MultiStore: an open source Android app that searches multiple APK stores in one query and verifies every APK before it installs (BETA)

Hello, fellow pirates. First things first: I asked the mods before posting this, and they gave me the go-ahead.

Like some of you I guess, I spend a fair amount of time hunting down a single APK. You know how it goes, the same app name typed into every search box, four results that all claim to be the same version, and no easy way to tell which one is actually serving the real file. I got tired of it, and since I am a software engineer I figured I could stop complaining and build the thing instead, so that is what I have been doing lately. It is called MultiStore, it is open source, and this is the first time I am showing it to anyone.

What it does. It is a native Android app (Kotlin, Compose, Android 8.0 and up) that takes one query and sends it to multiple third party stores (currently 9) at the same time. Results stream in as each store answers rather than waiting for the slowest one, and they arrive grouped one row per app, with every store that carries it listed underneath. So instead of comparing tabs by hand, you get one row for the app you wanted and a list of the places that have it. If a store fails or gets rate limited, it is named right next to your results rather than quietly disappearing. You pick the store you want, and from there it downloads, verifies, installs, and keeps that app updated afterwards.

What it is not, because this is the part I would want to know first if someone else were posting this. It hosts nothing, mirrors nothing and rehosts nothing. It reads pages that are already public. There is no telemetry, there are no accounts, and there is nothing resembling analytics. The diagnostics log is switched off by default and never leaves your device on its own. If you ever want to send me one, you export it yourself, as plain text you can read through before deciding to share it.

On the AI question, since it will come up anyway. I used Claude Code as a development assistant, and it sped the work up a lot, above all on the tests and on the nine per store scraping adapters, which are a mountain of repetitive parsing I would probably still be grinding through otherwise. What it did not do is decide how any of this works. Every store's behaviour was measured against the live sites rather than assumed, with the real pages saved as fixtures so the tests run against what those sites actually served, and the design calls are mine. The source is GPL-3.0 on GitHub, so you do not have to take my word for any of that.

Verification, which is the part I actually cared about. You should assume that any APK you did not build yourself is hostile, and the app is built on that assumption. There are seven checks before anything installs, and they are identical for all stores, with no exceptions and no favourites:

• expected size
• SHA-256 computed streaming during the download, compared to the store's published hash where one exists
• the archive read and verified with apksig (v1/v2/v3)
• package name matched against the listing, a hard block that cannot be turned off
• signer compared against the certificate already on your device, including v3 key rotation
• anti-downgrade on versionCode
• a record of what was installed from where

The stores implemented today are AN1, APKCombo, APKMirror, APKMODY, F-Droid, LiteAPKs, MODYOLO, PDALIFE and Uptodown, and I cherry-picked them off the Megathread here. Each one can be toggled on and off individually, so if you do not trust one of them, switch it off and it stops being consulted. More are planned, including some from the FMHY megathread.

To be clear about where this is: it is a beta, v0.5.1 at the time of this post.

Repo: https://github.com/FedeFluork/multistore

APK: https://github.com/FedeFluork/multistore/releases/latest

What I would really like back from you is an honest feedback, including the uncomfortable kind. What would you change, and what is still missing before you would reach for this instead of your current habit? Bug reports are very welcome too, run it and tell me what broke, or open an issue on the repo. And if you would rather contribute than complain, the repo is open to pull requests.