LocalAndroidStore

LocalAndroidStore is a personal catalog app for Android apps you build yourself. It lists every APK across your GitHub releases, downloads the latest version, and drives the system installer with a single tap. Install. Update. Uninstall. Move on.

It exists because when you ship many Android apps from GitHub Releases, sideloading each one through the file manager on every fresh install is friction. F-Droid won't host private or in-development apps. This is the Android sibling of LocalChromeStore: same idea, same look, different platform.

Key Features

- Discovers every APK release across your enabled GitHub users/orgs. - Also supports pinned F-Droid repositories via index-v2 fingerprint URLs. - Shows installed state and update-available status for each app. - One-tap install: downloads the APK and drives the system PackageInstaller dialog (you confirm once). - One-tap uninstall: opens the system uninstall confirmation. - One-tap open: launches the installed app. - Optional Shizuku installer: if you have Shizuku running and grant access, installs can happen without the system dialog. - Signature pinning: LocalAndroidStore remembers the publisher's signing certificate. Future updates must match that pin (or carry a valid v3/v3.1 rotation lineage); an unrelated signer is blocked. - Multi-source aggregation: if the same package appears from multiple sources, they share one card. You can choose a preferred source. - Per-app release channels: pin a card to stable, beta, alpha, nightly, etc. - Historical release browsing: open a card's release history and select an older version for install/downgrade (with explicit confirmation). - APK transparency report: inspect the verified binary manifest, APK Signing Block, signature schemes, and offline tracker-signature matches. All on-device, no upload. - GitHub PATs (optional): use a personal access token to raise rate limits and see private repos. Stored encrypted with Tink AEAD, key protected by Android Keystore. - Batch selection: long-press a card, select multiple, then install, stage updates, or uninstall in sequence. - Wear OS companion: separate module provides an update-count Tile and complication for a paired watch. - Theme: Catppuccin Mocha AMOLED dark or Latte light, with accent color picker (Mauve, Sapphire, Green, etc.). Android 12+ can use wallpaper-derived Material You colors. - Fast catalog search: filter by app name, repo owner, description, tag, version, or package id. - Offline catalog: retains a usable snapshot for up to seven days; stale cards are marked. - No telemetry: diagnostics, install audit, and crash evidence stay local unless you explicitly export a redacted support bundle.

Basic Usage

1. Open the app and go to Settings (bottom nav). 2. Add one or more GitHub sources (user or org name). The default source is SysAdminDoc. 3. Optional: paste a personal access token to see private repos and raise rate limits. 4. Optional: enable topic filter or pre-releases per source. 5. Optional: add F-Droid repositories by pasting their HTTPS index-v2.json?fingerprint=... URL. 6. Tap Save settings, go to Catalog, tap Refresh. 7. Every qualifying repo appears as a card. Tap Install to download and install. 8. Tap Open to launch the installed app. Tap Uninstall to remove it.

For installed cards:

- Overflow menu → Inspect APK transparency for binary manifest, signature, and tracker matches. - Overflow menu → Choose preferred source if the same package appears from multiple sources. - Overflow menu → Set release channel to pin to a specific track. - Overflow menu → Release history to browse and install older versions (with explicit confirmation).

Batch actions: long-press a card to enter selection mode, select multiple, then use Install selected, Stage updates, or Uninstall selected.

How discovery works

- For each GitHub source, LocalAndroidStore lists owned non-fork public repos (up to 50 pages of 100), fetches the latest release, picks an installable APK asset, and shows it as a card. - If you provide a PAT, private repos owned by that source also appear. - F-Droid repositories are read through their pinned index-v2 metadata; verified fingerprint before parsing.

Security and Privacy

- Signature pinning: the app remembers the publisher's certificate. A new, unrelated signer is blocked. Legitimate v3/v3.1 rotation lineages are accepted. - All APK downloads are over HTTPS via Android's system CA store. Cleartext traffic is disabled. - GitHub PATs are stored in a Tink AEAD-encrypted file, with the keyset protected by Android Keystore. - No telemetry: diagnostics, install logs, and crash evidence remain local. You can export a redacted support bundle manually. - The APK transparency scan stays on-device – never uploads APK bytes or tracker hashes. - Developer Verification preflight is advisory only; it never blocks installation.

Limitations and Requirements

- Requires Android 8.0+ (API 26+). - By default, installs use the system PackageInstaller dialog – you must confirm each install. - The optional Shizuku installer requires a running, approved Shizuku service; may be rejected by device policy or OEM restrictions. - Uninstall always opens the system uninstall confirmation – cannot bypass it without device-owner privileges. - Automatic background updates are limited: you can set a daily cap, per-app auto/notify-only/priority/hold policy, but background checks run only on unmetered Wi-Fi while battery/storage are healthy. - GitHub Releases and F-Droid index-v2 repositories are supported; GitLab and HTML sources are not yet implemented. - The tracker-signature snapshot is a static offline list – a missing match does not mean an APK is private, and a match should be reviewed in context.

License

MIT