2 ms·
> Signal builds are reproducible. You can verify that the apk in the app store corresponds to a specific point in git history, and if you don't trust Google you
by searchableguy 5y ago
> Signal builds are reproducible. You can verify that the apk in the app store corresponds to a specific point in git history, and if you don't trust Google you can sideload that.
Actually, for both the commercial app stores - you cannot. Google requires app bundles where they package different APK for devices and sign it using their keys for new apps from 2021, August.
- mjg59 5y agoGoogle is pushing towards that, but for apps that already exist you can absolutely still upload stuff signed with your own keys.
- doublerebel 5y agoGoogle is far more than 'pushing': currently any app added after August 2021 is required to let Google manage the keys. I expect it's a just a matter of time before it applies to all apps. Really disappointing that they are using their market position to completely ruin developers' ability to provide security. Source: I have been developing on Android since Android 1.0. Also see https://stackoverflow.com/questions/68710048/no-opt-out-option-from-app-signing-in-google-play-console https://stackoverflow.com/questions/68710048/no-opt-out-opti...