Android

0 readers

1 users here now

Android news, reviews, tips, and discussions about rooting, tutorials, and apps.

General discussion about devices is welcome. Please direct technical support, upgrade questions, buy/sell, app recommendations, and carrier-related issues to other communities.

[email protected]

Rules

Stay on topic: All posts should be related to the Android operating system or ecosystem.
No support questions/rants/bug reports: All posts should benefit the community rather than the individual. Please refrain from posting individual support questions, rants, or bug reports.
Describe images/videos: Please provide an explanation in the self-post body when sharing images or videos. Memes are not allowed.
No self-promotional spam: Only active members of the community can post their apps, and they must participate in comments. Please do not post your own website, YouTube, or blog.
No reposts/rehosted content: Submit original sources whenever possible, unless the content is not available in English. Reposts about the same content are not allowed.
No editorializing titles: Do not change article titles when submitting. You may add the author if relevant.
No piracy: Do not share or discuss pirated content.
No unauthorized polls/bots/giveaways: Do not create unauthorized polls, use bots, or organize giveaways without proper authorization.
No offensive/low-effort content: Avoid posting offensive or low-effort content that does not contribute positively to the community.
No affiliate links: Posting affiliate links is not allowed.

founded 2 years ago

MODERATORS

[email protected]

submitted 5 months ago by [email protected] to c/[email protected]

9 comments fedilink hide all child comments

Dear #Android #App #Developers, as it still happens far too often (no naming, no shaming! 💩 happens to everyone of us) a reminder to take good care of your #signing keys – and also take precautions for the case that your keystore might get lost. Please take a look at: https://f-droid.org/2023/09/03/reproducible-builds-signing-keys-and-binary-repos.html#lessons-learned-2-how-to-keep-your-key-safe-and-what-measures-to-take-for-the-event-of-loss where I outline this topic.

Thanks!

#security

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 5 months ago (5 children)

@[email protected] I have my doubts towards the former (that would mean rolling back their implementation, at least in parts, and using the suggested patches instead, which they rejected. The argument was that f-droid.org itself does not need key rotation, IIRC.). And as long as we still use fdroidserver, the only way we can notify is via the inlined per-release changelogs (aka "Fastlane changelogs"), which is what we do.

[–] [email protected] 1 points 5 months ago (4 children)

@[email protected] Hm, there should be a way to set a warning for a version in the index that the client can use to inform users

[–] [email protected] 1 points 5 months ago (3 children)

@[email protected] which needs to be implemented serverside (fdroidserver writing the index) AND clientside (to show it). Without the index itself supporting it, there's nothing the clients can do. So: https://gitlab.com/fdroid/fdroidserver/-/issues/301 ? https://gitlab.com/fdroid/fdroidclient/-/issues/195 ? Does not look like this will happen.

[–] [email protected] 1 points 5 months ago (1 children)

@[email protected] I'll try to open issues for more specific messages then: metadata to warn about removed application, and metadata to warn about application that need to be reinstalled

[–] [email protected] 1 points 5 months ago (1 children)

@[email protected] Remember that WE cannot implement those. Everything that needs changes to the index, is out of our hands – at least as long as we're still bound to fdroidserver. So such issues would need to be filed there – with the tools that generate the indexes. Our client devs would surely pick up those data once available.

[–] [email protected] 1 points 5 months ago

@[email protected] Yep, I know ! Will share once done

load more comments (1 replies)