Episode Details

F-Droid has been the oldest surviving alternative to the Play Store since 2010 — and its small catalog is a feature, not a bug. This episode unpacks the architecture that makes it work: a signed XML index, a client that pulls instead of a server that pushes, and a build process that compiles apps from public source on F-Droid's own infrastructure. That design is why five different front ends — the official client, Droid-ify, Neo Store, and others — can all read the same catalog, and why VirusTotal scanning is a smoke detector rather than a guarantee. We walk through the real safety practices for sideloading, from signature verification to repository fingerprint checks to the thirty-second permission review, and rank the trust models from F-Droid's main repo down to third-party aggregators. Then we flip to the contributor side: the fdroiddata merge request, the YAML build recipe, the human review that can take months, and why a single proprietary dependency like Firebase can keep an open source app out of the main repo entirely. Episode #226860 — open it directly at myweirdprompts.com/226860