Replicant

This post by Moxie from Open Whisper Systems talks about themes related to this: https://github.com/signalapp/Signal-Android/issues/127#issuecomment-13447074

This was discussed a bit here, but no one provided a proper answer: https://stackoverflow.com/questions/18660395/known-source-but-not-from-google-play

I personally have zero knowledge about the app signing process and where the "known sources" are stored in the android system.

Now, being that we have complete control over the entire code base of our distribution, there is theoretically nothing to stop us achieving what you suggest.

The macro-steps would be as following:
1. determine how the app signature trust system works in android
2. change the trust model as needed by our requirements (needs deciding an official app distribution mechanism first)
3. locate the spot(s) in Replicant's code base where the trust model is implemented
4. change the implementation according to point 2.

A first (superficial) research I've made suggests that the "stock" trust model design is heavily bound to Google's infrastructure (Play and other services).
It seems like the only documented option for "alternative distributions"(sic) is to have the user manually enable "untrusted sources".
I'm most probably wrong as I didn't search that well.. but at a first glance it seems like the only option we're left with is to redesign a broader model of trust independent of any specific vendor.

resources:
https://source.android.com/security/apksigning/v2.html#verification
https://developer.android.com/distribute/marketing-tools/alternative-distribution
https://nelenkov.blogspot.com/2013/05/code-signing-in-androids-security-model.html

F-Droid works well without "Unknown Sources" if the F-Droid Privileged Extension is built into the ROM. I thought Replicant already did that. Copperhead, Fairphone Open and Lineage-for-MicroG all do that.

https://gitlab.com/fdroid/privileged-extension/#how-do-i-build-it-into-my-rom

I think that our stable release does this, but I don't think that we are doing this in our nightly releases. We'll have to fix that.

Hans-Christoph Steiner wrote:

F-Droid works well without "Unknown Sources" if the F-Droid Privileged Extension is built into the ROM. I thought Replicant already did that.
https://gitlab.com/fdroid/privileged-extension/#how-do-i-build-it-into-my-rom

The problem is that in the development branch the extension doesn't get integrated into the ROM. I don't see anything different with the stable branch, and I think that we are doing what is documented in the privileged extension howto page. We need to understand why this is happening.