List Signing Certificate Hash to Let Users Verify the Downloaded APK #213

New issue

Open

opened 2025-12-17 16:07:34 +03:00 by bengalbroys · 1 comment

bengalbroys commented

2025-12-17 16:07:34 +03:00

(Migrated from github.com)

I'm downloading this app using Obtainium, and so I would like to make sure that the app I install is indeed the correct one. To do so I use AppVerifier to be able to check whether the app downloaded is indeed from the developer I would need the hash of the signing certificate used to sign the app.

It's slowly becoming a standard security practice to list the key's hash somewhere in your project for example: Thunderbird, Molly, GeoShare.

I'm downloading this app using [Obtainium](https://github.com/ImranR98/Obtainium), and so I would like to make sure that the app I install is indeed the correct one. To do so I use [AppVerifier](https://github.com/soupslurpr/AppVerifier) to be able to check whether the app downloaded is indeed from the developer I would need the hash of the signing certificate used to sign the app. It's slowly becoming a standard security practice to list the key's hash somewhere in your project for example: [Thunderbird](https://github.com/thunderbird/thunderbird-android/blob/main/SECURITY.md), [Molly](https://github.com/mollyim/mollyim-android?tab=readme-ov-file#download), [GeoShare](https://github.com/jakubvalenta/geoshare?tab=readme-ov-file#from-an-apk-file).

TJYSunset commented

2025-12-18 17:39:57 +03:00

(Migrated from github.com)

For the direct answer to your question, it's ed20b176709c0e632400eed8d5bdb3abd510086719fe97fe9046b922f8faaf4f. You can also obtain public keys of other reproducible F-Droid apps in the metadata repo (for example, search for AllowedAPKSigningKeys in https://gitlab.com/fdroid/fdroiddata/-/blob/master/metadata/org.sunsetware.phocid.yml).

But I don't think that's a useful information to publish - what exactly are you verifying against when installing Phocid?

If you trust the GitHub releases, GitHub provides SHA-256 hashes for the file.
If you trust F-Droid, they have PGP signatures.
If you trust no platform but only me the developer - all communications originating from me could have been compromised by the platform, and my credentials could have been stolen, so you can't do that unless you know me in person.
Updates to an already existing app must use the same signing key (or a new key specified by the previous keyholder), so manual certificate validation would be redundant.

For the direct answer to your question, it's `ed20b176709c0e632400eed8d5bdb3abd510086719fe97fe9046b922f8faaf4f`. You can also obtain public keys of other reproducible F-Droid apps in the [metadata repo](https://gitlab.com/fdroid/fdroiddata) (for example, search for `AllowedAPKSigningKeys` in https://gitlab.com/fdroid/fdroiddata/-/blob/master/metadata/org.sunsetware.phocid.yml). But I don't think that's a useful information to publish - what exactly are you verifying against when installing Phocid? - If you trust the GitHub releases, GitHub provides SHA-256 hashes for the file. - If you trust F-Droid, they have PGP signatures. - If you trust no platform but only me the developer - all communications originating from me could have been compromised by the platform, and my credentials could have been stolen, so you can't do that unless you know me in person. - Updates to an already existing app must use the same signing key (or a new key specified by the previous keyholder), so manual certificate validation would be redundant.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

novvux/Blissid#213

No description provided.

Rows
Columns