QuantumBadger / QuantumBadger/RedReader
publish hashes of signing keys
Open
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 2.7k
- Forks
- 527
- Avg merge
- 20d 10h
- Merged PRs (30d)
- 3
Description
On Android, you can use AppVerifier to confirm if an apk was signed by the owners or an untrusted key (as well as other methods). This can be combined with Obtanium to check at install time.
The hashes could be published in a number of places for additional trust. e.g
- blog post
- gpg signed download
- mastodon / twitter /...
- Github
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests; start by reviewing the Android release and signing process, then read the linked AppVerifier and Obtanium context. Done means publishing the signing-key hashes in a verifiable location, but the issue does not specify which location or release workflow to use.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java
- Domain
- mobile, release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100