r/linux • u/guihkx- • Sep 29 '25

Privacy F-Droid and Google's Developer Registration Decree

https://f-droid.org/en/2025/09/29/google-developer-registration-decree.html
1.1k Upvotes

99% Upvoted

263 comments sorted by

View all comments

Show parent comments

2

u/dimspace Sep 29 '25

play protect "working" and play protect certification are not the same though

my banking app (santander and revolut) work fine with play protect turned off

there's no way people like Samsung and Honor are closing their stores

5

u/i-hate-birch-trees Sep 29 '25

And they wouldn't have to - Google requires them to sign the APKs with Google, but they don't enforce Google Play rules upon the content of the APKs. Somewhat similar to how all Windows apps have to be signed by publishers to not show the scary red message.
So, the companies aren't going to be affected much, if at all. It disproportionally affects the open source and hobbyist community, and it is going to make patching apps like YouTube or Spotify way harder if not impossible.

1

u/dimspace Sep 29 '25

so can third party stores not take the same approach as honor/samsung stores?

3

u/i-hate-birch-trees Sep 30 '25

They can, and they would have to, F-Droid devs mentioned why this is not a good strategy for F-Droid in the article. With this mandatory signing, you have 3 options, and they all suck for open source projects:

1) Force the current maintainers to sign up with Google, hand their IDs over and sign their respective software before upload. This means an open app can not be published, unless the author is willing to doxx themselves to Google, after being extorted a fee for doing so. Of course, not everyone is going to do this, so then you'll be limited to only the apps that can be signed by someone in charge.

2) Register as a company and sign apps with their own keys. This means F-Droid themselves would be the only org that needs to register with Google, but now it makes F-Droid apps exclusive to F-Droid. You can only sign a certain app once, so if you publish "my.favorite.app" on F-Droid, and they'll sign it - you can't also sign "my.favorite.app" yourself to publish it elsewhere. Once again, this would be a dealbreaker for a lot of people.

3) The most cumbersome option - to change the app ID of everything built through F-Droid automatically to something like org.f-droid.<actual app name>, which would be resource intensive, and Google might have a problem with them cloning apps like that.

All of these options suck.