gotify / gotify/android

List Signing Certificate Fingerprint to Let Users Verify the Downloaded APK

Open
#448 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.5k
Forks
217
PR merge metrics
No merged PRs in 30d

Description

### Is your feature request related to a problem? Please describe.

I'm downloading this app using [Obtanium](https://github.com/ImranR98/Obtainium) and so I would like to make sure that the app I install is indeed the correct one. To do so I use [AppVerifier](https://github.com/soupslurpr/AppVerifier). To be able to check whether the app downloaded is indeed from the developer I would need the hash of the signing certificate used to sign the app.

### Describe the solution you'd like

The signing certificate hash would be listed preferably on an external site. Like the app's site, but it could also be listed on Github if the external site is not an option.

### Describe alternatives you've considered

There aren't really any besides just downloading the app without verifying, downloading from F-Droid or not downloading it at all.

### Additional context

It's slowly becoming a standard security practice to list the key's hash somewhere in your project for example: [Thunderbird](https://github.com/thunderbird/thunderbird-android/blob/main/SECURITY.md#verifying-fingerprints), [Molly](https://github.com/mollyim/mollyim-android?tab=readme-ov-file#download), [AuroraStore](https://gitlab.com/AuroraOSS/AuroraStore#certificate-fingerprints), [GeoShare](https://github.com/jakubvalenta/geoshare?tab=readme-ov-file#from-an-apk-file).

For an example on a external website entry, see [DeltaChat](https://delta.chat/en/verify-downloads).

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.