signing key changed?

[IzzySoft]

What happened to your signing key?

2024-11-01 19:44:33,647 WARNING: "com.vishal2376.snaptick_9.apk" is signed by a key that is not allowed:
68253097450437107ac46c17904e102ce3ca3fa7ae5cecf367ac38bf48489072

Until the previous release, you've used this:

Signer #1 certificate DN: CN=Vishal Singh
Signer #1 certificate SHA-256 digest: 637c4d767b7e78337a9f3f0a3d1e17766366d050a75f770da446289e08caf649
Signer #1 certificate SHA-1 digest: 6c98183d193ccba225dccb0fc7913a36298f3a6a
Signer #1 certificate MD5 digest: 9f1a54fe50937985e09a1fe32af515d9
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048

Today's release has this one instead:

Signer #1 certificate DN: CN=Vishal Singh
Signer #1 certificate SHA-256 digest: 68253097450437107ac46c17904e102ce3ca3fa7ae5cecf367ac38bf48489072
Signer #1 certificate SHA-1 digest: 0dfed3abcf1381574d6296e9f60d96a0c7644ef9
Signer #1 certificate MD5 digest: 2ad1705ba8536c9d33c259edc183eb68
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048

That means, direct updates won't be possible (as Android will not accept it) – and also that the APK was rejected by the updater at IzzyOnDroid. I cannot find a hint in the release notes either. As your commits are not signed, a key change might indicate a "hostile take-over" of your Github account – so rejecting the APK is a security measure.

Can you please help us solve this issue? Until then, updates for Snaptick have been disabled at IzzyOnDroid.

Thanks in advance!

[vishal2376]

@IzzySoft Thanks for notifying me.

Actually, I lost my old signing key.

A few months ago, I switched to my new laptop. I backed up everything, but when I checked for the old keys yesterday, I couldn’t find them anywhere. I had already erased my old laptop, so I created a new signing key

[IzzySoft]

Sounds true – but how can we prove that, and rule out a "hostile takeover"? See: How to keep your key safe and what measures to take for the event of loss?

• you didn't sign your commits (I strongly recommend doing that)
• there's no other core contributor who could confirm/vouch for you
• the only alternative channel of contact is a Gmail address. It's unclear if mail sent there would reach you (Google often refuses to accept mail from smaller providers)

And btw, it would be good to mention the fact of key change in the release notes, so less tech-savvy people don't despair when they fail to update and know they have to uninstall first. Also, if there's a migration path to export/import settings and data, you could name that.

[vishal2376]

@IzzySoft I replied to your email to confirm it's me.

• I didn't know about commit signing, but I will try it next time.
• I also updated about key changes in release notes

[IzzySoft]

I replied to your email to confirm it's me.

Thanks a lot! I can confirm having received your reply (which with Gmail isn't always sure, as pointed out above). So we can consider it "verified" now and I'll initiate the "roll-over":

• the current signing key will be added as allowed
• the update thus will be accepted. While drawing it in, I will add a fastlane changelog for this version, pointing out the key has changed and, to update, one must uninstall first
• the previous key and all APKs signed with it will be removed from IoD in about a month (as there won't be update notifications due to the key change, this should give people a chance to notice it)

I didn't know about commit signing, but I will try it next time.

Thanks! I have set up an alias with my local Git to ensure each of my commits is signed unless I explicitly say not to sign. That way I cannot forget. Might be an idea you wish to adopt: git config --global alias.ci commit -S :wink:

I also updated about key changes in release notes

Thanks a lot!

PS: Just manually triggered an update, and the scanner yields:

! repo/com.vishal2376.snaptick_9.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

Easy to avoid by adding a few lines to your build.gradle for the next releases:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains. More details can be found e.g. here: Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.

Last question: are you other apps affected as well?

[vishal2376]

Last question: are you other apps affected as well?

Yeah, I also lost my Git Coach App key. But I might not release any updates in the future (most probably). These are my apps on IzzyOnDroid.

You can remove Scroll Block as i am no longer owner of this app, and also it contains many bugs.

[IzzySoft]

But I might not release any updates in the future (most probably).

OK, so we deal with that if/when the day comes.

You can remove Scroll Block as i am no longer owner of this app, and also it contains many bugs.

Do I read this correctly as "author requested to remove the app"? Then I'd of course comply :wink: