@Izzy Do you how to use sendevent? I'm trying to emulate longpress but with no luck. Got some tutorials but oh well, I don't know what they are talking about.
@Firelord What do you wanna hear? I wish in those cases the bounty could be split, but that's not the case. So the best thing to do is accepting one and awarding the other, as suggested – though that's not really satisfying, as it suggests the accepted answer solved the issue.
@Izzy Right. Accepting an answer depicts to everyone that OP is satisfied and the answer has covered everything which isn't the case here. What a load of confusion it is. I can choose to let the points go down the hole but that would be bad, really bad thing to consider. I'll ask Andrew to fill in a bit more detail about point 1 in the answer since the bounty specifically asked to answer point 1 and 2.
@MadaraUchiha Check with F-Droid. With some luck you'll find the app there – and then you can be sure it was compiled from the Github code. F-Droid stands for that.
F-Droid always compiles APK files directly from the sources (usually from Github). That's why apps cannot be cross-updated with other sources: packages on F-Droid are signed with the F-Droid key (no other way, as they compile themselves).
On other places (Playstore, Aptoide) devs upload their own compiled APK files. So you get the binaries there, but cannot really say whether some files from the listed sources have been replaced. There might be ways, but not for "the average end-user".
Aptoide e.g. uses this fact for their "security badges": one verification is comparing signatures with those the same app (and version) has on other platforms (such as Playstore). If they match, that says the APK files have not been tampered with. (of course they also use additional measures to tell whether an APK file "looks clean")
Android Enthusiasts
Android Enthusiasts