3 ms·
That being said, the signing key is supposed to be "we certify this". Handing your key over to a 3rd party defeats that. If both <software producer> and google
by RHSeeger 3y ago
That being said, the signing key is supposed to be "we certify this". Handing your key over to a 3rd party defeats that. If both <software producer> and google need to be able to sign it in some way, then the signing process should be enhanced to represent that. Maybe the software producer signs their individual components, and google signs the bundle, or something like that.
- danpalmer 3y agoI believe this is captured already – it's possible to verify that the binary was created by Google, but that it originated from the original developer.
- rvnx 3y agoThe key your describe, is the developer key, Google checks it. The key that VLC is talking about, is the distribution key. Google manages the distribution key for you, one of the many reasons is because they create optimized APKs for each platform.
- wongarsu 3y agoSimilar to how on Windows you sign both the installer and each binary that will be installed. In that setup it's trivial to have the binaries signed by one party, and the installer by another party.
- Turing_Machine 3y ago> Handing your key over to a 3rd party defeats that. Hmm... if Google went rogue, wouldn't everyone's Android phone basically be pwnt whether they had some dev's signing key or not?