cybersecurity

A name I've seen in connection with this issue is Obtainium. From a cursory look, it appears this just streamlines checking for and getting apk's from GitHub release pages and other project-specific sources, rather than adding any trust. So maybe it just greases the slippery slope :)

Security guidelines for mobile phones, and therefore policies enforced by large organizations (think Bring-Your-Own-Device), are likely to say that one may only install apps from the platform-provided official source, such as the Play Store for Android or the Apple App Store for iOS. You might say it's an institutionalized form of "put[ting] too much trust in claims of authority." Or you might say that it's a formal cession of the job of establishing software trustworthiness to the platform vendors, at the mere expense of agency for users on those platforms.

People are not taught how to verify the authenticity and legitimacy of software

Rant: Mobile computing as we know it is founded on the rounding off of the rough corner of user agency, in order to reduce the amount users need to know in order to be successful, and to provide the assurances other players need, such as device vendors, employers, banks, advertisers, governments, and copyright holders. See The Coming War on General Computation, Cory Doctorow, 2011. Within such a framework, the user is not a trustworthy party, so the user's opinion of authenticity and legitimacy, however well informed, doesn't matter.

Rant: We're living in a time where curl | bash has become normalized. This generation's security practices are fucked.

Back to the topic: I see it as a problem of not enough education and too much trust. People are not taught how to verify the authenticity and legitimacy of software, and put too much trust in claims of authority. It's not just a consumer problem either, look at the CrowdStrike incident: people in the industry knew it was shit, but the decision makers kept trusting it because they are a big name. How did they become a big name? The same way a lot of other companies do, by bribing the early decision makers into using them.

Back to consumers: it doesn't help that there's no first class sandboxing features. Both Android and iOS rely heavily on app store controls. Sure, there are some system controls, but the user has barely any agency over them.

It's good to have established release channels that don't rely on third parties in the first place. Everything beyond that is for convenience and strictly optional.

Unfortunately this is a moving target, depending on what you define as your trust anchor.

Is your anchor the original Team? Fdroid with the (reproducible) build? Something else?

depending on the answer, the "good" solution is probably different from mine

I don't trust f-droid as well, because some of its apps crash the (un)installer and can therefore never be removed.

However, you need a trustworthy party and they have to digitally sign the APK after checking the code (changes) and compiling it themselves. They can also sign messages they send to the public.