Redoubt

Redoubt’s F-Droid repository

Redoubt runs its own F-Droid repository. It serves the same APKs as the GitHub release, signed with the same key, and F-Droid tells you when a new version is out.

Add the repository

  1. Install the F-Droid app from f-droid.org if you do not have it.
  2. On the phone, open this link: add Redoubt’s repository to F-Droid. Or scan the QR code below with F-Droid (Repositories → +), or type the address and fingerprint there by hand.
  3. Check that F-Droid shows the fingerprint below, then add the repository and install Redoubt from it.

QR code that adds Redoubt's F-Droid repository with its fingerprint

Repository address

https://redoubtbrowser.hel1.your-objectstorage.com/repo

This address is for the F-Droid app. Opened in a web browser, it only shows an error.

Repository fingerprint

B0A8CDBB 61AA4FC3 CA1FED71 F4CAECEB 7B00E39D 4E6E0583 A6370708 62AC5567

This is the fingerprint of the key that signs the repository’s index, not of the app. F-Droid refuses an index signed by any other key once you have added the repository with it.

The app inside is the same APK

The repository does not rebuild or re-sign Redoubt. Each APK in it is byte for byte the file on the GitHub release, and its signing certificate has the same SHA-256 as every other Redoubt APK; see Verify the download. An APK installed from GitHub and one installed from this repository update each other in place.

F-Droid offers the APK for your phone’s processor (64-bit ARM, 32-bit ARM or x86_64). The universal APK is only on the GitHub release.

Why F-Droid shows “Tracking”

F-Droid lists Redoubt with the anti-feature Tracking. That is deliberate: it is the same label f-droid.org gives Fennec F-Droid and Mull for contacting Mozilla services by default. Redoubt, too, contacts Mozilla’s Remote Settings (blocklists and certificate revocation data) and addons.mozilla.org (add-on updates, including uBlock Origin) by default. Telemetry, experiments, crash-report upload and Google Play services are removed. What those requests contain is listed in the privacy policy; the limits are on Privacy & limits.

Older releases

The repository shows the newest 5 releases. Every older release stays available in its archive section, https://redoubtbrowser.hel1.your-objectstorage.com/archive, signed with the same key. To see it in F-Droid, open Repositories, select Redoubt’s repository, open Settings and turn on Show archived apps and outdated versions of apps; on Redoubt’s app page, pick Redoubt (archive) in the repository list to see the older versions. Installing an older version over a newer one is a downgrade, which Android allows only after uninstalling the app, and that removes its data.

Updates

F-Droid notifies you of new versions. Redoubt’s own opt-in Check for updates switch is not needed: Redoubt hides it when F-Droid installed or last updated the app.

Where the repository is hosted

F-Droid downloads the index and the APKs from redoubtbrowser.hel1.your-objectstorage.com, a Hetzner Object Storage bucket in Helsinki, Finland that this project rents from Hetzner Online GmbH. Hetzner sees your IP address and the time of each request. The address is Hetzner’s, not redoubtbrowser.org, because Hetzner’s object storage cannot serve a bucket under its own domain; the fingerprint above, not the address, is what proves the repository is Redoubt’s. This page itself is hosted on GitHub Pages.

This repository is not f-droid.org’s main repository, and Redoubt is not there. f-droid.org can publish developer-signed APKs only if it reproduces the build bit for bit; Redoubt’s build is not reproduced across machines yet, so f-droid.org would sign it with F-Droid’s own key, which makes it a different app to Android, with a different fingerprint from every other Redoubt APK.