F-Droid

{{Short description|Free and open source Android app repository}}

{{Infobox software

| title = F-Droid

| name = F-Droid

| logo = F-Droid Logo 4.svg

| logo size = 64px

| logo alt = Official F-Droid logo

| screenshot = 222px

| latest release version = {{LSR/wikidata}}

| caption = Screenshot of F-Droid 1.19.0 on Android showing the latest apps

| developer = {{wikidata|property|references|edit|P178}}

| released = {{wikidata|property|references|edit|P577}}

| programming language = Python (server tools), Jekyll (software) (site), Java (client)

| operating system = Android (client), Linux, macOS, Windows 10, FreeBSD (server)

| genre = Digital distribution of free software, Software repository

| license = {{wikidata|property|references|edit|P275}}

}}

F-Droid is a free and open source app store and software repository for Android, serving a similar function to the Google Play store. The main repository, hosted by the project, contains only free and open source apps. Applications can be browsed, downloaded and installed from the F-Droid website or client app without the need to register an account. "Anti-features" such as advertising, user tracking, or dependence on non-free software are flagged in app descriptions.{{cite web|title=Client 0.54 released|publisher=F-droid.org|url=https://f-droid.org/posts/client-0-54-released/|date=5 November 2013|url-status=dead|archive-url=https://web.archive.org/web/20150426020000/https://f-droid.org/posts/client-0-54-released/|archive-date=26 April 2015|df=dmy-all }}

The website also offers the source code of applications it hosts, as well as the software running the F-Droid server, allowing anyone to set up their own app repository.{{cite web|url=https://www.androidcentral.com/f-droid-foss-application-store-your-android-phone|title=F-Droid is the FOSS application store for your Android phone|last=Hildenbrand|first=Jerry|date=27 November 2012|work=Android Central|archive-url=https://web.archive.org/web/20180616130200/https://www.androidcentral.com/f-droid-foss-application-store-your-android-phone|archive-date=16 June 2018|url-status=dead|access-date=29 August 2013}}{{cite web|url=http://www.thepowerbase.com/2012/08/f-droid-the-android-market-that-respects-your-rights/|title=F-Droid: The Android Market That Respects Your Rights|last=Nardi|first=Tom|date=27 August 2012|work=The Powerbase|archive-url=https://web.archive.org/web/20131203061021/http://www.thepowerbase.com/2012/08/f-droid-the-android-market-that-respects-your-rights/|archive-date=3 December 2013|url-status=dead|access-date=29 August 2013}}{{cite web|title=F-Droid Server Manual|url=https://f-droid.org/manual/|access-date=30 August 2013 |archive-url=https://web.archive.org/web/20131106051022/https://f-droid.org/manual/|archive-date=6 November 2013|url-status=live}}

History

File:Commits by year month.png

F-Droid was founded by Ciaran Gultnieks in 2010. The client was forked from Aptoide's source code.{{cite web|url=http://gitorious.org/f-droid/fdroidclient/source/0b71cb7e7331fb73ee762225d0225fd92ce99010:src/org/fdroid/fdroid|title=F-Droid initial source code|date=19 October 2010|work=F-Droid|archive-url=https://web.archive.org/web/20141210121308/https://gitorious.org/f-droid/fdroidclient/source/0b71cb7e7331fb73ee762225d0225fd92ce99010%3Asrc/org/fdroid/fdroid|archive-date=10 December 2014|url-status=dead|access-date=10 December 2014}}{{cite web |url=https://f-droid.org/about/ |title=F Droid About |access-date=28 January 2014 |archive-url=https://web.archive.org/web/20140123124323/https://f-droid.org/about/ |archive-date=23 January 2014 |url-status=live }} The project was initially run by the English nonprofit F-Droid Limited. As of 2021, F-Droid Limited was no longer used for donations,{{Cite web |last=F-Droid |title=Donations {{!}} F-Droid |url=https://f-droid.org/donate/ |access-date=2022-05-10 |website=F-Droid |archive-date=10 May 2022 |archive-url=https://web.archive.org/web/20220510183629/https://f-droid.org/donate/ |url-status=live }} and was being shut down, according to spokesman Hans-Cristoph Steiner.{{Cite web |title=Apply for the GitLab Open Source Program (#223) · Issues · F-Droid / admin · GitLab |url=https://gitlab.com/fdroid/admin/-/issues/223 |access-date=2022-05-10 |website=GitLab |date=8 May 2021 |language=en |archive-date=10 May 2022 |archive-url=https://web.archive.org/web/20220510183003/https://gitlab.com/fdroid/admin/-/issues/223 |url-status=live }}

