search

zikalify / BMI_Calculator

18 stars 6 forks source link

The app has a weak security sigrature #7

Closed CrimsonFork closed 5 years ago

CrimsonFork commented 5 years ago

According to F-Droid: https://f-droid.org/wiki/page/Antifeature:DisabledAlgorithm

Sent from my Moto E (4) Plus using FastHub-Libre

zikalify commented 5 years ago

When I update the app, it's built and signed by F-Droid. Or am I missing something? @OffifialMITX

CrimsonFork commented 5 years ago

It is, but the developer gets to decide now it's built. I'm no developer myself, so I can't help you here, my nearest guess is that either your SDK or some of your configuration is outdated.

On February 25, 2019 10:43:23 PM UTC, Paul Hill notifications@github.com wrote:

When I update the app, it's built and signed by F-Droid. Or am I missing something?

-- You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub: https://github.com/zikalify/BMI_Calculator/issues/7#issuecomment-467214422

-- Sent from my Android device with K-9 Mail. Please excuse my brevity.

zikalify commented 5 years ago

What have you read that says it's using and outdated signature? It was at one point and it got moved to the fdroid archives but I updated it so that their servers would pull the software and sign it the new way and now it appears in the main fdroid repos. Point me to where it says it uses an outdated signature so I can look into it, thanks.

CrimsonFork commented 5 years ago

It says so in the F-Droid app. screenshot_20190226-084518 screenshot_20190226-084522 The links lead to https://f-droid.org/wiki/page/Antifeature:DisabledAlgorithm and https://f-droid.org/wiki/page/Antifeature:KnownVuln

zikalify commented 5 years ago

Ok it's like that because you have f-droid archive repo turned on, the older builds do have this issue but newest ones don't. To make this go away go to settings in fdroid, manage repositories and disable the fdroid archive repo leaving just the main one enabled.

CrimsonFork commented 5 years ago

Ah, ok, my bad, sorry for bothering.

On February 26, 2019 8:03:43 AM UTC, Paul Hill notifications@github.com wrote:

Ok it's like that because you have f-droid archive repo turned on, the older builds do have this issue but newest ones don't. To make this not go away go to settings in fdroid, manage repositories and disable the fdroid archive repo leaving just the main one enabled.

-- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: https://github.com/zikalify/BMI_Calculator/issues/7#issuecomment-467336827

-- Sent from my Android device with K-9 Mail. Please excuse my brevity.

zikalify commented 5 years ago

Then clear fdroid data and when you go back on the message will be gone. Just done the process myself. Basically new versions are not using weak signature.