F-Droid report DisabledAlgorithm and KnownVuln

[ale5000-git]

In this page it report these:

• DisabledAlgorithm

  This APK was signed using a signature algorithm that was disabled because it is broken. Since April 2017, APK signatures that use MD5 are no longer considered valid, jarsigner and apksigner will return an error when verifying.

• KnownVuln

  This APK has a known security vulnerability, found by one of the scanners in fdroidserver. current APK has a weak MD5 signature aka AntiFeature:DisabledAlgorithm fix by making new release or rebuild to get an APK signed with the current signature algorithms uses a version of OpenSSL that has known vulnerabilities update the app to OpenSSL 1.0.2f/1.0.1r or higher. For more info, see How to address OpenSSL vulnerabilities in your apps

It would be nice to fix them.

[mar-v-in]

This is nothing we can fix, not sure why fdroidserver produces these messages, but

1. It's up to F-Droid to decide which digest algorithm to use, this is not controlled by me.
2. The latest Ichnaea backend on F-Droid is signed using SHA1 digests.

I guess these anti-features are outdated and have been fixed on the F-Droid side.

[ale5000-git]

I have reported to them and I'm waiting their reply.

[ale5000-git]

Ok, now I get it, if there is at least one version with the antifeatures then they appear in the wiki but they don't apply to the latest version.