Use Waydroid with Kicksecure
Donate
How-To: Use Waydroid with Kicksecure.
Documentation for this is incomplete. Contributions are happily considered! See this for potential alternatives.
Install Waydroid
[edit]1 Review the third-party repository warning.
Security warning: Adding a third-party repository and/or installing third-party software allows the vendor to replace any software on your system, including but not limited to the installation of malware, file deletion, and data harvesting. Proceed at your own risk! See also Foreign Sources for further information. For greater safety, users adding third-party repositories should always use Multiple Kicksecure to compartmentalize VMs with additional software.
Documentation in the Kicksecure wiki provides guidance on adding third-party software from various upstream repositories. This is especially useful since upstream often includes generic instructions for different Linux distributions, which may be complex for users to follow. Additionally, documentation in Kicksecure usually places a higher emphasis on security and verifying digital software signatures.
The instructions provided here serve as a "translation layer" from upstream documentation to Kicksecure, offering assistance in most scenarios. Nevertheless, it's important to recognize that upstream repositories and software may change over time. Consequently, the documentation on this wiki might require occasional updates, such as revised signing key fingerprints, to remain current and accurate.
Please note, this is a general wiki template and may not apply to all upstream documentation scenarios.
Users encountering issues, such as signing key problems, are advised to follow the Self Support First Policy and engage in Generic Bug Reproduction. This involves attempting to replicate the issue on Debian trixie, and contacting upstream directly if the issue can be reproduced, as such problems are likely unspecific to Kicksecure. In most cases, Kicksecure is not responsible for, nor capable of resolving, issues stemming from third-party software.
For further information, refer to Introduction, User Expectations - What Documentation Is and What It Is Not.
Should the user encounter bugs related to third-party software, it is advisable to report these issues to the respective upstream projects. Additionally, users are encouraged to share links to upstream bug reports in the Kicksecure forums and/or make edits to this wiki page. For example, if there are outdated links or key fingerprints that need updating, please feel free to make the necessary changes. Contributions aimed at maintaining the accuracy and currency of information are highly valued. These updates not only improve the quality of the wiki but also serve as a useful resource for other users.
The Kicksecure wiki is an open platform where everyone is welcome to contribute improvements and edits, with or without an account. Edits to this wiki are subject to moderation, so contributors should not worry about making mistakes. Your edits will be reviewed before being made public, ensuring the integrity and accuracy of the information provided.
2 Follow the platform specific instructions.
- Kicksecure: Perform these steps inside Kicksecure.
- Kicksecure for Qubes: Perform these steps inside Qubes
kicksecure-18Template.
3 Add the Waydroid OpenPGP key to the system APT keyring.
To add the signing key, follow steps 1 to 4.
1 Securely download the key.
Select your platform.
Kicksecure
If you are using Kicksecure (kicksecure), run.
scurl https://repo.waydro.id/waydroid.gpg --output waydroid.gpg
2 Display the key's fingerprint.
Optional for better security. If you are interested, click on Expand on the right.
gpg --keyid-format long --import --import-options show-only --with-fingerprint waydroid.gpg
Verify the output.
- Digital signatures are a tool enhancing download security. They are commonly used across the internet and nothing special to worry about.
- Optional, not required: Digital signatures are optional and not mandatory for using Kicksecure, but an extra security measure for advanced users. If you've never used them before, it might be overwhelming to look into them at this stage. Just ignore them for now.
- Learn more: Curious? If you are interested in becoming more familiar with advanced computer security concepts, you can learn more about digital signatures here: Verifying Software Signatures
The most important check is confirming the key fingerprint exactly matches the output below. [4]
Key fingerprint = 0D27 43A2 4328 AE06 34DF 3557 959F E34E 90E5 1522
Warning:
Do not continue if the fingerprint does not match -- this risks using infected or erroneous files! The whole point of verification is to confirm file integrity.
3 Copy the signing key to the APT keyring folder. [5]
sudo cp waydroid.gpg /usr/share/keyrings/waydroid.gpg
4 Adjust permissions on the signing key. [6]
sudo chmod 0644 /usr/share/keyrings/waydroid.gpg
4 Add the Waydroid third-party APT repository.
echo "Types: deb URIs: https://repo.waydro.id/ Suites: trixie Components: main Enabled: yes Signed-By: /usr/share/keyrings/waydroid.gpg" | sudo tee /etc/apt/sources.list.d/waydroid.sources
5 Install the waydroid package.
Install package(s) waydroid following these instructions:
1 Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: In Template.
2 Update the package lists and upgrade the system.
sudo apt update && sudo apt full-upgrade
3 Install the waydroid package(s).
Using apt command line --no-install-recommends option is in most cases optional.
sudo apt install --no-install-recommends waydroid
4 Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification.
5 Done.
The procedure of installing package(s) waydroid is complete.
6 Completion.
The process of installing Waydroid is complete.
See Also
[edit]- Debian RFP: waydroid – Run a full Android system on Wayland using a container
- https://forums.kicksecure.com/t/running-android-apps-inside-kicksecure-waydroid/304
- https://forums.whonix.org/t/running-android-apps-inside-whonix-workstation-waydroid/16911
Footnotes
[edit]- ↑
Using Qubes UpdatesProxy (
http://127.0.0.1:8082/) because Qubes Templates are non-networked by Qubes default and therefore require UpdatesProxy for connectivity. (APT in Qubes Templates is configured to use UpdatesProxy by Qubes default.) - ↑
Even more secure would be to download the key Disposable and then
qvm-copy it to the Qubes Template because this would avoid curl's attack surface but this would also result in even more complicated instructions. - ↑
Even more secure would be to display the key in another Disposable because this would protect the Template from
curl's andgpg's attack surface but this would also result in even more complicated instructions. - ↑ Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
- ↑
https://forums.whonix.org/t/apt-repository-signing-keys-per-apt-sources-list-signed-by/12302
- ↑
This is necessary because the umask set in Kicksecure will result to the file permissions of the copied file being set to
0640, which will prevent them from being read by non-root users.
A secure by default operating system with the latest security research in place.
At
Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
2012-
2026 ENCRYPTED SUPPORT LLC
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!