Fonte

Open-source app updater for Android.
Installs and updates apps straight from their source. Fast, private and minimal. No trackers, no Google Play Services.

About

Fonte keeps the apps that you install from outside an app store up to date. Give it a link to a repository or an app page. Fonte finds the latest release, picks the APK for your phone, checks it and installs it.

It is an alternative to Obtainium, with fewer features and a smaller attack surface, and it imports your Obtainium list. Fonte has no native code, no WebView and no dynamic code loading. It is made to run on GrapheneOS with "Restrict dynamic code loading" (memory and storage) on.

Features

• Sources: GitHub (also private repositories, with a token), GitLab (also self-hosted), Codeberg, Forgejo and Gitea, F-Droid and IzzyOnDroid, and other F-Droid repos (for example the Guardian Project repo). Give the repo link with its fingerprint, then choose the app.
• The right APK: the build for your processor, an optional name filter (regex), and pre-releases if you want them.
• Background updates: a check every 3, 6, 12 or 24 hours. Apps that Fonte installed update silently while you do not use them. Apps that another store installed ask you once, through a notification. By default, these downloads wait for an unmetered network, such as Wi-Fi.
• Fast checks: HTTP/3 and HTTP/2, all apps at the same time, and a source with no change answers with an empty "not modified" reply.
• Updates itself: Fonte is always in its own list and updates like the other apps.
• Share to add: share a repository link from your browser to Fonte.
• Import and export: the Obtainium export (any version), and Fonte's own list with the pinned certificates.
• Material 3 Expressive: your wallpaper colours, light and dark.

Security

Before Fonte installs an APK, the APK must:

• match the SHA-256 digest that GitHub publishes for the file. For other F-Droid repos, match the digest in the repo's signed index. Fonte checks that index with the fingerprint from the repo link at each check, and refuses a repo link with no fingerprint;
• be a valid, signed APK with native code (if any) for this device;
• keep the package name that the app had before;
• be signed with the pinned certificate. Fonte pins the certificate at the first install, or when it adopts an app that is installed already. A key rotation (APK signature scheme v3) is followed;
• at the first install from F-Droid or IzzyOnDroid, be in the repo's signed index. Fonte checks the index with the repo key that the F-Droid client also uses.

And also:

• Update ownership (Android 14): other installers need your consent to update an app that Fonte installed.
• HTTPS only, also after redirects. Only system CAs: a CA that you or an admin add is not trusted.
• The GitHub token is optional; private repositories need one. Fonte shows the steps to make a fine-grained token with read-only access and nothing more. It is encrypted with an Android Keystore key (StrongBox when available) and sent only to api.github.com, with each GitHub check: GitHub links these checks to your account. A redirect to another host drops it.
• Release notes are plain text. Fonte shows no HTML, and opens only https web pages.
• Memory tagging (MTE) in sync mode on phones that have it, such as Pixel 8 and later.

Privacy

• No analytics, no crash reporting, no Google Play Services, no third-party SDKs, no account.
• Fonte connects to the sources in your list, and its own GitHub repository is always in it. A GitLab, Forgejo or Gitea release can link its APK on a different host that the project selects. Fonte downloads the APK from that host, also in the background. The pinned certificate still protects the update. When you add a link to an unknown host, Fonte asks that host if it runs GitLab, Forgejo or Gitea. An import makes no probe, but Fonte checks each imported source at once and then at each interval. A list can name self-hosted GitLab and Forgejo hosts.
• Hosts that Fonte connects to:
  • GitHub: api.github.com, github.com, and the download hosts after a redirect (*.githubusercontent.com, for example release-assets.githubusercontent.com).
  • f-droid.org, apt.izzysoft.de, gitlab.com and codeberg.org, when your list has an app from them.
  • Each self-hosted GitLab, Forgejo or Gitea host and each F-Droid repo that you add, and each host where their releases put an APK.
• For other F-Droid repos, each check reads entry.jar (a few KB). Fonte downloads the full index only when it changes (about 0.7 MB for the Guardian Project repo, an estimate), and sends no ETag to these repos.
• No cookies, no HTTP cache, and a User-Agent with no device data. Fonte sends back the ETag of the last answer of each source, so that a source with no change answers "not modified". A source can use the ETag to see that two checks come from the same phone.
• The clipboard is read only when you tap Paste.
• Notifications do not show on a locked phone that has a screen lock.
• No backups: the app list and settings stay out of cloud backup and device transfer.
• Fonte reads the installed version of each app in your list (Android permission "query all packages"). This information stays on the phone.

