• leinardi@lemmy.world
    link
    fedilink
    English
    arrow-up
    6
    ·
    1 year ago

    Interesting. But should this apply to many apps on F-Droid? I also have an app published on both the Play Store and F-Droid and I don’t recall having seen requests to change the application ID to avoid clashes between stores.

    • 520@kbin.social
      link
      fedilink
      arrow-up
      16
      ·
      edit-2
      1 year ago

      KDE Connect is likely a special case; as it is a PC integration app, and a very feature-loaded one at that, it accesses a whole bunch of sensitive stuff like notifications, clipboard, direct file access, SMS functions, keyboard inputs and more.

      More than any other non-root-accessing app, you do not want a trojanised version of KDE Connect on your phone.

    • Martin
      link
      fedilink
      English
      arrow-up
      7
      ·
      1 year ago

      If the signature matches, Google probably won’t care where they are installed from. I suspect that the KDE Connect in fdroid is signed with a different certificate than on google play, causing it to be flagged as an impostor. This could probably be easily prevented by using the same cert or different app identifiers (to cause them to be treated as different apps).

      • leinardi@lemmy.world
        link
        fedilink
        English
        arrow-up
        9
        ·
        1 year ago

        All F-Droid apks are signed with a different key than the play store one: you do not upload your key when you publish on F-Droid and all the apps are built from source by the F-Droid build servers.