Screenshot F-Droid 0.102.3 on Android showing some installed apps
|Developer(s)||Ciaran Gultnieks, F-Droid Limited|
|Initial release||29 September 2010|
|Stable release||1.0.1 (10 October 2017)|
|Development status||Active / >2,500 apps (as of November 2016)|
|Written in||Python (server), PHP (site), Java (client)|
|Operating system||GNU/Linux (server), Android (client)|
|Type||Digital distribution of free software, Software repository|
F-Droid is a software repository (or "app store") for Android applications, similar to the Google Play store. The main repository, hosted by the project, contains only apps that are free and open-source software. Applications can be browsed and installed from the F-Droid website or client app without the need to register for an account. "Anti-features" such as advertising, user tracking, or dependence on non-free software are flagged in app descriptions. The website also offers the source code of applications it hosts, as well as the software running the F-Droid server, allowing anyone to set up their own app repository.
Replicant, a fully free software Android operating system, uses F-Droid as its default and recommended app store.The Guardian Project, a suite of free and secure Android applications, started running their own F-Droid repository in early 2012. In 2012 Free Software Foundation Europe featured F-Droid in their Free Your Android! campaign to raise awareness of the privacy and security risks of proprietary software. F-Droid was chosen as part of the GNU Project's GNU a Day initiative during their 30th anniversary to encourage more use of free software.
In March 2016 F-Droid partnered with The Guardian Project and CopperheadOS with the goal of creating "a solution that can be verifiably trusted from the operating system, through the network and network services, all the way up to the app stores and apps themselves".
The F-Droid repository contains a growing number of more than 2,300 apps, compared to over 1.43 million on the Google Play Store. The project incorporates several software sub-projects:
F-Droid builds apps from publicly available and freely licensed source code. The project is run entirely by volunteers and has no formal app review process. New apps are contributed by user submissions or the developers themselves. The only requirement is that they be free of proprietary software.
To install the F-Droid client the user has to allow installation from "Unknown sources" in Android settings and retrieve the APK (installable file) from the official site. Installation is not available through the Google Play store due to the non-compete clause of the Google Play Developer Distribution Agreement.
The client was designed to be resilient against surveillance, censorship, and unreliable Internet connections. To promote anonymity it supports HTTP proxies and repos hosted on Tor hidden services. Client devices can function as impromptu "app stores" distributing downloaded apps to other devices over local Wi-Fi, Bluetooth, and Android Beam. The F-Droid client app will automatically offer updates for installed F-Droid apps.
The main F-Droid repository uses its own keys to sign packages, so apps previously installed from another source must be reinstalled to receive updates.
The neutrality of this section is disputed. (May 2017) (Learn how and when to remove this template message)
This section relies largely or entirely upon a single source. (May 2017) (Learn how and when to remove this template message)
F-Droid has received criticism for distributing out-of-date versions of official applications and for its approach to application signing.
In 2012, security researcher and developer Moxie Marlinspike criticised F-Droid for distributing out-of-date versions of TextSecure which contained a known bug that had been fixed in the official application. F-Droid removed the application from the repository at the request of Marlinspike. Marlinspike later criticised the project's handling of the issue, stating that they "mischaracterized the scope of [the] bug" and were "incredibly immature" in their post announcing the removal, after he received email from users who had been misled by F-Droid's announcement.
Marlinspike has also been critical of F-Droid's approach to application signing in the main repository. Applications distributed via the Google Play store are signed by the developer of the application, and the Android operating system checks that updates are signed with the same key, preventing others from distributing updates that the developer themselves did not sign. When F-Droid signs the binaries, the application user needs to trust F-Droid rather than the developer of the application, that no malicious update to an application is distributed. A security model based on reproducible builds would reduce the trust the end user would need to place in either.
Day 9: Have an Android phone? Install F-Droid, a repository with hundreds of free software apps.
Manage research, learning and skills at defaultLogic. Create an account using LinkedIn or facebook to manage and organize your IT knowledge. defaultLogic works like a shopping cart for information -- helping you to save, discuss and share.