This app contains a growing database of signatures so you can verify that APKs you get are legit. Make sure to submit all the playstore apps you rely on, as those are especially affected!
Vadhod APK Extractor contains AI code but only updated and well working app I know that can extract split-APKs and regular ones. Also it doesnt need file permission!
Universal Installer allows you to install split-APK files like you might get from extracting Playstore apps.
It might be a good idea to make an F-Droid repo with essential proprietary apps, as the combination with VerifiedApps allows users to not need to trust the repo but be able to verify the App’s origin securely. Android will only allow updates if the signature matches, so you only need to do this once on install.
Note that Obtainium+Apkpure have frequently installed 32bit APKs on recent Android phones that still supported those, which is a security issue. Might not happen if your phone doesnt even support them anymore like recent Pixels do.
The title is misleading, GrapheneOS users are the only ones who have an alternative lol
Most other open source Android builds simply rely on Aurorastore and we see how unreliable that is
/e/OS uses some weird shady appstore that contains a lot of playstore malware (literally anything) and is completely intransparent.
Apkmirror and apkpure rely on other people extracting and uploading APKs.
Tips for everyone
Install the following apps:
VerifiedAppsAndroid (Github) also available through their F-Droid repo
This app contains a growing database of signatures so you can verify that APKs you get are legit. Make sure to submit all the playstore apps you rely on, as those are especially affected!
Signature of the app:
org.privacyguides.verifiedapps 40:5C:6B:D2:CA:7C:3A:AE:8F:46:3C:6F:8B:55:BC:F0:DD:AC:43:1C:5E:D8:EA:FF:65:D1:06:C9:81:7A:20:7FVadhod APK Extractor contains AI code but only updated and well working app I know that can extract split-APKs and regular ones. Also it doesnt need file permission!
Universal Installer allows you to install split-APK files like you might get from extracting Playstore apps.
It might be a good idea to make an F-Droid repo with essential proprietary apps, as the combination with VerifiedApps allows users to not need to trust the repo but be able to verify the App’s origin securely. Android will only allow updates if the signature matches, so you only need to do this once on install.
Note that Obtainium+Apkpure have frequently installed 32bit APKs on recent Android phones that still supported those, which is a security issue. Might not happen if your phone doesnt even support them anymore like recent Pixels do.