F-Droid, Explained
F-Droid, Explained
F-Droid is how the apps reach your phone and stay updated. This page explains the warning messages Android will show you, why they appear, why F-Droid is the safer choice despite them — and how updates work once you are set up.
If you just want the installation steps, they are on the Install page. Come back here when Android shows you a warning you were not expecting.
The warnings you will see — and what they actually mean
Android is built by Google, and out of the box it treats Google Play as the only legitimate source of apps. Installing anything from anywhere else triggers a series of warnings. They look alarming. Here is what each one really means.
"Install unknown apps" / "Allow from this source"
When you first install F-Droid (and later, when F-Droid installs an app), Android asks you to allow installations from that source.
What it means: "This app did not come from Google Play." That is all. It does not mean the app is dangerous — it means Google did not distribute it.
What to do: Allow it for F-Droid (and for your browser, if you downloaded the F-Droid APK with it). This is a one-time setting per source.
"Unsafe app blocked" / Play Protect warnings
Google Play Protect scans apps on your phone and sometimes flags apps it does not recognise — which by definition includes community-built apps that were never submitted to Google.
What it means: "Google has never seen this app before." Play Protect is checking against Google's catalogue, not analysing what the app actually does. Iwacu, isoko, and abantu will never appear in Google's catalogue — keeping them out of Google's hands is part of the point.
What to do: Tap More details → Install anyway (the wording varies by Android version). If the warnings bother you, you can turn off Play Protect's scanning under Play Store → Settings → Play Protect — but leaving it on is fine too; it just means tapping through the warning at install time.
"Unknown app provider" on newer Android versions
Recent Android versions phrase the warning as being about an unknown "provider" or ask you to verify the app's source.
What it means and what to do: Same as above. The provider is known — it is the Rubanda repository, whose cryptographic fingerprint you verified when you added it. Google just does not know it.
Why F-Droid instead of just downloading APKs?
You can install the apps by downloading APK files directly — the Install page shows how. F-Droid is still the better path:
| F-Droid | Direct APK | |
|---|---|---|
| Updates | Automatic — you get fixes without doing anything | Manual — you must hear about, download, and reinstall each update |
| Integrity | Index is signed; F-Droid rejects tampered apps and updates | You verify checksums yourself, every time |
| Downgrade attacks | Prevented — F-Droid refuses versions older than what you have | Nothing stops someone handing you an old, vulnerable APK |
| Account required | None | None |
| Tracking | None — F-Droid has no analytics, no account, no ad ID | None, but your browser download may be logged |
Two more reasons that matter for this ecosystem specifically:
- One repository, all the apps. Add the Rubanda repo once and iwacu, isoko, and abantu are all available, with updates for all three flowing through the same verified channel.
- No gatekeeper. Google can remove apps from Play, refuse updates, or be compelled to do either. The Rubanda F-Droid repository is hosted by the community, mirrors can be run by anyone, and nothing about it depends on Google's continued cooperation.
How updates work
Once the repository is added, updates are hands-off. Here is the mechanism, so you know what to expect:
- Publishing. When a new version of an app is released, it is added to the repository with a higher version number, and the repository's signed index is regenerated.
- Checking. Your F-Droid app periodically downloads that index (you can also pull down to refresh manually). The signature is verified against the fingerprint from setup — a tampered or impersonated index is rejected, not installed.
- Notifying. When the index lists a newer version than what you have, F-Droid shows it under Updates and can notify you.
- Installing. Tap update — or let F-Droid do it unattended: F-Droid → Settings → Updates → Automatically install updates (on recent Android versions this works without any prompts for apps F-Droid itself installed).
Each update must be signed with the same key as the version you already have — Android itself enforces this, so even a compromised repository could not swap in an imposter app on your phone.
Checking what version you have
- In F-Droid: open the app's page — the installed version and the latest available version are shown side by side.
- In each app: the version appears in Settings (or the About section).
If soma's release notes mention a feature you do not see, check F-Droid for a pending update first — it is almost always that.
Back to installation steps