List Signing Certificate Fingerprint to Let Users Verify the Downloaded APK
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 62/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- android, java
- Domain
- documentation, mobile, security
Research direction
Start by checking the project's download and documentation entry points to find the appropriate place for a signing fingerprint. Confirm the APK's signing certificate hash and publish it on the project site or GitHub, following the verification examples linked in the issue. Done means users can locate the fingerprint and compare it with their downloaded APK.
Written by the indexing model from the issue text.
Description
Is your feature request related to a problem? Please describe.
I'm downloading this app using Obtanium and so I would like to make sure that the app I install is indeed the correct one. To do so I use AppVerifier. To be able to check whether the app downloaded is indeed from the developer I would need the hash of the signing certificate used to sign the app.
Describe the solution you'd like
The signing certificate hash would be listed preferably on an external site. Like the app's site, but it could also be listed on Github if the external site is not an option.
Describe alternatives you've considered
There aren't really any besides just downloading the app without verifying, downloading from F-Droid or not downloading it at all.
Additional context
It's slowly becoming a standard security practice to list the key's hash somewhere in your project for example: Thunderbird, Molly, AuroraStore, GeoShare.
For an example on a external website entry, see DeltaChat.
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 217
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from gotify/android
-
a:feature
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Faster delete Opena:feature
Difficulty 3/5 1-2 days Newbie friendliness 65/100
-
a:feature
Difficulty 3/5 1-2 days Newbie friendliness 68/100
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Similar issues
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
apache/cloudstack#14222 ·
-
[BUG]茶杯方块在取茶时会引发崩溃 Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
1.0.0-alpha2 Type/Improvement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
wso2/dpdp-accelerator#272 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
apache/rocketmq-dashboard#4860 · 1 comment ·
-
agent-audit bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Vault-Web/cloud-page#144 ·