> Most people accept that "free" apps should be able to be installed any way that people like.

That doesn't make it legal or safe. Re-distributing copyrighted material is questionable even in Portugal.

But more importantly there's no guarantee the app binary was not modified and repackaged to include malicious code.

It is very easy to verify these apps have not been modified if you also have access to a known good copy of the same app. Install known good copy -> install suspect APK as upgrade -> signature check performed on upgrade verifies that it was signed with the same key as the old version, so if the upgrade succeeds there has been no modification.

Actually Google is adding a way to verify it came from them:

https://android-developers.googleblog.com/2018/06/google-pla...

They specifically cite being able to do this peer to peer.

How do you get access to a known good copy of the app?

Especially since the normal use of an APK intermediary is that one does not have access to a known good source such as Google Play

Android apps are generally signed by the developer in question. APKMirror verifies the apps they distribute are signed by the original developers.

Legality of distributing "free as in beer" stuff that isn't "free as in speech" is always an interesting topic, in the case of Europe, I suspect we'll see more revision on that front as these cases regarding the Play Store and the license changes develop. It's possible, for instance, that the EU might feel that preventing sideloading of a Google app "ties" it to the Play Store in a way they find distasteful.

It's interesting to me that as of yet, Google has tolerated APKMirror, likely because it's run by Google/Android enthusiasts, and not intended for circumventing Google's business model. I'd be very curious how Google distinguishes Aptoide as something to be stopped, but APKMirror as something to be permitted.

The apps are signed. If you modify them and try to install an updated version on top of the one you already had from the Play Store, it will not match the signature and fail to install.

To play devil's advocate, I can just as easily install lineageOS and then install Google's apps.

https://www.xda-developers.com/google-blocks-gapps-uncertifi...

As Google seems to explicitly allow that, does it actually matter if I download opengapps and flash it myself versus getting it from APK mirror or Aptiode?

Presumably, if you bought a phone that originally had the Play Store and then flash it with Lineage, Google has licensed that phone already to run Google Apps. The preloading agreement with the manufacturer, which is what this license scheme is designed to protect, is still working as intended, so Google has no reason to intervene.

Google's behavior would also generally lead one to believe they are not concerned about what enthusiasts/tech pros do with their phones, as that's a niche quantity of users who don't really negatively impact their bottom line. They're chiefly concerned with ensuring manufacturers are only selling devices with their apps installed and set as default.

I agree they are chiefly concerned with manufacturers. However, if a user bought a phone from a device manufacturer that did not license it, from that article, it seems like they can still license it themselves. However, that opens up the idea that if that becomes more widespread, than they would lock down this "loophole".

I mainly bring it up as if an app is "free" (as in beer), does it really matter where you get it from (assuming it is untampered with)? I know they can forbid redistribution in their ToS, but is that actually enforceable legally?

Yes. Illegal redistribution violates the owner's copyright (in its absolute literal sense). While there may be no actual damages, a country might allow for statutory damages to be sought after. For example, the US allows for such statutory damages:

https://www.law.cornell.edu/uscode/text/17/504