Path: ...!weretis.net!feeder9.news.weretis.net!news.quux.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!eternal-september.org!.POSTED!not-for-mail
From: "R.Wieser" <address@is.invalid>
Newsgroups: comp.mobile.android
Subject: Re: grapheneOS app store - how to get a list of available apps ?
Date: Thu, 22 May 2025 14:16:15 +0200
Organization: A noiseless patient Spider
Lines: 75
Message-ID: <100n4ji$3f2pb$1@dont-email.me>
References: <100la9g$30k1k$1@dont-email.me> <m-q*3G7cA@news.chiark.greenend.org.uk> <100mqnv$3d4a6$1@dont-email.me> <m-q*Ob8cA@news.chiark.greenend.org.uk>
Injection-Date: Thu, 22 May 2025 14:16:51 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="7de094b29525662847673258d3d40780";
	logging-data="3640107"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX19bVFtd2d7ljE5E1qvDf3f167V0DJyvTU8qIHXZ0gSjEQ=="
Cancel-Lock: sha1:jleQNHE2VSa1koJQoezwjl1IDbQ=
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
X-Newsreader: Microsoft Outlook Express 6.00.2900.5512
X-Priority: 3
X-RFC2646: Format=Flowed; Original
X-MSMail-Priority: Normal
Bytes: 4130

Theo,

> Hmm, some of the apps in the F-droid catalogue are very old.
> I wonder if that's a problem?

Most likely, yes.  I sometimes see messages (from my OS) saying as much.

> Do the apps say they are built for a recent Android?

Thats part of the "find an app" problem, they mostly don't.  After 
downloading I can inspect the apps manifest and see names like 
"minSdkVersion" and "targetSdkVersion", but I have no idea how those map to 
the different android phones and/or OS versions.

> A number of banking/ecommerce apps don't like being installed via
> an alternative way, or insist on having a Google account on the
> phone before they will start.

If an app doesn't explain what the problem is with the first it gets 
trash-binned.

If an app demands a Google account and I can see it in the manifest it 
doesn't even get installed.  If it refuses to work after installing because 
it demands mothership access it gets binned too.

> If you use an app like Droid-ify it combines the repos of
> F-droid, IzzyOnDroid and some others.

I only thought of using the GrapheneOS appstore because it was build in. 
For all other apps I use my desktops webbrowser and "side-loading" (the 
phone/OS recognises a connected thumbdrive, which I use for backup backup 
and transport apps to it).

> There is some controversy with F-droid building their own apps,
> because they sign them with F-droid keys not the developers' keys.

It does mean that if a developers key is withdrawn (for whatever reason, 
including a "we don't like you anymore") their old apps can still be 
installed.

> This means you can't upgrade from F-droid built apps to developer-built
> ones or vice versa,

I dislike self-updating programs as the "update" could be poisonned (ask MS 
how that works :-) ) - as has already happened a few times.

> and there are some supply chain security concerns in case somebody
> got access to the F-droid build servers they could tamper with a
> lot of apps.

:-) The same kind of thing is true for Googles app store.

Furthermore, Googles app store is known to still offer malware laden 
versions of popular apps.  They can't(?) seem to get rid of them.

And they still do not have a method to prohibit the sale of a developers app 
together with their personal developers-key - allowing malversants to buy 
both and create malware-laden "updates" that get automatically installed.

> An alternative client like Droid-ify doesn't suffer from that.

I have to see if I can find them using a webbrowser.  On the other hand, my 
Pixel6 is "old" too ...

> So when somebody recommends an app you can install and keep it
> updated directly from the developer, rather than having to go
> via any catalogue or store.

Thats good when you have already found the app(s URL).  Finding such URLs 
would not be all that easy.  :-|

Regards,
Rudy Wieser