mastodon - Link to source

Dear #Android #App #Developers, as it still happens far too often (no naming, no shaming! 💩 happens to everyone of us) a reminder to take good care of your #signing keys – and also take precautions for the case that your keystore might get lost. Please take a look at: f-droid.org/2023/09/03/reprodu… where I outline this topic.

Thanks!

#security


Reproducible builds, signing keys, and binary repos | F-Droid - Free and Open Source Android App Repository

Earlier this year, we reported about our progress concerning reproduciblebuilds. Meanwhile,more and more apps are using this; you can find some statisticsher...
f-droid.org
#android #app #security #developers #signing
in reply to S1m

mastodon - Link to source

IzzyOnDroid ✅

@S1m Key rotation does no longer work at F-Droid.org, but it does at IzzyOnDroid (as we implemented the suggested patches instead of accepting their implementation of the "POC fix" back then). If Key rotation is used, no notifications are needed; IIRC, Android handles that (we have only 1 such app yet). And establishing RB here does not require it either, as we only ship the APKs signed by their resp. devs to begin with (RB runs on a "parallel track" here).
@S1m
in reply to S1m

mastodon - Link to source

IzzyOnDroid ✅

@S1m I have my doubts towards the former (that would mean rolling back their implementation, at least in parts, and using the suggested patches instead, which they rejected. The argument was that f-droid.org itself does not need key rotation, IIRC.). And as long as we still use fdroidserver, the only way we can notify is via the inlined per-release changelogs (aka "Fastlane changelogs"), which is what we do.
@S1m
in reply to S1m

mastodon - Link to source

IzzyOnDroid ✅

@S1m which needs to be implemented serverside (fdroidserver writing the index) AND clientside (to show it). Without the index itself supporting it, there's nothing the clients can do. So: gitlab.com/fdroid/fdroidserver… ? gitlab.com/fdroid/fdroidclient… ? Does not look like this will happen.

Push information to users (of a specific app) (#195) · Issues · F-Droid / Client · GitLab

I'd like to have the ability to push information to the user. E.g. we do want to notify users if we had to re-release an app or (what...
GitLab
@S1m
in reply to IzzyOnDroid ✅

mastodon - Link to source

Fay 🏳️‍🌈

@S1m the f-droid client doesn't handle key rotation. I think neo store and droid-ify allow disabling the key fingerprint check allowing android to handle the rotation but all clients will by default consider the key incompatible and not offer an update as the index format itself does not support key rotation even when generated using an implementation that doesn't flat out reject all APKs with rotated keys like fdroidserver does
@S1m