Obtainium vs F-Droid vs Aurora Store: Sideloading When Play Protect Is the Product

Play Protect is not a confused antivirus. It is the store’s immune system. It wants packages that arrived through Play, signed in a way Google already knows, updated on Google’s schedule. Sideloading is allowed the way a hotel allows a minibar: technically yes, with a warning on the door and a scan that treats your GitHub APK like a stranger in the lobby. The broader case for doing it at all is when sideloading is worth it and when it is not.

Obtainium, F-Droid, and Aurora Store are three ways to live with that stranger. They are not interchangeable. One tracks the developer’s own release. One rebuilds the app in a warehouse you chose. One fetches the Play binary without the Play app. Play Protect will have opinions about all three. The useful question is whose signature you wanted in the first place.

What Play Protect is actually scoring

Protect looks at the package name, the cert, reputation, and behavior. A first-seen APK from a new signing key looks risky even when the source is the same GitHub account that published the source last year. An app that uses accessibility or SMS looks risky even from Play. Sideload adds a UI tax: extra prompts, “blocked by Play Protect,” a need to tap through on a phone you handed to a relative.

If you stay on a stock Pixel with a Google account, Protect is part of the OS you already agreed to. If you are on GrapheneOS or a de-Googled Lineage build, Protect may be absent or limited. This article is for the messy middle: a normal Android phone, Play Services still installed, and a wish to install things Play will not ship or will ship late.

I do not turn Protect off globally. I make exceptions per app when I know the cert. Turning it off is how a family member installs a “PDF cleaner.” The product is the warning. Your job is to decide which warnings are noise, and to write down the cert so the next warning is a comparison, not a vibe.

F-Droid: the warehouse, not the factory

F-Droid builds many apps from source and signs them with F-Droid’s keys. That is a feature and a fight. Updates wait for their build servers. The version on F-Droid can lag the developer’s GitHub by days or weeks. Some apps are missing because a dependency is non-free. Some have anti-feature flags that are honest and annoying.

Play Protect sometimes flags F-Droid itself or an F-Droid-signed APK because the cert is not the Play cert. You are not installing “the same app” as Play. You are installing a cousin with a different signature. You cannot update an F-Droid build with a Play build without uninstalling. That is the lock-in people forget when they mix stores for the same package name.

I use F-Droid for apps I want in a FOSS warehouse: NewPipe’s official distribution story has been messy over the years, so I check the current recommended path, but the pattern holds for lots of tools — a repo I can add, a client that updates them together, logs I can read. I do not use F-Droid for banking. I do not use it for apps whose developers only ship on Play and GitHub.

The privileged extension and extra repos are power-user paths. They do not make Protect quieter. They make updates cleaner inside the F-Droid world.

Aurora Store: Play’s APK, someone else’s client

Aurora talks to Google’s delivery like a pretend Play Store. You get the same package Play would have given you, including paid apps if you log into the right account. Anonymous mode works until it does not. Google changes an API. Aurora breaks for a week. That is the tax for not using the official storefront.

Protect is usually calmer here because the APK is a Play APK. The client is the risk: you typed a Google password into a third-party app, or you used a throwaway account, or you used anonymous and got rate-limited. I use a dedicated Google account for Aurora on a phone that already has a main account in Play for banking. Two accounts is ugly. It is uglier to put the main password into Aurora.

Aurora is the right tool when the app only exists on Play and you refuse the Play Store app — or you want to download an APK to archive. It is the wrong tool when you wanted a FOSS build. You did not get a FOSS build. You got Play’s binary through a side door.

Obtainium: you pick the URL, you own the miss

Obtainium watches a source you configure: GitHub releases, GitLab, a plain HTML page, sometimes an F-Droid repo URL. It downloads the APK the developer uploaded. The signature is usually the developer’s, not F-Droid’s, not Play’s. Updates arrive when the developer tags, not when a warehouse rebuilds.

The miss is yours. Wrong asset filter and you install a debug build. Wrong repo and you track a fork. A GitHub release that attaches five APKs — arm64, universal, F-Droid variant — will install the wrong one if you were sloppy. Play Protect will flag a brand-new key. You will tap through because you checked the fingerprint once. You must actually check the fingerprint once.

I keep a note of signing certs for the five apps I care about. Obtainium is a tracker, not a reputation system. It will happily update you to a compromised release if the GitHub account is compromised. So will Play, with more delay and more lawyers. The difference is who you thought was reviewing the binary.

Obtainium plus GitHub is my default for apps whose authors release APKs and whose F-Droid build lags. Obtainium plus an F-Droid repo URL is how I watch one warehouse app without living in the F-Droid client. I do not use Obtainium to scrape random APK sites. That is how Protect earns its keep.

A rule for mixing the three

One package name, one signer, one updater. If NewPipe — or whatever you actually use — is F-Droid-signed, do not also add it in Obtainium pointing at GitHub, and do not also grab it from Aurora. You will fight signatures and lose updates.

Split by job:

• F-Droid client: the set of apps you want in a FOSS repo with anti-feature labels.
• Obtainium: developer-released APKs you trust enough to track, plus a cert note.
• Aurora: Play-only apps on a dedicated Google account, when you will not use the Play Store UI.
• Official Play Store: banking, payments, anything where Protect’s opinion is also your bank’s opinion.

Play Protect will still nag. The nag is cheaper than a single updater that pretends all four sources are the same trust model. I would rather see three clients and one rule than one client and a surprise signature change on a Sunday.

What I tell a careful non-expert

If they only want Signal, a browser, and a bank: use Play. Sideloading is not a personality. If they want NewPipe and a keyboard Play will not recommend: F-Droid plus patience, or Obtainium plus a cert check I do with them once. If they want to avoid the Play Store app but keep Play apps: Aurora with a dedicated account, and a warning that it will break.

I do not tell them to disable Protect. I tell them that Protect is Google’s storefront talking. Sometimes the storefront is wrong about a GitHub APK. Sometimes it is right about a “cleaner.” The three tools above do not replace judgment. They replace the Play Store’s monopoly on the update pipe.

GrapheneOS, sandboxed Play, and the same three tools

On GrapheneOS with sandboxed Play, Protect still exists inside that sandbox. Aurora and Play can coexist more cleanly than on a stock OEM skin that hides sideload toggles. Obtainium still needs the install-unknown-apps permission for its own package. F-Droid still ships a different cert. The OS changes the blast radius, not the signature math. I still keep banking in the Play-shaped path and FOSS tools in F-Droid or Obtainium. The phone being “more private” is not a reason to mix signers on one package.

Work profiles (Shelter, the built-in profile, or a second user) are a better split than “turn off Protect.” Put Aurora experiments in a profile you can wipe. Keep the main profile boring. Obtainium in the main profile for two or three apps you already vetted is enough. A main profile full of random APKs is how Protect becomes the only adult in the room.

The product you are negotiating with

Google wants installs to be Play-shaped. Sideloading remains because regulators and power users made it expensive to kill. Protect is the remaining friction. Obtainium, F-Droid, and Aurora are three frictions you choose on purpose. Pick the signer first. Pick the updater second. Let Protect complain. Tap through only when the cert matches the note you wrote when you were sober. If you do not have that note, you do not have an exception. You have a hope, and Protect is allowed to treat hope as malware.