mastodon - Link to source

Before the update run completes & app-rain toot comes, some other exciting news from the #IzzyOnDroid repo that won't fit in there:

* JetNote was removed as it still used a debug key for signing.
* Occtax switched to a new and proper signing key, using key rotation, so even direct updates are possible*.

So gitlab.com/IzzyOnDroid/repo/-/… could finally be closed. There should be no debug-signed apps at IzzyOnDroid anymore after the next sync.

(1/2)


scan existing APKs for use of debug keys (#477) · Issues · IzzyOnDroid / repo · GitLab

once #475 has been completed, existing APKs should be scanned for...
GitLab
#izzyondroid
in reply to Julian

mastodon - Link to source

IzzyOnDroid ✅

@j_r technically possible yes. Practicable no, for multiple reasons:

* you'd never get hold of the signing key used by F-Droid
* you should not give them yours either
* even if you would or they would, their setup would not allow it (that part of fdroidserver was broken back in January/February, as I just mentioned again). It would however work with IzzyOnDroid. But then a "seemless switch" would only be possible with NeoStore or Droid-ify, otherwise manual actions would be needed (as outlined)

@Julian
in reply to Sentinel999

mastodon - Link to source

IzzyOnDroid ✅

@Sentinel999 and now look at the "provided by": Installed from F-Droid, update from IzzyOnDroid. Most likely FairEmail is not RB at F-Droid, but let me check… Bingo. So F-Droid ships a version signed with their key, while IoD ships it signed with Marcel's key. Expected behavior.

> I disable the sig check only.

Which is why the update now is offered to you *despite the different sig*. This only makes sense if you override sig check in the system eg via an Xposed module. Better switch it back 😉

@Sentinel999
in reply to Sentinel999

mastodon - Link to source

IzzyOnDroid ✅

@Sentinel999 and today we learned what the signature check is for 😄 While in this specific case a cross-update would (hopefully 😉) be harmless, in another case someone could have put up an altered APK with harmful code. So the signature check prevents you from installing such "altered APKs" – only APKs with the same signature (or a proper key rotation, in which case you'd need to disable sigcheck once *for that update only* in Neo Store, eg with the current Occtax) will be accepted by Android.
@Sentinel999
⇧