In a 2014 interview for Free Software Foundation, Gultnieks said he was inspired to launch F-Droid because of "lock-down, lock-in and general nefarious behavior from software" on phones.{{Cite web |title=Interview with Ciaran Gultnieks of F-Droid — Free Software Foundation — Working together for free software |url=https://www.fsf.org/blogs/licensing/interview-with-ciaran-gultnieks-of-f-droid |access-date=2022-04-21 |website=www.fsf.org |archive-date=4 June 2022 |archive-url=https://web.archive.org/web/20220604204453/https://www.fsf.org/blogs/licensing/interview-with-ciaran-gultnieks-of-f-droid |url-status=live }}

From 2010 to 2015, F-Droid used the AGPL-licensed Gitorious repository system for development.{{Cite web |date=2010-12-25 |title=F-Droid - Gitorious |url=http://gitorious.org/f-droid |access-date=2022-04-21 |website= |archive-url=https://web.archive.org/web/20101225035010/http://gitorious.org/f-droid |archive-date=25 December 2010 |url-status=dead}} In 2015, it transitioned to proprietary licensed GitLab{{Cite web |title=ee/LICENSE · master · GitLab.org / GitLab · GitLab |url=https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/LICENSE |access-date=2022-05-11 |website=GitLab |language=en |archive-date=2 July 2022 |archive-url=https://web.archive.org/web/20220702113300/https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/LICENSE |url-status=live }} when Gitorious was acquired by GitLab. According to Daniel Marti, Former F-Droid Developer, in 2013, removal of AdAway from the Google Play Store caused a spike in searches and downloads of F-Droid, and he estimated there were 30 to 40 thousand users.{{Cite web |last=Martí |first=Daniel |date=February 2014 |title=F-Droid |url=https://archive.fosdem.org/2014/schedule/event/f_droid/ |access-date=2022-04-21 |website=archive.fosdem.org |language=en}}

Replicant, a fully free software Android operating system, previously used F-Droid as its default and recommended app store.{{cite web|title=FDroid: a free software alternative to Google Market|publisher=Replicant Project|date=26 November 2010|url=https://blog.replicant.us/2010/11/fdroid-a-free-software-alternative-to-google-market/|access-date=17 January 2015|archive-url=https://web.archive.org/web/20150117124502/http://blog.replicant.us/2010/11/fdroid-a-free-software-alternative-to-google-market/|archive-date=17 January 2015|url-status=live}}{{cite web|title=FDroid|work=Replicant Wiki|url=https://redmine.replicant.us/projects/replicant/wiki/DeprecatedFDroid|access-date=8 March 2018|archive-url=https://web.archive.org/web/20180309054444/https://redmine.replicant.us/projects/replicant/wiki/DeprecatedFDroid|archive-date=9 March 2018|url-status=live}} In 2016, the Replicant project determined F-Droid did not comply with GNU Free System Distribution Guidelines, on the grounds that some of the software it offers promotes or depends on non-free software. Replicant asked for assistance correcting it, but progress stalled.{{Cite web |title=Replicant 6.0 early work, upstream work and F-Droid issue {{!}} Replicant |url=https://blog.replicant.us/2016/08/replicant-6-early-work-upstream-work-and-f-droid-issue/ |access-date=2022-04-21 |website=blog.replicant.us |date=8 August 2016 |language=en-US |archive-date=6 July 2022 |archive-url=https://web.archive.org/web/20220706074637/https://blog.replicant.us/2016/08/replicant-6-early-work-upstream-work-and-f-droid-issue/ |url-status=live }} In June 2022, Replicant announced they had removed F-Droid.{{Cite web |last=GNUtoo |title=New Replicant 6.0 0004 release and Replicant 11 status. {{!}} Replicant |date=3 June 2022 |url=https://blog.replicant.us/2022/06/new-replicant-6-0-0004-release-and-replicant-11-status/ |access-date=2022-08-03 |language=en-US |archive-date=14 May 2017 |archive-url=https://web.archive.org/web/20170514204023/https://blog.replicant.us/2017/05/replicant-6-0-released/ |url-status=live }}

