Security & transparency

Trust should be explained, not implied.

Dapport is a publisher-authorized Android catalogue built on the public Solana Mobile publishing format. It is not a ROM, an Android modification, or an official Solana Mobile store.

Three visible boundaries

Who checks what?

Each layer has one job. No single badge silently replaces the other evidence.

  1. Solana publishing evidence

    Dapport verifies the current App NFT publishing authority, the Release relationship, and the publisher's separate distribution consent.

  2. Dapport server and phone

    The downloaded APK must match its published size, SHA-256, package, version, SDK, permissions, signature, and signing certificate.

  3. Android

    Android's supported PackageInstaller shows the final system confirmation and enforces installed-package compatibility.

Honest limits

Identity is not a security audit.

Dapport can prove that the file matches the release identity authorized by its publisher. It cannot promise that an app is bug-free, risk-free, financially sound, or independently audited.

What “checked release” means
The APK identity matches the release data Dapport synchronized from finalized Solana publishing metadata.
What it does not mean
It is not a blanket “safe” badge, a code audit, an endorsement, or proof of Solana Mobile approval.
Solana Mobile approval
When available, it is displayed as a separate fact. A publisher cannot assign it to their own app.

On your phone

Least privilege by design.

No root or modified Android

Dapport uses normal Android application APIs and the supported system installer.

No silent installs

Dapport explicitly requires Android's user confirmation before an installation or update proceeds.

No app-inventory upload

Only successful Dapport installations are recorded locally. Your installed-app inventory never leaves the device.

No broad package visibility

Dapport does not request QUERY_ALL_PACKAGES and never enumerates unrelated applications.

No consumer wallet required

Browsing and installing do not require a wallet, seed phrase, transaction, or access to your funds.

Updates keep one identity

Dapport updates must use its permanent Android signing certificate, and Android rejects incompatible signatures.

Technical detail, when you want it

Inspect the boundaries.

APK download and validation

Dapport enforces HTTPS, redirect and size limits, verifies the complete SHA-256, validates the APK with AOSP apksig, inspects its manifest and current signer, then rechecks the prepared file immediately before creating the PackageInstaller session.

Publisher authorization

The publisher signs an authentication message and a different distribution-consent message. Consent is bound to the app, domain, environment, policy and terms version, and can be revoked without transferring an NFT or signing key.

Package visibility and conflicts

Dapport tracks only its own successful installs and performs targeted package checks where Android permits them. If another edition cannot be inspected, uncertainty stays visible and Android remains the final conflict authority. Dapport never uninstalls an existing edition.

Dapport itself

The first Dapport APK is downloaded from the public release repository and its SHA-256 is published on the download page. Later updates require the same embedded signing identity and pass through the same native validation path.