List Signing Certificate Fingerprint to Let Users Verify the Downloaded APK
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 217
- PR merge metrics
- No merged PRs in 30d
Description
### Is your feature request related to a problem? Please describe.
I'm downloading this app using [Obtanium](https://github.com/ImranR98/Obtainium) and so I would like to make sure that the app I install is indeed the correct one. To do so I use [AppVerifier](https://github.com/soupslurpr/AppVerifier). To be able to check whether the app downloaded is indeed from the developer I would need the hash of the signing certificate used to sign the app.
### Describe the solution you'd like
The signing certificate hash would be listed preferably on an external site. Like the app's site, but it could also be listed on Github if the external site is not an option.
### Describe alternatives you've considered
There aren't really any besides just downloading the app without verifying, downloading from F-Droid or not downloading it at all.
### Additional context
It's slowly becoming a standard security practice to list the key's hash somewhere in your project for example: [Thunderbird](https://github.com/thunderbird/thunderbird-android/blob/main/SECURITY.md#verifying-fingerprints), [Molly](https://github.com/mollyim/mollyim-android?tab=readme-ov-file#download), [AuroraStore](https://gitlab.com/AuroraOSS/AuroraStore#certificate-fingerprints), [GeoShare](https://github.com/jakubvalenta/geoshare?tab=readme-ov-file#from-an-apk-file).
For an example on a external website entry, see [DeltaChat](https://delta.chat/en/verify-downloads).
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.