search

phpbg / easysync

Synchronize your android phone/tablet with your DAV server, the easy way.
MIT License
105 stars 6 forks source link

Signing issue #5

Closed IzzySoft closed 11 months ago

IzzySoft commented 11 months ago

Seems like you've switched the signing keys, which makes updates impossible:

versionCode:2

Signer #1 certificate DN: CN=Android, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
Signer #1 certificate SHA-256 digest: d724297dffaa2bf21fd3c2a40894c5b5c225d9285f024c9e83b58597ecc0b048
Signer #1 certificate SHA-1 digest: 579f146b403c30862af3823d9729eff4a8ad3fa3
Signer #1 certificate MD5 digest: b4b42da5636a7d8183686e5d21903085
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 4096

versionCode:3

Signer #1 certificate DN: C=FR, CN=CHEMLA Samuel
Signer #1 certificate SHA-256 digest: a4c44e0ed72d8e644d9c2618b36c79b735d38b399b957b25fe922ddf43b56a2e
Signer #1 certificate SHA-1 digest: 827b7c0b5e4669b018a1ed077fa9b7f537e5fe1d
Signer #1 certificate MD5 digest: 9290107d589cdfd1fc2b594ef376b9e4
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048

Was this intentional? Looks like with VC-2 you've uploaded the APK signed by Google, and now you're using your own certificate. You cannot mix that back and forth. Which one will you stay with here?

PS: I see your app is now available at F-Droid.org, congrats! So it should be fine for me to remove it from my repo then, to avoid confusion concerning different signatures (you didn't establish reproducible builds, so cross-updates won't be possible)?

phpbg commented 11 months ago

Sorry my bad, I re uploaded with google signature. I think it provides a more seamless experience for users (especially if they have both fdroid and playstore)

IzzySoft commented 11 months ago

I think it provides a more seamless experience

Agreed. It makes cross-updates possible then.

IzzySoft commented 11 months ago

Hmpf, so now I'm puzzled about the presence of your app in my repo. As you didn't establish reproducible builds with F-Droid, this might cause some confusion as those two don't match. I usually remove apps from my repo once they reach F-Droid. What did we decide for that now, @phpbg?

phpbg commented 11 months ago

This I guess:

So it should be fine for me to remove it from my repo then, to avoid confusion concerning different signatures (you didn't establish reproducible builds, so cross-updates won't be possible)?

IzzySoft commented 11 months ago

Thanks! Done then, effective with the next sync. Should for some reason you need it back here one day, just ring my bell :wink: All the best for you!