# Rewrite Obtaining Applications: Recommend F-Droid over Obtainium and the Aurora Store

**URL:** https://discuss.privacyguides.net/t/rewrite-obtaining-applications-recommend-f-droid-over-obtainium-and-the-aurora-store/29820
**Category:** Site Development
**Created:** 2025-08-06T19:36:45Z
**Posts:** 53
**Showing post:** 35 of 53

## Post 35 by @hashcatHitman — 2025-08-09T20:26:33Z

> [@anon94117004](#):
>
> this has too few apps and the developer is refusing to add any more for unknown reasons.

It isn’t very obviously documented, but [soupslurpr has said this is because it is too difficult to maintain](https://github.com/soupslurpr/AppVerifier/issues/192#issuecomment-2593784632). I’ve considered forking and trying to maintain the database myself, but I am not yet very knowledgeable in Kotlin or the finer details of Android, so I wouldn’t be able to do anything more complicated than maintaining simple hashes and simple fixes.

It can still be used to compare with other people, or with other versions of an APK. (ie, if the APK is published on a developer-owned website and GitHub, I can compare them to each other to lessen the trust of a single server).

> [@anon94117004](#):
>
> eg. the repository list contains both the expected app signature as well as a file hash and itself is signed and checked against a pinned key or eg. tofu key  
> you can even go further and have the CA or even specific key (eg. certbot has the `reuse_key` option to renew a single cert for long term pinning like other use of eg. TLSA) of the web server of the primary repository pinned too.

I see, thanks for the explanation!

---

_[View the full topic](https://discuss.privacyguides.net/t/rewrite-obtaining-applications-recommend-f-droid-over-obtainium-and-the-aurora-store/29820)._