Guardian Project, a suite of free and secure Android applications, started running their own F-Droid repository in early 2012.{{cite web|url=https://guardianproject.info/2012/03/15/our-new-f-droid-app-repository/|title=Our New F-Droid App Repository|date=15 March 2012|publisher=The Guardian Project|archive-url=https://web.archive.org/web/20170323101444/https://guardianproject.info/2012/03/15/our-new-f-droid-app-repository/|archive-date=23 March 2017|url-status=dead|access-date=29 August 2013}} In 2012, Free Software Foundation Europe featured F-Droid in their Free Your Android! campaign to raise awareness of the privacy and security risks of proprietary software.{{cite news|last1=Walker-Morgan|first1=Dj|title=FSFE launches "Free Your Android!" campaign|publisher=H-online|date=28 February 2012|url=http://www.h-online.com/open/news/item/FSFE-launches-Free-Your-Android-campaign-1444629.html|access-date=27 July 2014|archive-url=https://web.archive.org/web/20140723045318/http://www.h-online.com/open/news/item/FSFE-launches-Free-Your-Android-campaign-1444629.html|archive-date=23 July 2014|url-status=live}}{{cite web|title=Liberate Your Device!|publisher=Free Software Foundation Europe|url=https://fsfe.org/campaigns/android/liberate.en.html|access-date=27 July 2014|archive-url=https://web.archive.org/web/20140815235719/https://fsfe.org/campaigns/android/liberate.en.html|archive-date=15 August 2014|url-status=live}}

In 2014, F-Droid was chosen as part of the GNU Project's GNU a Day initiative during their 30th anniversary to encourage more use of free software.{{cite web|title=GNU-a-Day|publisher=GNU Project|url=https://www.gnu.org/gnu30/gnu-a-day/|access-date=23 July 2014|archive-url=https://web.archive.org/web/20140728024030/https://www.gnu.org/gnu30/gnu-a-day/|archive-date=28 July 2014|url-status=live}}

In January 2016, Hans-Christoph Steiner, a developer for Calyx Institute,{{Cite web |title=Team - Calyx Institute |url=https://calyxinstitute.org/about/team |access-date=2022-04-21 |website=calyxinstitute.org |archive-date=9 April 2022 |archive-url=https://web.archive.org/web/20220409072746/https://calyxinstitute.org/about/team |url-status=live }} Debian, F-Droid, and Guardian Project, said F-Droid was focusing on issues like security, building with Debian, reproducible builds, software requiring trust of as few people as possible, transparency, user privacy, non-internet distribution of apps, block avoidance, and media distribution.{{Cite web |last=Steiner |first=Hans-Christoph |date=January 2016 |title=F-Droid: building the private, unblockable app store |url=https://archive.fosdem.org/2016/schedule/event/fdroidappstore/ |access-date=2022-04-21 |website=archive.fosdem.org |language=en}}

In March 2016, F-Droid partnered with the Guardian Project and CopperheadOS with the goal of creating "a solution that can be verifiably trusted from the operating system, through the network and network services, all the way up to the app stores and apps themselves".{{cite web|url=https://guardianproject.info/2016/03/28/copperhead-guardian-project-and-f-droid-partner-to-build-open-verifiably-secure-mobile-ecosystem/|title=Copperhead, Guardian Project and F-Droid Partner to Build Open, Verifiably Secure Mobile Ecosystem|date=28 March 2016|publisher=The Guardian Project|archive-url=https://web.archive.org/web/20160420170541/https://guardianproject.info/2016/03/28/copperhead-guardian-project-and-f-droid-partner-to-build-open-verifiably-secure-mobile-ecosystem|archive-date=20 April 2016|url-status=live|access-date=19 April 2016}} Follow-on project GrapheneOS does not include F-Droid, and is developing their own app distribution method for "higher robustness and security".{{Cite web |title=Frequently Asked Questions {{!}} GrapheneOS |url=https://grapheneos.org/faq |access-date=2022-04-21 |website=grapheneos.org |language=en |archive-date=5 February 2023 |archive-url=https://web.archive.org/web/20230205015554/https://grapheneos.org/faq |url-status=live }}

