• 0 Posts
  • 204 Comments
Joined 1 year ago
cake
Cake day: July 11th, 2023

help-circle















  • android uses digital signatures as kind of a security measure. a digital signature is basically supposed to confirm that the apk was actually built by the developer, and most of the files in it were not tampered with.
    besides being able to make permissions depend on it, you cannot install an app update that was signed with a different key to what you have already installed, because that basically means you are replacing it with a version that was built by someone else.

    all apps are digitally signed. when an app becomes reproducibly built, from that point the app will be built by f-droid with their own digital signature.

    also note that since google play has forced all developers to hand over their signing keys, when making app bundle based publishing mandatory, the security of this signature has been… less useful