search

vitorpamplona / amethyst

Nostr client for Android
MIT License
1.14k stars 155 forks source link

[FEATURE] Add Hash of App Signing Key to README #972

Open shrimprugbysnowowl opened 3 months ago

shrimprugbysnowowl commented 3 months ago

The project includes a link for Obtainium. Obtainium includes a feature to share a downloaded apk with AppVerifier to verify the hash of the developer app signing key.

Please post the hash of your app signing key in the README and/or submit it to be included in the AppVerifier database. (I think this happens via their Matrix Room? I'm happy to ask on your behalf once it's posted somewhere.)

shrimprugbysnowowl commented 4 hours ago

Good afternoon, @vitorpamplona ,

To provide clarification, seeing as the project references Obtainium which allows users to directly download the apk from github, but those users should have a way to verify that the build was signed by the developer. Posting the sha-256 hash of the developer signing key multiple locations, such as in the project README and on Nostr, would limit future tampering.

Based on the downloaded amethyst-fdroid-universal-v0.92.1.apk, the hash appears to be: C2:D0:AA:86:BC:B6:B6:20:90:56:1A:41:BB:E3:36:E9:8B:78:C2:D0:21:0A:49:8D:C8:85:F2:8E:13:48:CF:17 I'm happy to create a PR for the README if you are amenable to inclusion.

Thank you for your consideration.