Important: Wiki, add instructions for PGP verification
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 14.6k
- Forks
- 3.2k
- Avg merge
- 12d 11h
- Merged PRs (30d)
- 4
Description
Is your feature request related to a problem? Please describe.
All apk files are GPG signed but there is no documentation on where to get the microG public key, and how to verify the downloads.
I assume microG is most often used downstream, which might integrate signing themselves. If not, this also helps them.
It can be expected that currently nobody verifies their downloads, which can be a security issue.
Describe the solution you'd like
I made a change here. I dont know how Github's wiki works, so this is the best I can currently do.
Describe alternatives you've considered
Research how to do this, including closed issues like that one. Look for a key with that signature on some keyservers.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Wiki's Installation page and the related issue #2540. Research the authoritative microG public key and how to verify signed APK downloads, including whether a keyserver provides the matching signature. The work is done when the wiki clearly identifies the key source and gives reproducible verification instructions.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100