I will be totally honest, I've never verified the signature, primarily for the same reason as other people. It has HTTPS connection, and I would highly doubt that the website had been hacked while I was trying to download it. However, that really is a terrible excuse, and I really should do better in the future. But honestly, I don't know how to verify signatures myself.
this post was submitted on 21 Nov 2024
17 points (94.7% liked)
F-Droid
8298 readers
19 users here now
F-Droid is an installable catalogue of FOSS (Free and Open Source Software) applications for the Android platform. The client makes it easy to browse, install, and keep track of updates on your device.
Matrix space | forum | IRC
founded 3 years ago
MODERATORS
How do you know the signature hasn't been compromised?
I think it is a big rabbit hole I don't have time to think about
I dont. As I said, I actually don't really know how to verify signatures. And even if I did, I know that you have to get the signature from somewhere else that is not run by them so that if they were compromised, the signature would not be compromised as well.
To be honest, I didn't verify the signature when I installed it. The download is over TLS (HTTPS) so you know you have a secure connection with the F-Droid server during the download. But because of the tiny chance the F-Droid website was hacked at the time you download it, you should verify the signature.
They just didn't document how to do it on Android.
Using Play is probably the least safe way to install apps, which has been recently shown to have plenty of malicious apps.
Edit: They documented what it typically looks like on Linux. To document how to do it elsewhere would require recommending an app to do it with.
Would you trust that recommendation?
You don't need to verify it. Download it and then temporarily turn on install from unknown sources. Once F-droid is installed you can turn off the install from unknown sources setting. When you first install an app from F-droid you will need to grant F-droid permission to install apps.
I personally I think F-droid is far better than the Play store. I don't even use the Play store on my device as I don't use or install Google services. I run pure Lineage OS with only apps from F-droid. F-droid takes a strong stance on freedom, libre software and privacy. To be on F-droid you need to meet strict requirements.
https://forum.f-droid.org/t/where-is-the-pgp-signature-verification-app/14305/
It mention Termux and OpenKeychain
Stock Android does not have tools to do that verification. Just verify it from the desktop and then send it to your Android device.
But I don't see how verifying the apk signature would help if your concern is that "you have bare to none knowledge how it works". The only thing that would fix that would be if you actually learn how it works.
Luckily, unlike other stores that are closed source and actively and purposefully hide from you what they do, F-Droid is open source, so anyone can go to the repo holding their source code and learn how it works, or build their own themselves, as long as they wanna spend that much effort.
I would not know that you can do this on Android, not without downloading another potentially malicious app anyways...
Could you get away with using something like Termux?
I've never heard of it, is it safe to use? I'll see if I can find the .apk from F-Droid
How are you going to verify that APK?
If you are concerned just verify it from your desktop and then transfer the file over.
Asking "is it safe to use" is pointless. No one can say an app is "safe", just that they've never seen an issue.
I'd argue Termux isn't safe, because if you're rooted you can break the OS. And I use Termux every day.
"Safe" is determined by your use-case and what you do. I'd even argue there's no such thing as "safe", just a risk level which you are comfortable with.