Dapport uses normal Android application APIs and the supported system installer.
Security & transparency
Trust should be explained, not implied.
Dapport is a publisher-authorized Android catalogue built on the public Solana Mobile publishing format. It is not a ROM, an Android modification, or an official Solana Mobile store.
Three visible boundaries
Who checks what?
Each layer has one job. No single badge silently replaces the other evidence.
- Solana publishing evidence
Dapport verifies the current App NFT publishing authority, the Release relationship, and the publisher's separate distribution consent.
- Dapport server and phone
The downloaded APK must match its published size, SHA-256, package, version, SDK, permissions, signature, and signing certificate.
- Android
Android's supported PackageInstaller shows the final system confirmation and enforces installed-package compatibility.
Honest limits
Identity is not a security audit.
Dapport can prove that the file matches the release identity authorized by its publisher. It cannot promise that an app is bug-free, risk-free, financially sound, or independently audited.
- What “checked release” means
- The APK identity matches the release data Dapport synchronized from finalized Solana publishing metadata.
- What it does not mean
- It is not a blanket “safe” badge, a code audit, an endorsement, or proof of Solana Mobile approval.
- Solana Mobile approval
- When available, it is displayed as a separate fact. A publisher cannot assign it to their own app.
On your phone
Least privilege by design.
Dapport explicitly requires Android's user confirmation before an installation or update proceeds.
Only successful Dapport installations are recorded locally. Your installed-app inventory never leaves the device.
Dapport does not request QUERY_ALL_PACKAGES and never enumerates unrelated applications.
Browsing and installing do not require a wallet, seed phrase, transaction, or access to your funds.
Dapport updates must use its permanent Android signing certificate, and Android rejects incompatible signatures.
Technical detail, when you want it
Inspect the boundaries.
APK download and validation
Dapport enforces HTTPS, redirect and size limits, verifies the complete SHA-256, validates the APK with AOSP apksig, inspects its manifest and current signer, then rechecks the prepared file immediately before creating the PackageInstaller session.
Publisher authorization
The publisher signs an authentication message and a different distribution-consent message. Consent is bound to the app, domain, environment, policy and terms version, and can be revoked without transferring an NFT or signing key.
Package visibility and conflicts
Dapport tracks only its own successful installs and performs targeted package checks where Android permits them. If another edition cannot be inspected, uncertainty stays visible and Android remains the final conflict authority. Dapport never uninstalls an existing edition.
Dapport itself
The first Dapport APK is downloaded from the public release repository and its SHA-256 is published on the download page. Later updates require the same embedded signing identity and pass through the same native validation path.