Download

Get the APK from Releases. Fonte is new software. Report problems in Issues.

Before you install, check the signing certificate. Its SHA-256 fingerprint is:

cc154a2b16d1b2021f233724054934162bf2980e161672640a6e0f388c36ffa4

Compare it with the output of apksigner verify --print-certs <file>.apk, or use AppVerifier. Do not install an APK with a different certificate.

After the first start, allow Fonte to install apps when Android asks.

Build

Requirements: JDK 21 and the Android SDK with platform 37.

JAVA_HOME=/opt/homebrew/opt/openjdk@21 ./gradlew :app:assembleDebug :app:testDebugUnitTest

Release builds are signed with the key that scripts/make-release-key.sh makes; without it, assembleRelease makes an unsigned APK. The release APK is about 2.5 MB.

How Fonte finds updates

• F-Droid and IzzyOnDroid: the version code of the suggested version (with pre-releases on, the highest one). Fonte reads the small per-package API, not the multi-megabyte index. For apps with one build per ABI, a ranged request reads only the ZIP directory of each build, to find the build for this device before the download. The per-package API has no signature, so Fonte trusts its HTTPS answer. The pinned certificate and the version code protect the APK: a hostile server can only hide updates. At a first install, it can offer an older version that a signed index lists.
• Other F-Droid repos: the signed index (v2). Fonte takes the highest version code with native code for this device (or none). A version in a release channel, such as Beta, counts only with pre-releases on. When the digest of the index in entry.jar is the same as at the last check, nothing changed. Repos with only the old index (v1) are not supported.
• GitHub, GitLab, Codeberg, Forgejo and Gitea: the 10 newest releases in one request. Fonte takes the newest one with an APK for this device. Drafts are skipped, and pre-releases are skipped unless you turn them on. On GitHub, when all 10 are pre-releases (for example the nightly builds of Brave), one more request reads the stable release that GitHub marks as latest.
• After Fonte installs an app, it remembers the release tag and the version code. The next checks compare tags, which is exact. Before that, Fonte compares the version name with the tag.
• If the downloaded APK has the version that is installed already, Fonte installs nothing and only remembers the release.

Project layout

• app/src/main/kotlin/app/fonte/net: HTTPS through the platform HttpEngine (Cronet).
• app/src/main/kotlin/app/fonte/source: link parser, sources, APK choice, version compare.
• app/src/main/kotlin/app/fonte/install: download, checks, install sessions, installed packages.
• app/src/main/kotlin/app/fonte/work: periodic job and notifications.
• app/src/main/kotlin/app/fonte/transfer: Obtainium and Fonte import and export.
• app/src/main/kotlin/app/fonte/ui: theme, shared components, navigation and screens.

Validation

Run the JVM tests, lint and the two builds:

./gradlew :app:testDebugUnitTest :app:lintDebug :app:assembleDebug :app:assembleRelease

The tests cover the link parser, the APK choice, the version compare, the parsers of all sources, the import formats, the store, the certificate pins, the install gates, the signatures of the repo indexes, the redirect rule for the token and the GitHub limit. The index reader uses the Android JSON reader, so the JVM tests do not cover it; the emulator steps below do.

On an Android 15 emulator, these steps were tested with real sources: add apps from each source, first install, an update of an app that another installer owns, a silent update in the background, the "tap to install" notification, and the Obtainium import. On an Android 17 emulator: add Tor Browser from the Guardian Project repo, its first install, a background check with no change, and a repo link with a wrong fingerprint (refused). To run the background job at once:

adb shell cmd jobscheduler run -f app.fonte 1

License

Fonte is free software under the GNU General Public License v3.0. It uses AndroidX, Jetpack Compose and Kotlin coroutines (Apache-2.0), and Material Symbols icons (Apache-2.0).

---

_{Fonte is an independent project. It is not affiliated with Obtainium, F-Droid, IzzyOnDroid, the Guardian Project, GitHub, GitLab or Codeberg.}