Skip to main content

mastodon - Link to source

Dear #Android #App #Developers, as it still happens far too often (no naming, no shaming! 💩 happens to everyone of us) a reminder to take good care of your #signing keys – and also take precautions for the case that your keystore might get lost. Please take a look at: f-droid.org/2023/09/03/reprodu… where I outline this topic.

Thanks!

#security


Reproducible builds, signing keys, and binary repos | F-Droid - Free and Open Source Android App Repository

Earlier this year, we reported about our progress concerning reproduciblebuilds. Meanwhile,more and more apps are using this; you can find some statisticsher...
f-droid.org
#android #app #security #developers #signing
in reply to IzzyOnDroid ✅

S1m
mastodon - Link to source
S1m
• •
How do you deal with key rotation ? And, is it planned for the client to inform about an application they have to reinstall (because of that) ?
in reply to S1m

IzzyOnDroid ✅
mastodon - Link to source
IzzyOnDroid ✅
• •
@S1m Key rotation does no longer work at F-Droid.org, but it does at IzzyOnDroid (as we implemented the suggested patches instead of accepting their implementation of the "POC fix" back then). If Key rotation is used, no notifications are needed; IIRC, Android handles that (we have only 1 such app yet). And establishing RB here does not require it either, as we only ship the APKs signed by their resp. devs to begin with (RB runs on a "parallel track" here).
@S1m
in reply to IzzyOnDroid ✅

S1m
mastodon - Link to source
S1m
• •

Ok, great ! Hope they fix it too.

The notification is still required for developers that loses their keys 😬

in reply to S1m

IzzyOnDroid ✅
mastodon - Link to source
IzzyOnDroid ✅
• •
@S1m I have my doubts towards the former (that would mean rolling back their implementation, at least in parts, and using the suggested patches instead, which they rejected. The argument was that f-droid.org itself does not need key rotation, IIRC.). And as long as we still use fdroidserver, the only way we can notify is via the inlined per-release changelogs (aka "Fastlane changelogs"), which is what we do.
@S1m
in reply to IzzyOnDroid ✅

S1m
mastodon - Link to source
S1m
• •
Hm, there should be a way to set a warning for a version in the index that the client can use to inform users
in reply to S1m

IzzyOnDroid ✅
mastodon - Link to source
IzzyOnDroid ✅
• •
@S1m which needs to be implemented serverside (fdroidserver writing the index) AND clientside (to show it). Without the index itself supporting it, there's nothing the clients can do. So: gitlab.com/fdroid/fdroidserver… ? gitlab.com/fdroid/fdroidclient… ? Does not look like this will happen.

Push information to users (of a specific app) (#195) · Issues · F-Droid / Client · GitLab

I'd like to have the ability to push information to the user. E.g. we do want to notify users if we had to re-release an app or (what...
GitLab
@S1m
in reply to IzzyOnDroid ✅

S1m
mastodon - Link to source
S1m
• •
I'll try to open issues for more specific messages then: metadata to warn about removed application, and metadata to warn about application that need to be reinstalled
in reply to S1m

IzzyOnDroid ✅
mastodon - Link to source
IzzyOnDroid ✅
• •
@S1m Remember that WE cannot implement those. Everything that needs changes to the index, is out of our hands – at least as long as we're still bound to fdroidserver. So such issues would need to be filed *there* – with the tools that generate the indexes. Our client devs would surely pick up those data once available.
@S1m
in reply to IzzyOnDroid ✅

Fay 🏳️‍🌈
mastodon - Link to source
Fay 🏳️‍🌈
• •
@S1m the f-droid client doesn't handle key rotation. I think neo store and droid-ify allow disabling the key fingerprint check allowing android to handle the rotation but all clients will by default consider the key incompatible and not offer an update as the index format itself does not support key rotation even when generated using an implementation that doesn't flat out reject all APKs with rotated keys like fdroidserver does
@S1m
in reply to Fay 🏳️‍🌈

IzzyOnDroid ✅
mastodon - Link to source
IzzyOnDroid ✅
• •
@obfusk @S1m Confirmed that NeoStore can handle that. Just checked: Droid-ify had a new release this year already, so it should now handle that as well by now (last time I've checked it was implemented but not yet published, now it should be both). I cannot tell about other clients or how they might handle it.
@Fay 🏳️‍🌈 @S1m
⇧