On 16 July 2019, the project published a "Public Statement on Neutrality of Free Software". This statement was issued to address the project's failure to prevent "oppression or harassment ... at its communication channels, including its forum", controversy surrounding alt-tech social media website Gab, and to explain how Fediverse client Tusky blocking access to it, while client Fedilab allowed its users to choose, was consistent with their principles.{{Cite web |title=Public Statement on Neutrality of Free Software |website=F-Droid |url=https://f-droid.org/en/2019/07/16/statement.html.en |access-date=2020-08-03 |archive-date=7 August 2020 |archive-url=https://web.archive.org/web/20200807110506/https://f-droid.org/en/2019/07/16/statement.html.en |url-status=live }}{{Cite web|last=Robertson|first=Adi|date=2019-07-12|title=How the biggest decentralized social network is dealing with its Nazi problem|url=https://www.theverge.com/2019/7/12/20691957/mastodon-decentralized-social-network-gab-migration-fediverse-app-blocking|access-date=2021-02-10|website=The Verge|language=en|archive-date=16 July 2019|archive-url=https://web.archive.org/web/20190716234621/https://www.theverge.com/2019/7/12/20691957/mastodon-decentralized-social-network-gab-migration-fediverse-app-blocking|url-status=live}}{{Cite web |title=TWIF 64: We are back! |website=F-Droid |url=https://f-droid.org/en/2019/07/11/twif-64-we-are-back.html.en |access-date=2021-02-08 |archive-date=14 February 2021 |archive-url=https://web.archive.org/web/20210214172740/https://f-droid.org/en/2019/07/11/twif-64-we-are-back.html.en |url-status=live }}{{Cite web|title=Fedilab (fr.gouv.etalab.mastodon) and FreeTusky (com.thechiefmeat.freetusky) explicitly promote violence (#1736) · Issues · F-Droid / Data|url=https://gitlab.com/fdroid/fdroiddata/-/issues/1736|access-date=2021-02-08|website=GitLab|date=8 August 2019|language=en|archive-date=6 August 2020|archive-url=https://web.archive.org/web/20200806021836/https://gitlab.com/fdroid/fdroiddata/-/issues/1736|url-status=live}} Action was considered against several applications, including Purism's Librem One, to exclude them for allowing access to sites such as Gab or spinster.xyz.{{Cite web|title=remove spinster app (!6013) · Merge Requests · F-Droid / Data|url=https://gitlab.com/fdroid/fdroiddata/-/merge_requests/6013|access-date=2021-01-21|website=GitLab|date=3 December 2019|language=en|archive-date=28 January 2021|archive-url=https://web.archive.org/web/20210128154237/https://gitlab.com/fdroid/fdroiddata/-/merge_requests/6013|url-status=live}}{{Cite web|title=depackage Clover (org.floens.chan), Overchan, Overchan (fork), Ouroboros (#1722) · Issues · F-Droid / Data|url=https://gitlab.com/fdroid/fdroiddata/-/issues/1722|access-date=2021-02-08|website=GitLab|date=4 August 2019|language=en|archive-date=11 January 2021|archive-url=https://web.archive.org/web/20210111124306/https://gitlab.com/fdroid/fdroiddata/-/issues/1722|url-status=live}}{{Cite web|title=Consider Depackaging Librem One Apps (#1734) · Issues · F-Droid / Data|url=https://gitlab.com/fdroid/fdroiddata/-/issues/1734|access-date=2021-02-08|website=GitLab|date=7 August 2019|language=en|archive-date=25 January 2021|archive-url=https://web.archive.org/web/20210125134434/https://gitlab.com/fdroid/fdroiddata/-/issues/1734|url-status=live}}

