Bazaar Wiki¶

Bazaar lets you download apps securely, and share the apps on your phone with people in close proximity using whatever means are available (WiFi, Bluetooth, NFC, SDCard, etc). It also audits your installed apps by comparing them to the versions that other people have installed to make sure they are not malware. We are building upon the FDroid free software app store for Android to improve the security of the process while enabling decentralized and peer-to-peer distribution.

Overview¶

• Core Concept
• User Stories

Activities and Research¶

• FDroid Audit
• Auditing Existing APKs
• Bootstrapping Trust
• Local Data Transfer
• OTRDATA Integration Plan
• Trusted Intent Interaction
• Chained TLS Cert Verification
• Signing the Local APK Index
• Improving the APK Signing Procedure

Related Discussions¶

• posts on our blog: https://guardianproject.info/tag/bazaar/
• posts on the FDroid forum: https://f-droid.org/forums/tag/bazaar/
• Oct 23rd IRC Scrum log
• Nov 21st IRC log about identifying repos
• F-Droid and decentralized trust convo on twitter
• OpenITP UX Hackathon - Cydia/Community Notes

Code Repositories¶

• Kerplapp - dropping apps onto droids, the prototype repo app
• FDroid Android client - the Android app store
• FDroid server tools - the tools for managing app repos

Relevant F-Droid Issues¶

Whenever possible we should try to frame our work in terms of the F-Droid development process. If we can fix issues in F-Droid by submitting the functionality that we need for Bazaar, then its a win-win.

• Please provide GPG signatures for APKs - we can provide this with GPGA, and it will help with master key bug issues on phones that have not been updated
• Import and export list of installed apps - Kerplapp already does this, we'd just need to reframe that code to also do file I/O and SEND Intents.
• Resumeable downloads? - p2p and tor will mean lots of flaky connections
• Repo as virtual category in client - we will need a way to represent what is on the device on the other side of a p2p sync
• backgrounding apk download - downloading via Tor and OTRDATA could be slow
• Repository list management - adding repo via QR, etc.
• Update all - having update all would make syncing apps in the p2p process much easier.
• display 'category' when accessing an app - it would be nice if the UI showed where you were getting the app from, i.e. via the p2p connection you have right now, a Tor connection, etc.
• Update fails if a repo is broken - we'll definitely need to handle this since we'll be adding repos that come and go a lot
• Method for suggesting users uminstall an apk - if an APK proves to be compromised, it should be able to be revoked and the client should recognize that