4 ms·

The impediment is that if your application is distributed via the Play Store, and is removed for some reason, another installer/store (FDroid, etc.) can't updat

The impediment is that if your application is distributed via the Play Store, and is removed for some reason, another installer/store (FDroid, etc.) can't update the existing package. This means that the user can't seamlessly transition between the old and new distribution methods without fully uninstalling the app and wiping the data contained theirin.

g-b-r 3y ago
No, you can still provide Google your own key. The enormous problem with that change is instead that indeed you're required to provide the keys to Google, which can thus replace your app with anything else (especially, something that a court orders them to use). Anyway to switch to F-Droid you always had to reinstall the app, because they use their own signing keys (and indeed could be ordered to do the same thing as above, but it's less likely). Although, I think there actually is a mechanism to switch signatures; but if I remember well it entails signing with the new signature a version signed with the old one, so it's complex.
- Vt71fcAqt7 3y ago
  This has changed[0] >All the years before, F-Droid created a dedicated key for each app to sign the published APKs, but now with reproducible builds F-Droid ships APKs that are signed by the upstream developer [0] https://f-droid.org/en/2023/09/03/reproducible-builds-signing-keys-and-binary-repos.html https://f-droid.org/en/2023/09/03/reproducible-builds-signin...
  - g-b-r 3y ago
    Only for reproducible builds, a lot of work has been done to encourage and facilitate them in the last years, but they're still a minority of the apps. By the way, these reproducible builds apps run a high risk of being signed with the same key that Google has
    - Vt71fcAqt7 3y ago
      >these reproducible builds apps run a high risk of being signed with the same key that Google has That's a great point. Someone should submit a request to add language to their docs[0] letting developers know about that if it doesn't exist already. I breifly looked through that page just now and didn't see it pointed out explicitly. There should also be a way to let users know. [0] https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
      - g-b-r 3y ago
        About the fact that Google could have the signing key, you mean? Yeah I haven't followed much F-Droid lately, I wonder if they ever realized that... I think that the project never settled on a specific security model, to be honest, and the current one is mostly the result of happenstance. And I don't know what will happen to F-Droid now that some of the most important people left.
- g-b-r 3y ago
  > if I remember well it entails signing with the new signature a version signed with the old one, so it's complex. Wait no of course it's the opposite, specifically you sign the new certificate with the old key, if I understood it right (https://source.android.com/docs/security/features/apksigning/v3#proof-of-rotation-and-self-trusted-old-certs-structs https://source.android.com/docs/security/features/apksigning...)

g-b-r 3y ago

No, you can still provide Google your own key. The enormous problem with that change is instead that indeed you're required to provide the keys to Google, which can thus replace your app with anything else (especially, something that a court orders them to use). Anyway to switch to F-Droid you always had to reinstall the app, because they use their own signing keys (and indeed could be ordered to do the same thing as above, but it's less likely). Although, I think there actually is a mechanism to switch signatures; but if I remember well it entails signing with the new signature a version signed with the old one, so it's complex.

Vt71fcAqt7 3y ago
This has changed[0] >All the years before, F-Droid created a dedicated key for each app to sign the published APKs, but now with reproducible builds F-Droid ships APKs that are signed by the upstream developer [0] https://f-droid.org/en/2023/09/03/reproducible-builds-signing-keys-and-binary-repos.html https://f-droid.org/en/2023/09/03/reproducible-builds-signin...
- g-b-r 3y ago
  Only for reproducible builds, a lot of work has been done to encourage and facilitate them in the last years, but they're still a minority of the apps. By the way, these reproducible builds apps run a high risk of being signed with the same key that Google has
  - Vt71fcAqt7 3y ago
    >these reproducible builds apps run a high risk of being signed with the same key that Google has That's a great point. Someone should submit a request to add language to their docs[0] letting developers know about that if it doesn't exist already. I breifly looked through that page just now and didn't see it pointed out explicitly. There should also be a way to let users know. [0] https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
    - g-b-r 3y ago
      About the fact that Google could have the signing key, you mean? Yeah I haven't followed much F-Droid lately, I wonder if they ever realized that... I think that the project never settled on a specific security model, to be honest, and the current one is mostly the result of happenstance. And I don't know what will happen to F-Droid now that some of the most important people left.
g-b-r 3y ago
> if I remember well it entails signing with the new signature a version signed with the old one, so it's complex. Wait no of course it's the opposite, specifically you sign the new certificate with the old key, if I understood it right (https://source.android.com/docs/security/features/apksigning/v3#proof-of-rotation-and-self-trusted-old-certs-structs https://source.android.com/docs/security/features/apksigning...)