[Question] Why apk called app-fdroid-release?

[0pLuS0]

Hello,

I assume coming to the developer's GitHub repo, they are naming their apps by their names.

I didn't see/notice any mention of this anywhere, this makes it confusing, as if this app was meant to come from fdroid, as if it was built and signed by them.

I'm running LOS 23, I'm not using fdroid or gapps, I just want to download android apk directly from the developers.

I know this might just be a file manager, but it would be nice to have also gpg verification, so end-users who wish to download directly from you, can more thoroughly authenticate verification, instead of just sha, which is all I noticed for the latest download a sha sum.

THANKS

[VishnuSanal]

hi, thanks for reaching out :)

I assume coming to the developer's GitHub repo, they are naming their apps by their names.

it is called app-fdroid-release.apk because fdroid is the flavour name we use to build the app with no closed dependencies (ref).

as if this app was meant to come from fdroid, as if it was built and signed by them.

no! this is an app that we built using our signature. :)

I know this might just be a file manager, but it would be nice to have also gpg verification, so end-users who wish to download directly from you, can more thoroughly authenticate verification, instead of just sha, which is all I noticed for the latest download a sha sum.

and about adding GPG signature, lemme look into it (if you have any ideal way of doing this in any projects that you use pls share it with us to take a look).

[0pLuS0]

HI @VishnuSanal

I personally wouldn't recommend calling it app-fdroid-release, it's just confusing to people, and I personally don't get the reasoning behind it since it's your app, then it has no associations to F-Droid.

For GPG, Mullvad shows how to do it with their apps;

https://mullvad.net/en/help/verifying-signatures

THANKS

[shuvashish76]

I personally wouldn't recommend calling it app-fdroid-release, it's just confusing to people

Lots of apps using different builds with fdroid in their release name e.g. https://github.com/ImranR98/Obtainium/releases

gpg verification, so end-users who wish to download directly from you, can more thoroughly authenticate verification, instead of just sha, which is all I noticed for the latest download a sha sum.

They use APK Signature for Android e.g: rainxchzed/Github-Store#209
AppManager is what I use but there are other apps available as well, e.g AppVerifier