According to Ankush Das writing for ItsFoss.com in 2021, F-Droid is known for hosting open-source apps such as Element or Tusky (later reinstated){{When|date=October 2024|reason=Reinstated on Google Play}} that have been removed from Google Play Store.{{Cite web |date=2021-03-18 |title=Decentralized Networks Under Attack? Google Removes Open-Source Mastodon Client "Tusky" from the Play Store |url=https://news.itsfoss.com/tusky-removed-play-store/ |access-date=2022-04-22 |website=It's FOSS News |language=en-US |archive-date=23 May 2022 |archive-url=https://web.archive.org/web/20220523142603/https://news.itsfoss.com/tusky-removed-play-store/ |url-status=live }}

Scope of project

The F-Droid website lists the apps hosted, over 3,800;{{cite web|title=F-Droid Main Repository|url=https://f-droid.org/en/packages/|access-date=7 February 2021|website=F-Droid|archive-date=8 February 2021|archive-url=https://web.archive.org/web/20210208121808/https://f-droid.org/en/packages/|url-status=live}} the Google Play Store lists about 3 million apps.{{Cite web |title=Number of available applications in the Google Play Store from December 2009 to December 2020 |author= |work=Statista |date=4 February 2021 |access-date=7 February 2021 |url=https://www.statista.com/statistics/266210/number-of-available-applications-in-the-google-play-store/ |archive-date=6 December 2020 |archive-url=https://web.archive.org/web/20201206141741/https://www.statista.com/statistics/266210/number-of-available-applications-in-the-google-play-store/ |url-status=live }} The project incorporates several software sub-projects:

Client software for searching, downloading, verifying, and updating Android apps from an F-Droid repository
fdroidserver – tool for managing existing repositories and creating new ones
Jekyll-based website generator for a repository

F-Droid builds apps from publicly available and freely licensed source code. New apps, which must be free of proprietary software, are contributed by user submissions or the developers themselves.{{cite web|url=https://f-droid.org/wiki/page/Inclusion_Policy|title=Inclusion Policy|date=4 April 2014|publisher=F-Droid|archive-url=https://web.archive.org/web/20150325030726/http://f-droid.org/wiki/page/Inclusion_Policy|archive-date=25 March 2015|url-status=live|access-date=29 March 2015}} F-Droid tries to check the source code and remove issues, but warns that the checking is not exhaustive.{{cite web |title=About | F-Droid - Free and Open Source Android App Repository |publisher=F-Droid |url=https://staging.f-droid.org/en/about/ |access-date=25 May 2024 |archive-date=25 May 2024 |archive-url=https://web.archive.org/web/20240525040223/https://staging.f-droid.org/en/about/ |url-status=live }} Many app stores, such as Google Play and Apple's App Store, screen apps mostly using automated tools only; malware with defeat devices can pass these tests, by detecting when the software is being automatically tested and delaying malicious activity.{{cite magazine |last1=Barrett |first1=Brian |title=How 18 Malware Apps Snuck Into Apple's App Store |url=https://www.wired.com/story/apple-app-store-malware-click-fraud/ |magazine=Wired |access-date=25 May 2024 |archive-date=25 May 2024 |archive-url=https://web.archive.org/web/20240525034307/https://www.wired.com/story/apple-app-store-malware-click-fraud/ |url-status=live }}{{cite web |last1=Whittaker |first1=Zack |title=Millions downloaded dozens of Android apps from Google Play that were infected with adware |url=https://techcrunch.com/2019/10/24/millions-dozens-android-apps-adware/ |website=TechCrunch |date=24 October 2019 |access-date=25 May 2024 |archive-date=25 May 2024 |archive-url=https://web.archive.org/web/20240525034308/https://techcrunch.com/2019/10/24/millions-dozens-android-apps-adware/ |url-status=live }}{{cite magazine |last1=Newman |first1=Lily Hay |title=Never Ever (Ever) Download Android Apps Outside of Google Play |url=https://www.wired.com/2016/12/never-ever-ever-download-android-apps-outside-google-play/ |magazine=Wired |access-date=25 May 2024 |archive-date=25 May 2024 |archive-url=https://web.archive.org/web/20240525034307/https://www.wired.com/2016/12/never-ever-ever-download-android-apps-outside-google-play/ |url-status=live }}

