Find publicly known signing keys

quantify-nfc / Wear24-NFC-ROM

6 stars 2 forks source link

Find publicly known signing keys #7

Closed davwheat closed 5 years ago

JaredTamana commented 5 years ago

The Android tree includes test-keys under build/target/product/security https://source.android.com/devices/tech/ota/sign_builds

davwheat commented 5 years ago

These are only test keys though. Would they work in practise? Would it be better if we make our own keys and signed with them instead?

JaredTamana commented 5 years ago

They work fine. Custom ROMs use them all the time iirc. Unless we are concerned about our files being under security scrutiny, there's no reason to sign them with unique keys. Usually signing is done before building Android source. We don't have that luxury. I don't even know if we need to sign, but without signing, the META-INF folder isn't created

davwheat commented 5 years ago

Ok. You know waay more about this stuff than me but I just wanted to check :)

davwheat commented 5 years ago

Can we close?