search

phpbg / easysync

Synchronize your android phone/tablet with your DAV server, the easy way.
MIT License
91 stars 3 forks source link

Signing issue #5

Closed IzzySoft closed 10 months ago

IzzySoft commented 10 months ago

Seems like you've switched the signing keys, which makes updates impossible:

versionCode:2

Signer #1 certificate DN: CN=Android, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
Signer #1 certificate SHA-256 digest: d724297dffaa2bf21fd3c2a40894c5b5c225d9285f024c9e83b58597ecc0b048
Signer #1 certificate SHA-1 digest: 579f146b403c30862af3823d9729eff4a8ad3fa3
Signer #1 certificate MD5 digest: b4b42da5636a7d8183686e5d21903085
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 4096

versionCode:3

Signer #1 certificate DN: C=FR, CN=CHEMLA Samuel
Signer #1 certificate SHA-256 digest: a4c44e0ed72d8e644d9c2618b36c79b735d38b399b957b25fe922ddf43b56a2e
Signer #1 certificate SHA-1 digest: 827b7c0b5e4669b018a1ed077fa9b7f537e5fe1d
Signer #1 certificate MD5 digest: 9290107d589cdfd1fc2b594ef376b9e4
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048

Was this intentional? Looks like with VC-2 you've uploaded the APK signed by Google, and now you're using your own certificate. You cannot mix that back and forth. Which one will you stay with here?

PS: I see your app is now available at F-Droid.org, congrats! So it should be fine for me to remove it from my repo then, to avoid confusion concerning different signatures (you didn't establish reproducible builds, so cross-updates won't be possible)?

phpbg commented 10 months ago

Sorry my bad, I re uploaded with google signature. I think it provides a more seamless experience for users (especially if they have both fdroid and playstore)

IzzySoft commented 10 months ago

I think it provides a more seamless experience

Agreed. It makes cross-updates possible then.

IzzySoft commented 9 months ago

Hmpf, so now I'm puzzled about the presence of your app in my repo. As you didn't establish reproducible builds with F-Droid, this might cause some confusion as those two don't match. I usually remove apps from my repo once they reach F-Droid. What did we decide for that now, @phpbg?

phpbg commented 9 months ago

This I guess:

So it should be fine for me to remove it from my repo then, to avoid confusion concerning different signatures (you didn't establish reproducible builds, so cross-updates won't be possible)?

IzzySoft commented 9 months ago

Thanks! Done then, effective with the next sync. Should for some reason you need it back here one day, just ring my bell :wink: All the best for you!