The project describes itself as having a core of volunteers;{{cite web|url=https://f-droid.org/contribute/|title=Contribute|publisher=F-Droid|archive-url=https://web.archive.org/web/20150318142136/https://f-droid.org/contribute/|archive-date=18 March 2015|url-status=live|access-date=29 March 2015}} some contributors have been paid for their work.{{Cite web|title=F-Droid · Expenses - Open Collective|url=https://opencollective.com/f-droid/expenses|access-date=2021-02-09|website=opencollective.com|language=en|archive-date=23 September 2020|archive-url=https://web.archive.org/web/20200923075244/https://opencollective.com/f-droid/expenses|url-status=live}}{{Cite web|title=Payout request (#194) · Issues · F-Droid / admin|url=https://gitlab.com/fdroid/admin/-/issues/194|access-date=2021-02-09|website=GitLab|date=5 January 2021|language=en|archive-date=1 March 2021|archive-url=https://web.archive.org/web/20210301011613/https://gitlab.com/fdroid/admin/-/issues/194|url-status=live}}{{Cite web|title=Mozilla Speed Dating grant payout and further work (#189) · Issues · F-Droid / admin|url=https://gitlab.com/fdroid/admin/-/issues/189|access-date=2021-02-09|website=GitLab|date=5 October 2020|language=en|archive-date=31 October 2021|archive-url=https://web.archive.org/web/20211031223115/https://gitlab.com/fdroid/admin/-/issues/189|url-status=live}}

Client application

File:Get it on F-Droid (material design).svg

File:Droid-ify v0.5.5.png is a F-Droid client with Material UI focused on user experience. It is an alternative to the official F-Droid client, also using the F-Droid app repository.{{cite web |title=Overview · Droid-ify |url=https://droidify.eu.org/overview |website=droid-ify.org |access-date=9 April 2025 |language=en |date=10 January 2024}}{{cite web |last1=Kanellakos |first1=John |title=You won't find these 9 excellent apps anywhere on the Google Play Store |url=https://www.pocket-lint.com/best-android-apps-from-f-droid/ |website=Pocket-lint |access-date=9 April 2025 |language=en |date=12 March 2025}}{{cite web |last1=Myrick |first1=Andrew |title=Here's how I'm slowly moving away from relying on the Play Store |url=https://www.androidcentral.com/apps-software/the-play-store-sucks-so-heres-what-i-use-instead |website=Android Central |access-date=9 April 2025 |language=en |date=19 February 2025}}{{cite web |last1=Rasool |first1=Faisal |title=4 Awesome Alternatives to the Google Play Store |url=https://www.howtogeek.com/4-awesome-alternatives-to-the-google-play-store/ |website=How-To Geek |access-date=9 April 2025 |language=en |date=30 June 2024}}{{cite web |last1=König |first1=Björn |title=Droid-ify: App Store im Test |url=https://www.teltarif.de/apps-android-test/news/95860.html |website=www.teltarif.de |access-date=9 April 2025 |language=de |date=26 June 2024}}]]

F-Droid is not available on the Google Play Store. To install the F-Droid client, the user has to allow installation from "Unknown sources" in Android settings{{cite web|url=https://developer.android.com/distribute/marketing-tools/alternative-distribution.html|title=Android Open Distribution |date=31 October 2012|access-date=31 October 2012|archive-url=https://web.archive.org/web/20180324010259/https://developer.android.com/distribute/marketing-tools/alternative-distribution.html|archive-date=24 March 2018|url-status=live}} and retrieve the F-Droid Android application package (.apk file) from the official site.

