Bazaar Wiki¶

• FDroid Audit
• Kerplapp - dropping apps onto droids, in-progress code dumped to a Github branch
• Auditing Existing APKs
• Bootstrapping Trust
• Local Data Transfer
• OTRDATA Integration Plan
• Trusted Intent Interaction
• Signing the Local APK Index

Related Discussions¶

• Oct 23rd IRC Scrum log
• F-Droid and decentralized trust convo on twitter
• posts on our blog: https://guardianproject.info/tag/bazaar/

Relevant F-Droid Issues¶

Whenever possible we should try to frame our work in terms of the F-Droid development process. If we can fix issues in F-Droid by submitting the functionality that we need for Bazaar, then its a win-win.

• Please provide GPG signatures for APKs - we can provide this with GPGA, and it will help with master key bug issues on phones that have not been updated
• Import and export list of installed apps - Kerplapp already does this, we'd just need to reframe that code to also do file I/O and SEND Intents.
• Resumeable downloads? - p2p and tor will mean lots of flaky connections
• Repo as virtual category in client - we will need a way to represent what is on the device on the other side of a p2p sync
• backgrounding apk download - downloading via Tor and OTRDATA could be slow
• Repository list management - adding repo via QR, etc.
• Update all - having update all would make syncing apps in the p2p process much easier.
• display 'category' when accessing an app - it would be nice if the UI showed where you were getting the app from, i.e. via the p2p connection you have right now, a Tor connection, etc.
• Update fails if a repo is broken - we'll definitely need to handle this since we'll be adding repos that come and go a lot
• Method for suggesting users uminstall an apk - if an APK proves to be compromised, it should be able to be revoked and the client should recognize that