home-assistant / home-assistant/android

Verified Apps for Android fingerprint mismatch for io.homeassistant.companion.android.minimal

Open
#7,316 5 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Kotlin
Stars
3.9k
Forks
1.1k
Avg merge
1d 12h
Merged PRs (30d)
81

Description

**Home Assistant Android app version(s):**
2026.6.5-minimal

**Android version(s):**
17

**Device model(s):**
N/A

**Home Assistant version:**
N/A

**Last working Home Assistant release (if known):**
N/A

**Description of problem, include YAML if issue is related to notifications:**

- `io.homeassistant.companion.android.minimal` as distributed via F-Droid [has fingerprint](https://github.com/privacyguides/verified-apps/issues/626#issuecomment-4580575372) `17:48:52:50:A0:3A:0F:2B:3F:29:2A:05:4F:59:5A:9E:79:4B:EE:F8:0C:F9:10:F7:B3:BB:B8:09:8A:BF:6D:50`
- Privacy Guides's _Verified Apps_ GitHub bot complains this is not the real fingerprint but just an F-Droid one, and [says](https://github.com/privacyguides/verified-apps/issues/626#issuecomment-4580575372): "You should complain to the app's developer to add [reproducible build](https://f-droid.org/docs/Reproducible_Builds/) support."
- Also, `io.homeassistant.companion.android.minimal` as distributed through some other channels [apparently has fingerprint](https://github.com/privacyguides/verified-apps/issues/626#issuecomment-4580575372) `11:19:4B:A8:09:B4:2D:DF:0E:1A:7D:EC:68:42:A5:9C:7F:F1:11:9C:54:82:E9:5F:EB:FF:D5:C6:01:4D:AA:5A` which is apparently [the same fingerprint](https://github.com/privacyguides/verified-apps/issues/625) as `io.homeassistant.companion.android'. **In other words, both apps ("minimal" and "full") share a fingerprint, which should not happen.**

**Companion App Logs:**

```

```

**Screenshot or video of problem:**

**Additional information:**

Contributor guide

Open the contributing guide

Research direction

Start by comparing the signing fingerprints and build configuration for the minimal and full Android artifacts, using the linked Privacy Guides and F-Droid reports as evidence. Done means the minimal app has the intended distinct fingerprint and its distribution can satisfy the relevant verified-app or reproducible-build checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
build-system, mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.