The client was designed to be resilient against surveillance, censorship, and unreliable Internet connections. To promote anonymity, it supports HTTP proxies and repositories hosted on Tor onion services. Client devices can function as impromptu "app stores", distributing downloaded apps to other devices over local Wi-Fi and Bluetooth.{{cite web|url=https://f-droid.org/posts/client-0-76-released/|title=Client 0.76 Released|date=14 October 2014|publisher=F-Droid|archive-url=https://web.archive.org/web/20170202032348/https://f-droid.org/posts/client-0-76-released/|archive-date=2 February 2017|url-status=dead|access-date=28 March 2015}}{{cite web|url=https://www.theverge.com/2014/6/10/5794406/what-do-you-do-when-the-internet-turns-off|title=Your survival guide for an internet blackout|last=Brandom|first=Russell|date=10 June 2014|work=The Verge|archive-url=https://web.archive.org/web/20140808043706/http://www.theverge.com/2014/6/10/5794406/what-do-you-do-when-the-internet-turns-off|archive-date=8 August 2014|url-status=live|access-date=2 August 2014}} The F-Droid client app automatically offers updates for installed F-Droid apps; when the F-Droid Privileged Extension is installed, updates can also be installed by the app itself in the background.{{cite web|url=https://f-droid.org/en/packages/org.fdroid.fdroid.privileged/|title=F-Droid Privileged Extension|publisher=F-Droid|archive-url=https://web.archive.org/web/20180619062756/https://f-droid.org/en/packages/org.fdroid.fdroid.privileged/|archive-date=19 June 2018|url-status=live|access-date=19 June 2018}} However, automatic updates are not turned on by default.{{Cite magazine|last=Orphanides|first=K. G.|date=2021-01-14|title=How to move all your WhatsApp groups and get started on Signal|language=en-GB|magazine=Wired UK|url=https://www.wired.co.uk/article/signal-app-privacy-security-features|access-date=2021-02-10|issn=1357-0978|archive-date=14 January 2021|archive-url=https://web.archive.org/web/20210114062424/https://www.wired.co.uk/article/signal-app-privacy-security-features|url-status=live}} The extension requires the device to have root access, or to be able to flash a zip file.{{cite web|url=https://f-droid.org/en/packages/org.fdroid.fdroid.privileged.ota/|title=org.fdroid.fdroid.privileged.ota_2070|publisher=F-Droid|archive-url=https://web.archive.org/web/20180619062746/https://f-droid.org/en/packages/org.fdroid.fdroid.privileged.ota/|archive-date=19 June 2018|url-status=live|access-date=19 June 2018}}

Key management

The Android operating system checks that updates are signed with the same key, preventing others from distributing updates that are signed by a different key.{{cite web|url=https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13447074|title=moxie0 commented Feb 12, 2013|last=Marlinspike|first=Moxie|author-link=Moxie Marlinspike|date=12 February 2013|via=GitHub|archive-url=https://web.archive.org/web/20180110213421/https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13447074|archive-date=10 January 2018|url-status=live}}{{cite web|url=https://developer.android.com/tools/publishing/app-signing.html|title=Signing Your Applications|website=Android Developers|publisher=Google|archive-url=https://web.archive.org/web/20160415031947/http://developer.android.com/tools/publishing/app-signing.html|archive-date=15 April 2016|url-status=live|access-date=16 April 2016}} Originally, the Google Play store required applications to be signed by the developer of the application, while F-Droid only allowed its own signing keys. So apps previously installed from another source have to be reinstalled to receive updates.{{cite web|url=https://f-droid.org/wiki/page/Release_Channels_and_Signing_Keys|title=Release Channels and Signing Keys|date=12 August 2014|publisher=F-Droid|archive-url=https://web.archive.org/web/20150402180343/https://f-droid.org/wiki/page/Release_Channels_and_Signing_Keys|archive-date=2 April 2015|url-status=live|access-date=29 March 2015}}

In September 2017 Google Play started offering developers a signing key service managed by Google Play,{{cite web|url=https://android-developers.googleblog.com/2017/09/enroll-for-app-signing-in-google-play.html|title=Enroll for app signing in the Google Play Console & secure your app using Google's robust security infrastructure|last=Glick|first=Kobi|date=6 September 2017|website=Android Developers Blog|publisher=Google|archive-url=https://web.archive.org/web/20180710225238/https://android-developers.googleblog.com/2017/09/enroll-for-app-signing-in-google-play.html|archive-date=10 July 2018|url-status=live|access-date=16 April 2016}} offering a similar service to what F-Droid offered since 2011, and F-Droid now lets developers use their own keys via the reproducible build process.{{cite web|url=https://f-droid.org/docs/Reproducible_Builds/|title=Reproducible Builds|publisher=F-Droid|access-date=10 July 2018|archive-url=https://web.archive.org/web/20180711022101/https://f-droid.org/docs/Reproducible_Builds/|archive-date=11 July 2018|url-status=live}}

Security issues

In 2012, F-Droid announced they had removed an app because of a security flaw that could leak personal information.{{Cite web |last=F-Droid |date=2012-08-23 |title=Security Notice – TextSecure |url=https://f-droid.org/2012/08/23/security-notice-textsecure.html |access-date=2022-04-21 |website=F-Droid.org |archive-date=13 December 2017 |archive-url=https://web.archive.org/web/20171213204020/https://f-droid.org/2012/08/23/security-notice-textsecure.html |url-status=live }} In 2017, F-Droid stated "No malware has been found in f-droid.org in its 7 years of operation."{{Cite web |last=F-Droid |date=2017-12-13 |title=F-Droid and the Janus Vulnerability |url=https://f-droid.org/en/2017/12/13/fdroid-and-janus.html |access-date=2022-04-21 |website=F-Droid.org |archive-date=21 April 2022 |archive-url=https://web.archive.org/web/20220421195114/https://f-droid.org/en/2017/12/13/fdroid-and-janus.html |url-status=live }} In 2022, F-Droid discovered over 20 distributed applications contained "known vulnerabilities".{{Cite web |title=Flag many apps with KnownVuln (!11496) · Merge requests · F-Droid / Data · GitLab |url=https://gitlab.com/fdroid/fdroiddata/-/merge_requests/11496 |access-date=2022-12-06 |website=GitLab |date=August 2022 |language=en |archive-date=6 December 2022 |archive-url=https://web.archive.org/web/20221206083256/https://gitlab.com/fdroid/fdroiddata/-/merge_requests/11496 |url-status=live }}

Reception

In August 2019, Rae Hodge of CNET recommended F-Droid as a way to avoid malware from Google apps, which according to Google was a low risk. Advantages of F-Droid were said to include better security odds of open source software, avoidance of tracking in apps and a "stringent security auditing process", no hidden costs, and greater customization. Disadvantages were said to be lack of a rating system, only about 2,600 apps in F-Droid, versus more than 2.5 million in the Play store, and more manual process for updating apps. Editors cautioned F-Droid can give users more control and better privacy and security, but also takes more diligence.{{Cite web |last=Hodge |first=Ron |date=6 August 2019 |title=Fight Android malware by quitting Google Play and using F-Droid for Android apps |url=https://www.cnet.com/tech/mobile/fight-android-malware-by-quitting-google-play-and-using-f-droid-to-install-android-apps/ |access-date=2023-06-03 |website=CNET |language=en |archive-date=3 June 2023 |archive-url=https://web.archive.org/web/20230603122839/https://www.cnet.com/tech/mobile/fight-android-malware-by-quitting-google-play-and-using-f-droid-to-install-android-apps/ |url-status=live }}

In an April 2022 detailed article for HowtoGeek, Joe Fedewa wrote "The selection of apps is much smaller in F-Droid than the Play Store, around 3,000 compared to around 3 million, but that's to be expected. If you're looking to de-Google your life a bit, or you just want to try some apps that have better ethics, F-Droid is a great place to go."{{Cite web |last=Fedewa |first=Joe |title=What Is F-Droid and How Is It Different From the Play Store? |url=https://www.howtogeek.com/790674/what-is-f-droid-and-how-is-it-different-from-the-play-store/ |access-date=2023-04-13 |website=How-To Geek |date=18 April 2022 |language=en-US |archive-date=13 April 2023 |archive-url=https://web.archive.org/web/20230413214325/https://www.howtogeek.com/790674/what-is-f-droid-and-how-is-it-different-from-the-play-store/ |url-status=live }}

In a December 2022 detailed article in Popular Science, Justin Pot wrote "F-Droid isn't going to replace Google Play for most people, but it's a nice and simple alternative for finding free and safe apps before you dive into the swamp that is Google's app store."{{Cite web |date=2022-12-24 |title=How to set up F-Droid, the open-source alternative to the Google Play Store |url=https://www.popsci.com/diy/f-droid-download/ |access-date=2023-04-13 |website=Popular Science |language=en-US |archive-date=13 April 2023 |archive-url=https://web.archive.org/web/20230413214324/https://www.popsci.com/diy/f-droid-download/ |url-status=live }}