4 ms·
The main problem with downloading APKs from the GitHub releases page, is that it doesn't come with a low-friction way of distributing updates. This is especiall
by selfhoster11 5y ago
The main problem with downloading APKs from the GitHub releases page, is that it doesn't come with a low-friction way of distributing updates. This is especially important for unofficial client apps like NewPipe, which basically become bricked at a moment's notice, and updating within a day or two is important to maintain continuity of service.
Not to mention that an app may be hosted on a different platform, perhaps one that doesn't do auto-builds. Or, as was already pointed out, builds do exist but contain telemetry or secret code. In that case, a trusted intermediary (which I trust heck of a lot more than Google) that pulls and compiles the code and then distributes it, is a strictly value-added proposition.
- southerntofu 5y agoThat's a very good point! Although, would it not be trivial to setup a 3rd-party F-Droid-compatible repo that just distributes CI/CD artifacts (eg. Github releases) by subscribing to a RSS feed? I personally wouldn't do it for the reasons you mentioned, but it could certainly be useful for some people.
- kuschku 5y agoIt's easily possible, and many people already do it. e.g. Quasseldroid is available via https://repo.kuschku.de/fdroid/repo/?fingerprint=A0CBC2C29E38ED9542F86A1188412A60C5A756FC4D7A31C4C622242D7AD021F2 https://repo.kuschku.de/fdroid/repo/?fingerprint=A0CBC2C29E3... a custom repo generated from the same CI builds that also get pushed to Google Play.
- southerntofu 5y agoAh yes, but this requires adding one repo per app. I meant having a "single" (though selfhostable) Fdroid gateway to CI artifacts so i could just add "cidroid.org" repository to my Fdroid then choose for each application if i want it from F-droid repo or from fresher CIDroid.
- kuschku 5y agoIt's pretty much the same as PPAs on Ubuntu. For what you're asking for, IzzyDroid's repo may be the closest to what you're asking for.
- southerntofu 5y agoThanks i was not aware of this! It's almost exactly what i was looking for, although admittedly i wanted something more automated (along the lines of here's an RSS feed of releases, use this xpath query to extract the download URLs for various architectures).
- Wonderfall 5y agoFunny you should mention NewPipe since they discourage users from relying on the official F-Droid repo for the very reason of slow updates, which you don't want for an app relying on parsing web pages that are likely to change. The app itself (at least the regular build provided by the developers) sends you a notification once a new update is available. They also maintain a third-party repository, which again is fine at mitigating some issues of the official repository (while breaking the security model because the OS inherently wants one source per app repository, but at least it's more usable than waiting for the F-Droid build to be updated). F-Droid can't do anything against "secret code" since they don't/can't analyze the whole codebase. Like said multiple times, they only run a few scripts on the available source code to remove known trackers, which is known to be a poor approach to privacy.
- selfhoster11 5y agoI actually use direct APK downloads for myself, and F-Droid for my mother, who is far less technical and therefore benefits from the easier end-to-end UX for the update process. Even with delayed updates, having NewPipe unavailable for two or three days is preferable to using the official YouTube app in the Play Store, which doesn't have the features she relies on at all, or a direct APK download that may expose her to the risk of malware. That said, I should really set her up with a third party repository for updates.