F-Droid is warning that the project could reach an end due to Google’s new requirements for all Android developers to verify their identity.
The third-party app store argues that Google falsely frames this new requirement as a security measure against malware and the purpose is to tighten the grip on "a formerly open ecosystem."
F-Droid is a third-party app store for Android devices that distributes free and open-source software through a catalog of apps built directly from publicly available source code.
Before publishing an app, the platform checks them for hidden trackers or adware, and distributes reproducible builds to anonymous users that do not need an account to access them.
In August, Google announced plans to introduce a new ‘Developer Verification’ requirement in 2026, to block malware installations from sideloaded apps outside the official Google Play app store.
The new decree requires that all apps installed on certified Android devices must originate from developers who have verified their identity with Google; otherwise, their installation will be blocked, and the user will receive a warning message.
While the proposed system at a first glance seems like a step towards better security, F-Droid says that many open-source developers would not give their identification details to Google.
F-Droid explains that it cannot compel these publishers to register with Google and pay the associated fees, nor seize the app identifiers on their behalf.
"The F-Droid project cannot require that developers register their apps through Google, but at the same time, we cannot 'take over' the application identifiers for the open-source apps we distribute, as that would effectively seize exclusive distribution rights to those applications" - F-Droid
The project's board member Marc Prud'hommeaux said that Google's "registration decree will end the F-Droid project and other free/open-source app distribution sources as we know them today."
Hence, enforcing this new system could deny access to a large number of otherwise trustworthy apps, while also preventing users from updating existing installations.
F-Droid emphasizes that this identification requirement isn’t related to security, as Android already has the Play Protect system in place, which should addresses all risks that Developer Verification is intended to tackle.
“We do not believe that developer registration is motivated by security,” states F-Droid. “We believe it is about consolidating power and tightening control over a formerly open ecosystem.”
F-Droid urges regulators to examine this development critically within the frameworks of competition and digital rights. The project also encourages developers and users to advocate for software freedom by engaging with lawmakers.
BleepingComputer has contacted Google to request a comment about F-Droid’s statement and whether its worries are substantiated, but we have not received a response by publication time.
Meanwhile, the company published a follow-up article yesterday, where it reiterated that sideloading on Android will still be possible, albeit only for apps from verified developers.
Exemptions are allowed, though, for hobbyist developers that distribute apps only to a small number of devices.
Google also clarified that the new decree will not impact Android Studio workflows, as the development and build testing phases will not be subjected to the new restrictions.
Join the Breach and Attack Simulation Summit and experience the future of security validation. Hear from top experts and see how AI-powered BAS is transforming breach and attack simulation.
Don't miss the event that will shape the future of your security strategy