linux.conf.au 2018 / F-Droid

F-Droid: The private, secure app store

by Peter Serwylo (@serwylo, peter@serwylo.com)

F-Droid: https://f-droid.org
Slides: https://pserwylo.gitlab.io/fdroid-lca-2018

Android

Yay, a well backed Linux based OS for mobile!

Android Open Source Project
(AOSP)

ROMs

Control
Support
Customization
Freedom
...

Current ROM situation

Support many devices
Documentation
Community

But...

Software situation?

F-Droid

An alternative to Google Play

Amazon

Mi store

AppVn

Aptoid

Cafe Bazaar

QQ

Mobogenie

a.d.cn

F-Droid: The "app store"

Search and browse for apps
Update notifications
Screenshots
Localized (over 40 languages and growing)

F-Droid: the "package manager"

Packages from source
No account necessary
No tracking
No advertising
Decentralisation
...

What is F-Droid?

fdroidclient: Android client
privileged-extension: Android system app
fdroidserver: CLI tools for maintaining an F-Droid repository
fdroiddata + rfp (request for packaging): Build metadata for over 2000 open source Android apps

Plus a number of other things

repomaker: Desktop/Web frontend to fdroidserver
update-channels: Libs to use F-Droid repositories into other apps
fdroidcl: (Unofficial) CLI client for managing apps via USB
Fossdroid-Core: (Unofficial) Web front-end for F-Droid repositories
...

Privacy, Security, and Freedom

Sourcing an application
Building packages
Signing packages
Distributing metadata
Distributing apps
Installing apps

Privacy, Security, and Freedom

Sourcing an application
Building packages
Signing packages
Distributing metadata
Distributing apps
Installing apps

Inclusion criteria

All applications in the repository must be Free, Libre and Open Source software

https://f-droid.org/en/docs/Inclusion_Policy/

Request for Packaging

Build metadata

Categories: Games
License: GPL-3.0
Description: ...
...

Build metadata

Repo Type:git
Repo:https://github.com/lexica/lexica

Build:0.10.0,1000
commit=v0.10.0
subdir=app
gradle=yes

Flag any anti features

Ads The app contains advertising
Tracking The app tracks and/or reports your activity to somewhere, either without your permission, or by default (i.e. you’d have to actively disable it)
Non-free Network Services The app promotes/depends on a non-Free network service
Non-free Addons The app promotes other non-Free apps or plugins
Non-free Dependencies The app depends on another non-Free app (e.g. Google Maps)
Upstream Non-free The upstream source is non-free - the F-Droid version is patched to fix this
Non-free Assets The app contains non-free assets
Known Vulnerability The APK has a known security vulnerability

Privacy, Security, and Freedom

Sourcing an application
Building packages
Signing packages
Distributing metadata
Distributing apps
Installing apps

Buildserver VM

Building thousands of apps, especially with automated and/or unattended processes, could be considered a dangerous pastime from a security perspective

https://f-droid.org/docs/Build_Server_Setup/

Maven problems

How to take over the computer of any Java/Clojure/Scala developer
- https://max.computer/blog/...
- July 28, 2014

Maven problems

How to take over the computer of any Java/Clojure/Scala developer
- July 28, 2014
SSL Connectivity for all Central Repository users Underway
- July 30, 2014

Verification Servers

...automatically reproduce official releases published by f-droid.org to ensure that everything in the release APK came from the source code, and nothing was inserted or included during the build process

https://f-droid.org/docs/Verification_Server/

https://verification.f-droid.org/

See Chris Lamb's LCA 2018 talk on diffoscope

Privacy, Security, and Freedom

Sourcing an application
Building packages
Signing packages
Distributing metadata
Distributing apps
Installing apps

Android Signing Model

.apk files are signed by developers
OS will only update packages if the update is signed by the same cert

Typical Signing Process

Dev machine:

Build .apk
Sign .apk with certificate stored on disk

Good Signing Process

Build machine:

Build .apk
Copy .apk to USB for transfer to signing machine

Airgapped machine:

Sign with a cert stored on a HSM
Transfer to internet connected machine via USB

Paranoid Great Signing Process

https://f-droid.org/docs/Building_a_Signing_Server/

Buy a computer off the shelf with cash, avoid having it shipped, especially across borders
Buy a Debian-supported Chromebook with removeable WiFi hardware, and needs no binary blobs
Install a reproducibly built coreboot binary
Install from a reproducibly built Debian image, wiping out Chrome OS entirely
...

Privacy, Security, and Freedom

Sourcing an application
Building packages
Signing packages
Distributing metadata
Distributing apps
Installing apps

Reproducible builds

F-Droid can verify that an app is 100% free software while still using the original developer’s APK signatures

https://f-droid.org/docs/Reproducible_Builds/

Avoid F-Droid having to sign anything
Moves a bit more trust from F-Droid to the dev
More difficult than the verification server (dev builds using F-Droid tools)

Privacy, Security, and Freedom

Sourcing an application
Building packages
Signing packages
Distributing metadata
Distributing apps
Installing apps

Verifying signed metadata

Pinned certificates for f-droid.org and guardianproject.info

Pinned certificates

app/src/main/res/values/default_repos.xml (link)

<?xml version="1.0" encoding="utf-8"?>
<resources>
<string-array name="default_repos">
  <item>F-Droid</item>
  <item>https://f-droid.org/repo</item>
  <item>3082035e308...</item> <!-- pubkey -->
  ...