Droid compatible repository if you'd agree. That way, updates would be available via the F-Droid client within approx. 24h of your creating a new release and attaching the .apk to it – of course provided the user has my repo added to the client's list.

[MartinStyk]

Hi @IzzySoft, I am not sure how does it work with signatures? I use Google Play app signing, so I am unable to release apk with same signature as apk from Google Play

[IzzySoft]

No idea about that. Don't Android devs sign their packages themselves (unless compiled by e.g. F-Droid from the sources, who then do the signing using their key)? I'd rather not trust any third party with my private keys. If that's the case with "Google Play app signing" (taking control from the devs), the idea behind that seems to be binding devs to their walled garden – which isn't a good idea for FOSS software at all.

But of course the app must be signed so end-users can install them. All the other 350+ apps in my repo are signed by their resp. developers – with the same key as in Playstore, if their app is there (not all of the apps are present at Play – some are pretty much "exclusive" to my repo, apart from Github).

If you hadn't Firebase inside your app, we could approach F-Droid to compile from your sources; but Firebase is a show-stopper there (for good reasons). My repo has slightly relaxed rules in comparison, though I have set limits, too 😉

[Samsua]

#16

[IzzySoft]

@Samsua yes? That link goes here ("self-reference") 😉

[rmenessec]

F-Droid is copiously documented.

[MartinStyk]

Hi, sorry for late response. Currently I am not able to sign the Apk Analyzer with the key used in Google Play(I use google play app signing). I'll try to find more info about this and we'll see what can be done.

[IzzySoft]

@MartinStyk maybe you go back to signing packages yourself in general (for playstore, too). If I'd develop for Android, I'd certainly not trust any third party with my private key – nor let me be immured anywhere. Well, my special distrust concerning Google is because of my tin-foil hat – so no, NO third party 😉 Up to you of course.

[Poussinou]

We can't include this app due to firebase (non free component).

Would it be possible to have a build variant with only free and open source component.

This app really has to be in the main F-Droid repository.

[il-av]

If you generated your signing key with Play App Signing you won't be able to download the key.
https://support.google.com/googleplay/android-developer/answer/9842756?hl=en
In this article Google recommends you install the apk from Google play console and then you can add it to the releases.

[IzzySoft]

Nice, eh? It's your private key, but it's kept from you. Guess why. (Security reasons, yeah – but whose security?)

[Poussinou]

Hi @MartinStyk

Any chance we can get an apk in the releases section at least for the last version, for people without Play Store like us?

[IzzySoft]

As I don't know what features of Firebase you need here, maybe switching to appwrite or Supabase as replacements would be an option making your app eligible for F-Droid.org? If not, the only option left would be using a different signing key yourself.