I just noticed today that Signal (not talking Molly) is now available on F-Droid via the “Guardian” repository.
Just wanted to give everyone a heads up.
It’s weird that this isn’t mentioned on the signal website or blog? They also distribute the binary with a signature you can check there if you want a non-play store source that’s actually verifiable.
It’s probably not an official thing. F-Droid can’t distribute apps in the official repo via their own policy if the developer doesn’t agree. Third-party repos like Guardian can.
I think they ship prebuilt binaries, i.e. the exact same ones you find on the Signal website
AFAIK this also applies to Tor Browser, Orbot and other third-party apps distributed by Guardian
Edit: I downloaded the files and manually verified the signatures. They are indeed the exact same files.
Because I didn’t really know how to grab an APK from the Guardian F-Droid repo, I used their S3 bucket and downloaded the Signal APK. It’s named Signal-Android-website-prod-universal-release-7.30.2.apk, which is the exact same file name as the one of the APK you can get from the Signal website.
I then used keytool to print the signature certificate fingerprint: (renamed the files to make it less confusing)
keytool -printcert -jarfile signal-website.apk
Signer #1:
Certificate #1:
Owner: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Issuer: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Serial number: 4bfbebba
Valid from: Tue May 25 17:24:42 CEST 2010 until: Tue May 16 17:24:42 CEST 2045
Certificate fingerprints:
SHA1: 45:98:9D:C9:AD:87:28:C2:AA:9A:82:FA:55:50:3E:34:A8:87:93:74
SHA256: 29:F3:4E:5F:27:F2:11:B4:24:BC:5B:F9:D6:71:62:C0:EA:FB:A2:DA:35:AF:35:C1:64:16:FC:44:62:76:BA:26
Signature algorithm name: SHA1withRSA (weak)
Subject Public Key Algorithm: 1024-bit RSA key (weak)
Version: 3
keytool -printcert -jarfile signal-guardian.apk
Signer #1:
Certificate #1:
Owner: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Issuer: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Serial number: 4bfbebba
Valid from: Tue May 25 17:24:42 CEST 2010 until: Tue May 16 17:24:42 CEST 2045
Certificate fingerprints:
SHA1: 45:98:9D:C9:AD:87:28:C2:AA:9A:82:FA:55:50:3E:34:A8:87:93:74
SHA256: 29:F3:4E:5F:27:F2:11:B4:24:BC:5B:F9:D6:71:62:C0:EA:FB:A2:DA:35:AF:35:C1:64:16:FC:44:62:76:BA:26
Signature algorithm name: SHA1withRSA (weak)
Subject Public Key Algorithm: 1024-bit RSA key (weak)
Version: 3
The fingerprints are identical.
Another edit: I just noticed that Signal even has official instructions for checking the signature on their APK download page. They use apksigner instead of keytool, but it’s basically the same process.
I know, it even says so in the post:
I just noticed today that Signal (not talking Molly) is now available on F-Droid via the “Guardian” repository.
Perhaps a result of the proposed ban on distributing tiktok via google and apple is that some developers rethink their distribution mechanisms
Thanks. You can get it by Obtainium too.
Is there anything specifically wrong with molly. It seems more locked down by default and is fully open source. Seems better to me.
Iirc Molly in F-droid still using FCM and the google maps API. If you want Molly-Foss, you have to use Obtanium to pull APKs from their git releases.
Edit: I was wrong, you can get it off their F-Droid repository.
You can also get it from Accrescent
I have a tangential question. Would it not make sense for an OS, in this case Android, to have some proper mechanism for installing apps (in this case APKs) directly from a website (as lots of people have been doing fastidiously from signal.org by necessity)?
After all, this is all about trust. With software, assuming that you trust the developer, the goal is to be sure that nobody interfered with the developer’s compiled software - and who better to guarantee that than the developer themself, at their own domain? DNS resolution is already based on the “web of trust” principle, which is why you can trust your bank’s website. Arguably F-Droid performs a valuable role as a curator and selector of good software, but is there any good technical need for it to actually distribute the software?
Not exactly answering your question but you can use the app Obtainium to fetch the apk URL from a website/github repo and many other sources to install directly. It also supports fdroid repos and many other sources out of the box. Kinda half way what you mentioned in your first paragraph.
Yes true! Forgot about Obtainium. Personally I’m not much tempted because all it does is swap out F-Droid for Github (i.e. Microsoft) as the middleman. But I agree that it’s definitely a win for convenience.
PS: Turns out Obtainium is source-agnostic. Good news.
Of course Github is just an example but you can pretty much regex any URL and further filter out anything in order to get the apk link with it. So depending on your level of privacy requirement and trusted sources, you can skip all the centralized ones and build your own list of sources.
Not sure if this fits your definition of OS, proper, or install, but FWIW you can already download an apk directly from github using most Android browsers and it will open (or give you the option to open) it with the system’s package installer.
Yep and that’s exactly what we doing with Signal to avoid the Play Store. It’s a bit of a PITA and it’s the same on desktop. It’s because they don’t want third parties maintaining their packages.
My crazy utopian idea is for some kind of protocol (or equivalent) that would allow native package managers (mobile or desktop) to “plug in” to the website repos of authors, directly.
Isn’t this basically the same thing as clicking a .apk or .exe link in a browser (which already works on mobile/desktop)?
