Skip to content

Privileged Extension: Security enhancement

Currently, the Installer checks on install (and uninstall) if it is installing the F-Droid Privleged Extension by comparing the package name (https://gitlab.com/fdroid/fdroidclient/blob/master/F-Droid/src/org/fdroid/fdroid/installer/Installer.java).

In addition to the package name, we should compare the "package signature" (it's more a certificate) with the package signature of the F-Droid app itself. This prevents installations of an app that has the same package name as our extension from a malicious repository.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information