4 ms·
I have an F-Droid question. The only way to download F-Droid (as far as I know) is to download the apk directly from their site: https://f-droid.org/ https://f
by flanbiscuit 4y ago
I have an F-Droid question.
The only way to download F-Droid (as far as I know) is to download the apk directly from their site: https://f-droid.org/ https://f-droid.org/. This means having to side-load the app. Of course doing that means I would want to do my due diligence and verify the download using the PGP Signature they provide. My question is how do I verify a PGP signature completely on my phone?
I do know how to verify it on my laptop, and then I could send it to myself or install it using adb. But I'm hoping there's a way to do this without having to involve a laptop.
- johannes1234321 4y agoOpenKeychain is an Android app for doing some basic GPG related work. It can verify signatures (hidden in the "encrypt/decrypt" menu) Also it integrates i.e. with K-9 mail to sign and verify. https://github.com/open-keychain/open-keychain https://github.com/open-keychain/open-keychain
- flanbiscuit 4y agooh this looks promising, thank you! I'll try this out
- wizeman 4y agoIf someone replaces the APK on their website with a compromised one, what prevents them from replacing the PGP signature with a signature created by the attacker?
- lalopalota 4y agoYou're not the only one. There are instructions using termux at the end of the thread. https://forum.f-droid.org/t/help-needed-to-verify-the-f-droid-app-apk/9357/41 https://forum.f-droid.org/t/help-needed-to-verify-the-f-droi...