search

microg / GmsCore

Free implementation of Play Services
https://microg.org
Apache License 2.0
8.37k stars 1.7k forks source link

F-Droid: GmsCore invalid signature #1932

Open apprehensions opened 1 year ago

apprehensions commented 1 year ago

Describe the bug Installing GmsCore from the MicroG F-Droid repository fails due to a signature mismatch

To Reproduce Steps to reproduce the behavior:

  1. Use a non-official F-Droid client such as Droid-ify or Neo Store (See below for why F-droid is excluded.)
  2. Install GmsCore from the MicroG F-Droid repository
  3. See error: 'Could not validate microg Services Core: Invalid signature.'

Expected behavior GmsCore installs from F-Droid as expected

System Android Version: 13 F-Droid: 1015056

Additional context The regular F-Droid client does not care about the signature: No versions with compatible signature, as for another F-Droid client such as Droid-Ify, Neo Store, etc - it does and fails installation due to a checksum mismatch. This could be a repository problem.

apprehensions commented 1 year ago

Fresh.

apprehensions commented 1 year ago

Dude. You're missing the main issue, it is related to F-Droid installation failing on third party clients.

WikiBayer commented 1 year ago

You can only update the microg with the official microG build. Some custom roms (omnirom, /e/OS,...) have a own build with own signature.

ale5000-git commented 1 year ago

@apprehensions

The regular F-Droid client does not care about the signature: No versions with compatible signature, as for another F-Droid client such as Droid-Ify, Neo Store, etc - it does and fails installation due to a checksum mismatch. This could be a repository problem.

Actually it is the opposite, if it say "No versions with compatible signature" it mean that it care about the signature. If another client try to update even if the signature is different then it is bugged.

SkewedZeppelin commented 1 year ago

this occurs when signature spoofing for microG is unavailable because F-Droid sees the real microG signature whereas the repo metadata has the Google signature to ensure updates work once spoofed.