3 ms·
This is insane. What is the point of even having a developer signing key if people other than the developer have access to it? Why don't they just sign the APKs
by pavon 5y ago
This is insane. What is the point of even having a developer signing key if people other than the developer have access to it? Why don't they just sign the APKs with Google's own keys from here on out?
Can't wait to hear Moxie's response on this. One of his (many) reasons for refusing to support FDroid was because it didn't allow developers to sign their own apps, and thus users had to trust that FDroid did not modify the app. Now FDroid has addressed that, but Google has not only removed that feature, but is demanding that developers allow Google to impersonate them.
- birksherty 5y ago> Now FDroid has addressed that Out of loop, what changed?
- piaste 5y ago> Out of loop, what changed? https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
- resoluteteeth 5y agoIirc they're switching to that model (google uses it's own key) but they need the developers' keys for older apps because android won't allow changing the key when an already installed app is upgraded.
- pavon 5y agoExcept Google maintains the code that performs those checks. Rolling out changes to key checking will result in a longer transition, but it is more legitimate than demanding developers hand over private signing keys. And in the meanwhile Google Play store knows which phones have been updated, so it can provided the slimmed-down Google-signed APKs to them, and the universal developer-signed APKs to everyone else.