Field Notes

source

wireguard inclusion policy violation

auto-updates w/o explicit user consent

StatusStableUpdatedStands on1 sourceSupportsnotes

An F-Droid fdroiddata issue from October 2023, opened by Fay Stegerman, reporting that WireGuard’s Android app shipped an in-app updater that violated F-Droid’s inclusion policy against downloading executable updates without explicit, informed opt-in. A saved copy is preserved here; the .raw.html companion is the provenance copy.

What it contains

The issue is evidence for two things at once.

First, a moderation data point: WireGuard added its updater in May 2023 and F-Droid noticed in October 2023, so a policy-relevant change to a security-critical app shipped for roughly half a year before anyone in the distribution pipeline flagged it. The episode supports the observation that F-Droid’s pipeline is automated scanning, not per-release human review.

Second, the thread preserves WireGuard developer Jason Donenfeld’s explanation for moving his users off F-Droid entirely. Having spent time inside the project, he concluded that F-Droid was “basically rotted and requires changes from the leadership on down,” that he did not feel good about its ability “to deliver updates of apps, not have its build infra hacked, stay updated with a good pace of development, attract new contributors, or even exist in the next N years,” and that reliance on F-Droid meant “its dysfunctionality holds my app users hostage.” WireGuard built its own updater, HSM-backed signing, and direct APK distribution, and declared the direct download and the Play Store its only supported installation sources. Because WireGuard was one of the few apps published on the developer-signed path, its users had a migration path off F-Droid — which Android app distribution trust models generalizes: apps F-Droid signs itself cannot migrate without reinstalling.

Limitations

Donenfeld’s assessment is one developer’s judgment, stated in a dispute over his own policy violation, and his xz-adjacent supply-chain views color the exchange. The thread is preserved as a primary record of the developer-relations dimension of the F-Droid critique, alongside PrivSec.dev on F-Droid security issues and the fdroidserver pinning bypass disclosures; it is not independent verification of the infrastructural claims. GrapheneOS cited this thread in January 2025 as a named-developer repudiation of F-Droid’s trustworthiness.

Built on 1 source (1 external).

Working out connections…