[Proposal] Request app inclusion in the IzzyOnDroid F-Droid repo

[Fs00]

I've recently learned about the IzzyOnDroid repository, which is an alternative F-Droid repo that distributes original APKs of FOSS apps pulled in directly from their respective source repositories (in our case that would be GitHub releases). I think that it would be a great alternative for making OctoDroid available to end users, because:

• the app can then be downloaded and updated using existing F-Droid clients, but APKs are the same ones that can be obtained on GitHub
• update availability is faster compared to the main F-Droid repo: as far as I've seen, updates are available in the repository in less than a day once the release is published on GH (F-Droid instead takes at least 2 days)
• the APK only needs to be built and uploaded to GH releases and nowhere else

To request the inclusion of the app in the repository, we only need to open an issue on their Gitlab. I'm happy to do that if you're fine with it @maniac103.

As far as I've seen, there is only a potential hurdle for inclusion in the repo: they seem to be a bit strict against the REQUEST_INSTALL_PACKAGES permission, mainly because it could potentially be used by auto-updaters to "download additional executable binary files without explicit user consent", which would be against the inclusion policy. Since OctoDroid doesn't fall into that scenario, I'm confident that we can fulfill the requirements for inclusion without the need to remove the permission. Another thing they look at - for which the repository website displays a warning, but doesn't prevent inclusion - is whether the APK contains the DEPENDENCY_INFO_BLOCK, an encrypted/obfuscated signing block added by default by Android build tools (more info here) which can be easily removed (I plan to open a PR for that).

Let me know your thoughts!

[maniac103]

I'm totally fine with that. NB: F-Droid can use pre signed APKs as well nowadays (I've used this recently), but obviously that's too late for Octodroid.

[Fs00]

I've tagged you on the inclusion request to ask your opinion, because it appears that the current APK signing key uses a weak algorithm and key size. It's an issue that probably needs to be fixed regardless of the inclusion in the repository...