Security

Android trust model

Every Android app is signed with its developer’s private key, and the file carries the matching signing certificate. Android installs an update only when it is signed with the same certificate as the copy already on the phone. The app page shows the certificate of the current release. The full report adds any earlier certificates linked to it.

A new release signed with a different certificate is a certificate mismatch. Zapstore says "The installed app is signed by a different certificate" and will not install it over the copy on your phone. A developer who changes certificates properly links the new one to the old one, using Android’s signing lineage, and updates keep working. Without that link, the change could mean a developer lost their key, or someone else is posing as them. Check with the developer before you uninstall and reinstall.

Claimed and unclaimed

Android’s signing certificate proves that two releases come from the same key, but not whose key it is. A claim answers that. The developer signs a message with the app’s signing key that names their Zapstore pubkey, and the catalog relay checks it against the APK. This links two keys that otherwise know nothing of each other. Everything attached to the pubkey, such as the developer’s name, the people who follow them and the zaps they receive, then applies to that certificate and any certificate linked to it, with cryptographic certainty.

An app is claimed while it has a current claim. A claim generally lasts two years, and the developer renews it. An app is unclaimed when nobody has claimed it.

In Zapstore’s default catalog, an app’s releases can come from the catalog’s indexer, which follows public releases on GitHub, F-Droid, IzzyOnDroid and similar sources. Once the developer claims the app, they can publish releases too, or have a delegate pubkey publish them from CI. An unclaimed app’s releases all come from the catalog. On a claimed app, the catalog can still fill in a release the developer did not publish, and it is shown under the developer’s name.

An unclaimed app is not a bad app. Every file is verified before it installs, whoever published it, and the developer can claim the app at any time.

On a claimed app, the install sheet shows the developer’s web of trust: who follows them. Tap Refresh with your web of trust to rank that list from your own point of view, based on the people you follow. A follow is not an endorsement.

Look-alike apps

An open catalog can list two apps with similar names. To tell them apart, compare who claimed each one, its source and its signing certificate on the app page, not its name or icon.

What is checked before an install

Your phone verifies every download before it installs, whoever published the release:

• The file’s SHA-256 hash matches the one in the signed listing.
• The APK’s signatures are valid, and its package name and signing certificate match the listing.
• On a claimed app, the certificate matches the developer’s current claim.
• On an update, the certificate is the one already installed, or linked to it by signing lineage.

If any check fails, nothing installs, and Zapstore says why:

• "The download did not match the listing."
• "This file is not the listed app."
• "The installed app is signed by a different certificate."
• "The developer proof does not match this APK, so it was not installed."
• "This version is older than the one installed."
• "This APK targets an Android version this device cannot install."

What the security report shows

The catalog relay inspects every release file and its source repository. The security report on an app page lists what it found, including whether the app uses Google services, shares data, shows ads, works offline, and has its source available. It also explains every permission in plain words. A fact that is bad for you shows in amber. A flag such as Differs from source or No English means something about the listing is off. Zapstore does not rate apps.