Certificate issue

[IzzySoft]

A scan (see here for details and background) just revealed the APKs at your releases are signed using a debug key. As that has security implications, may I ask you to please switch to a proper release key, and provide the corresponding APK signed with it? Thanks in advance!

[Netdex]

The APK artifacts provided in this repository are for development purposes and are not intended to be installed on a device for daily use.

Relevant meme:


[IzzySoft]

Then would you consider to make APKs for "daily use" available here? Asking because your app is in my repo since 11/2020.

[Netdex]

Ah, didn't realize the APKs were being published somewhere. I published a new release with signed artifacts.

[IzzySoft]

Yes, it's a repo for FOSS apps. To make them easier to find and keep them updated on-device. You can choose your favorite F-Droid client as well as your favorite repositories. Mine just happens to be the second largest…

Thanks for doing this! Please give me a ping here when they're available here, as I need to do some adjustments on my end then, too (like, pinning the hash of the new certificate as it would otherwise be rejected; and including a hint that those using an older version need to uninstall/reinstall).

PS: Ah wait, you wrote "published", so I'll check right now!

[IzzySoft]

Ah, package renamed as well – yeah, when better than now, as to update one needs to uninstall/reinstall anyway :wink:

If you want to have some icon/screenshots included, just let me have them. I can also offer you a PR with the metadata I've set up on my end to integrate them here with your repo, so you can adjust as you see fit and modifications would be fetched with each update. I'm using Fastlane structures for that (which are the quasi-standard in the Android world), and you can use my Fastlane Cheat Sheet for guidance. Just let me know.

looks good as well. If you want to get rid of that blob (DEPENDENCY_INFO_BLOCK):

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains.

Thanks a lot once more – and feel free to close this issue unless you want to keep it open for "the BLOB" :wink:

[Netdex]

Yes, it's a repo for FOSS apps

Very cool.

Ah, package renamed as well

Yeah, I must have done that at some point... thanks for making the necessary adjustments.

I can also offer you a PR with the metadata I've set up on my end to integrate them here with your repo

That would be great 🙂

If you want to get rid of that blob (DEPENDENCY_INFO_BLOCK)

Re-uploaded the latest release artifact with "the BLOB" gone.

[IzzySoft]

That would be great 🙂

There you go :smiley: Should questions arise, feel free to reach out.

Re-uploaded the latest release artifact with "the BLOB" gone.

Thanks! Confirmed and replaced here as well.