Skip to content

Install Fonte

Download Zapstore

Download
QR code for zapstore.dev/download
  • Scan the code with your phone’s camera
  • Tap Download anyway if the browser warns about the file
  • Allow your browser to install unknown apps if Android asks
  • Open Zapstore and finish the onboarding

Open Fonte in Zapstore

Open
QR code to open Fonte in Zapstore
  • Scan the code to open Fonte in Zapstore, or search for it there
  • Tap Install, and Download if Zapstore asks you to confirm the developer
  • Confirm in Android’s install dialog. Allow Zapstore to install unknown apps if Android asks

Claimed by the developer

Turtlecute cryptographically proved they hold the key that signs Fonte. The claim is a signed proof on Nostr, tied to the certificate below.

Developer
Turtlecute
Developer key
npub1acpsfwhq63nehv6rgl8rkxuqfq3x9wvp90gvp40pnf0zg3gy8d6ss564p8
Signing certificate
cc154a2b16d1b2021f233724054934162bf2980e161672640a6e0f388c36ffa4
APK checked by
relay.zapstore.devIt read the APK and found it signed with this certificate before listing the release.
Claim published
Oct 31, 2026
Valid until
Oct 30, 2028
Proof event
e8a512a3ff43aae27b229adc68fd4b466da3243985672ff44053a43301f71008in relay.zapstore.dev
How trust works

Give it a link to a repository or an app page. The app finds the latest release, picks the APK for your phone, checks it and installs it.

Fonte keeps the apps that you install from outside an app store up to date. Give it a link to a repository or an app page. Fonte finds the latest release, picks the APK for your phone, checks it and installs it.

It is an alternative to Obtainium, with fewer features and a smaller attack surface, and it imports your Obtainium list. Fonte has no native code, no WebView and no dynamic code loading. It runs on GrapheneOS with "Restrict dynamic code loading" on. No trackers, no Google Play Services.

  • Sources: GitHub (also private repositories, with a token), GitLab (also self-hosted), Codeberg, Forgejo and Gitea, F-Droid and IzzyOnDroid.
  • The right APK: the build for your processor, an optional name filter, and pre-releases if you want them.
  • Background updates: a check every 3, 6, 12 or 24 hours. By default, downloads wait for an unmetered network.
  • Updates itself, share to add, and import and export of Obtainium and Fonte lists.

Summary generated by Zapstore from source.

Original description, as the developer published it.

Zap Fonte

Zapping anonymously. Sign in to zap with your identity.

Sats go to npub1acpsf…s564p8, the developer who signed the app’s certificate proof.

Amount in sats

Stacked in

Latest release

Nov 10, 2026

Claimed app No Google servicesSource available · GPL-3.0-only

Seeing all installed apps has no shown use.

Permissions

NotificationsInstalled appsUninstall appsInstall apps What they allow
  • Notifications POST_NOTIFICATIONS Send you notifications
  • Installed apps QUERY_ALL_PACKAGES See every app installed on this phone Has no shown use.
  • Uninstall apps REQUEST_DELETE_PACKAGES Uninstall other apps
  • Install apps REQUEST_INSTALL_PACKAGES Install other apps REQUEST_INSTALL_PACKAGES

Can install apps.

Release notes

Fixes from a full code review: notifications stay off the lock screen, and a refused install shows its reason.

Requires Android 15 or later. The APK has no native code, so it runs on all ABIs. Update from 0.1.11 in place: the signing key is the same.

Changed

  • A failed install has its own text on the app's entry. The reason of a refused install stays until a new release, an install or a certificate reset. Before, the next check removed it.
  • A link with a port or a user name is refused. Before, Fonte dropped the port and sent its requests to the default port.

Fixed

  • An install that Android refused in the background was downloaded again at each interval, with no message. Fonte now downloads that release only once, and the next background check names the app in its notification.
  • With no network, the automatic check put an error on each app. Fonte now makes no automatic check with no network.
  • After the network dropped during a download, a tap on Update did nothing for some time. The install now starts at once.
  • A GitLab release link with a bad "%" in its file name stopped the check of that app.

Privacy and security

  • Notifications do not show on a locked phone that has a screen lock. Before, they could show the names of your apps.
  • A hostile F-Droid repo server could fill the memory with a compressed entry.jar before the signature check, and stop Fonte. The file and its content now have size limits.
File Use
Fonte-0.1.12.apk Release build, signed.

SHA-256:

  • Fonte-0.1.12.apk: 4ee6cb576f090e49bfc3c80a58b362201348e186bc373fcfe2c83c5bd8bf371e

Signing certificate SHA-256: cc:15:4a:2b:16:d1:b2:02:1f:23:37:24:05:49:34:16:2b:f2:98:0e:16:16:72:64:0a:6e:0f:38:8c:36:ff:a4

Check the certificate with apksigner verify --print-certs Fonte-0.1.12.apk or with AppVerifier. Do not install an APK with a different certificate.

Comments

Loading comments…

Get Fonte the private way

Updates checked on your device, and every release verified before it installs.

Get Zapstore for Android

  1. Tap Download APK below.Scan the code with your Android phone’s camera.
  2. If Android asks, allow your browser to install unknown apps.
  3. Open Zapstore and finish the onboarding.
Download APK

v2.0.4 · 71.2 MB · Android 10+

Verify the download

On a computer, run shasum -a 256 <the file you downloaded>. It should print: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

If you have zsp, Zapstore’s publishing tool, zsp utils extract-apk <the file you downloaded> works too. Its hash should be the same SHA-256: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

On the phone, AppVerifier should show this signing certificate: 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320

Source code All releases and notes

Get zsp

  1. Download the file for your computer.
  2. Make it executable and put it on your PATH.
  3. In your project folder, run zsp.

Have Go? This does the same:

go install github.com/zapstore/zsp/v2/cmd/zsp@latest
macOS, Apple silicon Linux, x86-64 Linux, arm64

v2.0.1 · macOS and Linux

Verify the download

On your computer, run shasum -a 256 <the file you downloaded>. It should print the SHA-256 for the one you chose.

macOS, Apple silicon · 18.6 MB 99018fb9744e5ace2b44557550dc333496239912c0e9b1137266d4922c803346

Linux, x86-64 · 23.8 MB 1ef5373f8ecd9ba63d2c3fab98abb0d31b2244a2aac31b3749fb205c7d5f5b38

Linux, arm64 · 22.1 MB e421005ee47cba58293dce4277bb784e4cfe706dbbcb8617d671629d0238be18

Source code All releases and notes