Obtainium: Pulling Android Updates Directly From Release Pages

The Problem: App Stores as a Bottleneck

Android users who want the latest version of an app often wait days or weeks after a developer publishes a release. Google Play and even F-Droid add their own review and build delays. Obtainium attacks that delay by installing and updating apps directly from the developer's release page. It is aimed at users who already sideload APKs, who follow beta channels, or who use apps distributed only through GitHub or a personal website. The README's original motivation links to a video titled "You should use this instead of F-Droid," which sets the tone: this is a tool for people who find the F-Droid pipeline too slow or too restrictive. It is not for casual users. It is for people who know what a release page is and want to control the exact artifact they install.

How It Works: Source Adapters and Release Tracking

Obtainium is not a single downloader. It is a framework of source adapters, each tailored to a specific hosting platform. The README lists over twenty sources, from GitHub and GitLab to APKPure, Aptoide, and even Huawei AppGallery. For each app you add, Obtainium stores a configuration that tells it which source to query and how to parse the release list. It then checks those sources periodically, compares the latest version against what is installed, and offers an update. The data flow is simple: Obtainium fetches a release page, extracts the APK link and version string, downloads the file, and hands it to the Android package installer. For sources that do not expose a clean API, it falls back to scraping HTML. The README is direct about this: "For some sources, data is gathered using Web scraping and can easily break due to changes in website design." That is the core trade-off. Direct access gives you speed and control, but it depends on the source's page structure staying stable.

Getting It Running: Installation and Verification

Obtainium is not on Google Play. You install it from one of three places listed in the README: the GitHub releases page, IzzyOnDroid, or F-Droid. The F-Droid package uses a different package ID, `dev.imranr.obtainium.fdroid`, while the main build uses `dev.imranr.obtainium`. The README provides a SHA-256 hash of the signing certificate, `B3:53:60:1F:6A:1D:5F:D6:60:3A:E2:F5:0B:E8:0C:F3:01:36:7B:86:B6:AB:8B:1F:66:24:3D:A9:6C:D5:73:62`, and notes that the F-Droid flavour shares the same signature thanks to reproducible builds. It also points to a PGP public key for verifying APK hashes. That level of verification detail is unusual for a sideloaded app, and it matters because Obtainium itself installs APKs, so its own integrity is the foundation of everything else. After installation, you add apps either by importing a configuration from the crowdsourced site or by manually entering a source URL and letting Obtainium parse it. The deep links feature lets you link straight to an import, which is how the project's badge system works.

The Scraping Fragility: A Real Limitation

The most obvious failure mode is that any source can change its HTML structure and break Obtainium's parser. The README admits this outright. If you track an app from a small blog that posts direct APK links, and that blog redesigns its page, update checks for that app can break. The fallback "HTML" source is a catch-all for any URL that returns links to APK files, but that is the most brittle of all. Obtainium installs from the source you configure, so that source has to be one you trust; the README recommends the separate "Verified Apps" tool for app verification. The README marks APKMirror and RockMods as track-only sources.

The Alternative: F-Droid's Reproducible Builds

The obvious alternative is F-Droid; the README links a video titled "You should use this instead of F-Droid" as the original motivation, and Obtainium is itself also distributed through F-Droid. F-Droid builds apps from source code and signs them with its own key, which means you get a guarantee that the APK matches the source. Obtainium does not do that. It downloads whatever binary the developer uploaded to a release page. For a user who values provenance over speed, F-Droid is the safer choice. The trade-off is that F-Droid only hosts free and open source software, and its build pipeline can be slow. Obtainium covers proprietary apps from stores like APKPure and Aptoide, which F-Droid will never touch. So the real difference is not just speed; it is the scope of what you can track. F-Droid is a curated, verified repository. Obtainium is a universal scraper that trusts the source. The README even links to a "Verified Apps" tool from Privacy Guides that integrates with Obtainium, which suggests the project is aware that verification has to happen elsewhere. That integration is a partial answer to the trust problem, but it is an opt-in extra, not a built-in guarantee.

Maintenance and Upgrade Cost

Obtainium is under active development, with v1.7.2 on 2026-10-24, v1.7.3 on 2026-10-25 and v1.7.4 on 2026-11-01. That pace means you will see frequent updates to the app itself, and each update may change the configuration format or the behavior of source adapters. The crowdsourced configuration site, apps.obtainium.imranr.dev, is a separate repository where users submit and maintain app-specific settings. If a configuration breaks, you may need to wait for someone to fix it or fix it yourself by editing the source URL and parser settings. The project is GPL-3.0 licensed, so you are free to fork and modify it, but the maintenance burden is real: you are not just installing an app, you are maintaining a set of scrapers. For a single user with a handful of apps, that is manageable. For a team managing dozens of devices, it becomes a sysadmin task. There is no central server that pushes updates; every device runs its own checks, so there is no server cost, but there is also no way to push a configuration change to all devices without manual effort.

Who Should Adopt It and What to Verify First

Adopt Obtainium if you are a developer who wants to distribute nightly builds without waiting for store approval, or a power user who wants updates the moment a release page changes. Do not adopt it if you expect a zero-trust environment or if you cannot tolerate a source breaking silently. Before you rely on it, verify the APK signature against the SHA-256 hash in the README, and test each source you plan to use by adding one app and waiting for a real update cycle. Check whether the source you want is marked track-only in the README. For critical apps, keep a secondary update path. Obtainium is a tool for people who understand the trade-off between convenience and control. It does not solve the trust problem; it just moves it to the source you choose.

Editorial conclusion

Adopt Obtainium if you want to bypass app stores, track pre-release builds, or update apps that never land on F-Droid. Skip it if you need a fully automated, zero-maintenance updater or if you cannot accept the risk of sideloading APKs from third-party mirrors. Before installing, verify the APK signature against the SHA-256 certificate hash listed in the README, and test a few sources to see if scraping breaks for the apps you care about.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes