F-Droid Basic is the preferred app store for CalyxOS. All the apps available in F-Droid are free and open source software, and contain no trackers or advertising.

• Install free software Android apps.
• In addition to the standard F-Droid source for apps (aka “repository”), CalyxOS includes a source for CalyxOS apps, which allows us push out out-of-band updates for various apps when needed.

In earlier versions, CalyxOS gave the client app (F-Droid) special privileges to streamline app updates, installs, and uninstalls. However, since CalyxOS 5.1.2, these privileges have been dropped for new installs in favor of a newer client app (F-Droid Basic).

Security

The default repositories configured in CalyxOS are run by F-Droid and CalyxOS itself. However, these additional repositories (sources) introduce the possibility of an attacker compromising the remote app repositories and serving a malicious update. To guard against this type of attack, these repositories go through multiple verification steps.

App stores cannot modify the fundamental security model of the Android operating system: When installing an update, the new app will only be accepted if verified to be from the same developer as the original version of the app. However, Android also always accepts the identity of the developer when first installing a new app, which is why the app repositories mustn’t be compromised.

For more information, see F-Droid security model.