José has an Android phone, but there is no 3G Internet in his region. He can, however, get on WiFi at his school, or when he walks by a local hotel or café. He uses these occasions to download new apps and upgrade the ones he has. Once he gets to school, he wants to share these with all of his friends.
Jane is traveling to an event to help train journalists in using smartphones. She has to buy the smartphones in the local area, as she could not bring them all with her; then she needs to quickly install a set of apps on each phone. She doesn't have much time and needs to make sure it’s done securely.
Juniper lives in a country where Google Play is blocked. The only way to get apps is through a few local sketchy app stores, or by downloading APK files off of message boards where malware is also sometimes posted. She knows some of her friends use VPNs, and wishes she could swap apps with them.
Linda is technically sophisticated and is able to access unfiltered Internet through [Tor | Psiphon | Lantern | etc.]. She keeps the apps on her device up-to-date using her unfiltered Internet connection. José lacks the technical ability to work around the filters himself and wishes he could update his apps from Linda’s device.
A developer in Iran has created some apps and wants to distribute them to as wide an audience as possible. He knows that some apps have been blocked from Cafe Bazaar, so he wants to make sure that there are as ways as possible for people to get this apps. He sets up the FDroid tools to manage publishing his apps to Cafe Bazaar, Google Play, f-droid.org, and a couple "collateral freedom" services like github and Amazon S3. He then runs two simple commands to update his app repository and publish it to all of the app stores. He makes his releases using the FDroid reproducible build and hardened signing process. Even though other local developers have found Finfisher on their computers, he feels confident that his release process has not been infiltrated.
StoryMaker is making a targeted campaign that delivers everything that a user needs to make a video, including tutorials and guidelines for that specific campaign, and a channel to publish videos to others. They need everything delivered to users' devices with a single download and single install process. It must also automatically stay updated. They use a custom FDroid installer bundle that includes everything needed in a single download link. This same link will also direct users who already have StoryMaker to the campaign without making them download everything again. For new users, FDroid is first installed, and it then downloads a standard StoryMaker release with a trigger for it to get the campaign materials. Since FDroid is now installed, it will automatically get StoryMaker updates while also providing a full app store to users. Users publish their videos from StoryMaker, which also adds them to this campaign's FDroid media channel, so they can easily get the videos that others are making.
A human rights organization produces videos and ebooks of training materials and important information, they also have their own mobile app. In their trainings, they use apps from Tor and Guardian Project. A trainer sets up an app store that includes their app and all their videos and publications, and set it up to automatically include the most recent updates from Tor and Guardian Project. At trainings, students get an FDroid bundle from the local app store on the trainer's phone. The installation process lets them click through to install Orbot and ChatSecure, and FDroid is set up with direct access to download and share all of the videos and ebooks.
A developer of circumvention and anonymity tools produces Android apps for journalists and human rights defenders who are targeted by multiple state actors. Having access to their app signing key means that an attacker could deliver targeted malware via peer-to-peer and internet app repositories. Getting access to their app repo signing key means malware can be injected into the official app repo. State Security Agencies target developers to install backdoors in all users: