signing key changed? #1461
Comments
|
The old cert was too weak for the google store policies, so it got refreshed. Happened so long ago that I think I must have forgotten to add to the changelog, will update the README & CHANGELOG. Correct SHA256 is |
|
2.4.12 sent to Google for review. Thanks for raising - please raise more if you see any issues. Google's rushed me into this slightly hacky release to hit an arbitrary deadline, so hyper-aware there may be more things that I've missed. |
|
First, thanks for outlining the details! Changing the cert means those who have the app installed need to uninstall and re-install the app. They won't get any notification of available updates before having done that (as the update would be "incompatible" due to the different signature). There currently is no way to inform those folks (something we currently work on at F-Droid but are still at "design state"), so it should at least be pointed out with the changelogs in case someone looks it up wondering why there were no updates. I'd then switch to permit the new signature, which means to remove all previous versions. To confirm it was really you, it would help if you could attach another APK of the same version which is signed with the old key (which only you could do, hence it would confirm the switch); I'd suggest a file name like As for description, screenshots and maybe even per-release changelogs: may I suggest to establish Fastlane structures here in your repo? Be welcome to use my Fastlane Cheat Sheet for guidance with that. It would empower you to define how your app is presented. Should you need help with that, let me know. |
I may be wrong, but doesn't this only apply to people who've manually installed the APK? If you're installing from the Play store, then that uses Google's signing key (and they take care of rolling that). If you're using F-Droid, then they have their own key they use for builds? (This may be moot anyway for F-Droid, as the next version that'll be published there will be 2.5.0, which removes the problematic objectbox dependency).
This is definitely a good point. I'll update the release notes and dig out the old key (if I can find it).
Thanks - Fastlane seems to integrate better with F-Droid than TripleT (which I think is now discontinued?) so I should definitely put switching on the backlog. Hopefully it shouldn't be too hard, the fastlane docs look excellent. |
|
With F-Droid, that depends: if the app is set up for reproducible builds, APKs are signed by the resp. developers. If the app comes via my repo (as in this case here), the same. Only otherwise, F-Droid uses a signing key it specifically created for the app.
Thanks! That would be great. Please give me a ping when it's there (I will be quite busy for the next few days, but should respond soon afterwards).
True. While Triple-T seems to meanwhile work fine as well, Fastlane seems to be more stable (and btw is the only of the two supported by my repo). Btw: You sound as if your app would be on F-Droid, but the link from your Readme gives a 404. The one to my repo would be this one. |
It was disabled, see #1298. |
|
Ah, thanks for the pointer! I vaguely remembered something but did nor remember what it was that I thought to remember 🙈 (didn't we have that just yesterday somewhere else? LOL) |
@growse did you meanwhile had a chance to do that? I'd like to make updates available again – but prefer to have the confirmation here if possible. So until now I receive a warning mail each time the repo updates, as your APK with the new key is not accepted before I switched out AllowedKeys. |
|
I've got the old keystore, just need to find time to actually do in between job / parenting / real-life / etc. |
|
Glad to read! Looking forward to the "proof" then with much optimism and enthusiasm even 😃 |
|
Updated the github release. |
|
Thanks! I've fetched both APKs to compare them (ignoring the certs, I've expected everything else to be identical). Found some small differences, though – but those seem to be caused by "non-reproducible building" (one file, namely TL;DR: Looks good to me, basically. @obfusk I hope you can confirm. What I did was basically the RB tests, which showed differences with the signature (to be expected), the (@growse I ask obfusk here as they have much more experience in this area than I have – and sharper eyes 😉) |
|
The diff is basically this: --- /dev/fd/63 2023-09-04 01:06:54.774025649 +0200
+++ /dev/fd/62 2023-09-04 01:06:54.774025649 +0200
@@ -4,6 +4,8 @@
package org.owntracks.android;
+import org.owntracks.android.data.repos.MemoryContactsRepo;
+import org.owntracks.android.ui.preferences.connection.ConnectionViewModel;
import org.owntracks.android.services.BackgroundService;
import org.owntracks.android.support.Events$RestartApp;
import android.location.Location;
@@ -12,8 +14,6 @@
import org.owntracks.android.support.Events$WaypointRemoved;
import org.owntracks.android.support.Events$WaypointUpdated;
import org.owntracks.android.support.Events$WaypointAdded;
-import org.owntracks.android.ui.preferences.connection.ConnectionViewModel;
-import org.owntracks.android.data.repos.MemoryContactsRepo;
import org.greenrobot.eventbus.meta.SubscriberInfo;
import org.greenrobot.eventbus.meta.SimpleSubscriberInfo;
import org.owntracks.android.services.MessageProcessor;
@@ -43,25 +43,25 @@
final int n3 = 1;
array[n3] = subscriberMethodInfo;
putIndex(new SimpleSubscriberInfo(MessageProcessor.class, array));
- final SubscriberMethodInfo[] array2 = new SubscriberMethodInfo[n];
+ final SubscriberMethodInfo[] array2 = new SubscriberMethodInfo[8];
final ThreadMode background = ThreadMode.BACKGROUND;
- final String s2 = "onEventMainThread";
- array2[0] = new SubscriberMethodInfo(s2, clazz2, background, 0);
- array2[n3] = new SubscriberMethodInfo(s2, clazz, background, 0);
- putIndex(new SimpleSubscriberInfo(MemoryContactsRepo.class, array2));
+ array2[0] = new SubscriberMethodInfo(s, Events$WaypointAdded.class, background, 0);
+ array2[n3] = new SubscriberMethodInfo(s, Events$WaypointUpdated.class, background, 0);
+ array2[n] = new SubscriberMethodInfo(s, Events$WaypointRemoved.class, background, 0);
+ array2[3] = new SubscriberMethodInfo(s, clazz2, background, 0);
+ array2[4] = new SubscriberMethodInfo(s, Events$MonitoringChanged.class, background, 0);
+ array2[5] = new SubscriberMethodInfo(s, MessageTransition.class, background, 0);
+ array2[6] = new SubscriberMethodInfo(s, Location.class, background, 0);
+ array2[7] = new SubscriberMethodInfo(Events$RestartApp.class);
+ putIndex(new SimpleSubscriberInfo(BackgroundService.class, array2));
final SubscriberMethodInfo[] array3 = new SubscriberMethodInfo[n3];
array3[0] = new SubscriberMethodInfo(clazz2);
putIndex(new SimpleSubscriberInfo(ConnectionViewModel.class, array3));
- final SubscriberMethodInfo[] array4 = new SubscriberMethodInfo[8];
- array4[0] = new SubscriberMethodInfo(s, Events$WaypointAdded.class, background, 0);
- array4[n3] = new SubscriberMethodInfo(s, Events$WaypointUpdated.class, background, 0);
- array4[n] = new SubscriberMethodInfo(s, Events$WaypointRemoved.class, background, 0);
- array4[3] = new SubscriberMethodInfo(s, clazz2, background, 0);
- array4[4] = new SubscriberMethodInfo(s, Events$MonitoringChanged.class, background, 0);
- array4[5] = new SubscriberMethodInfo(s, MessageTransition.class, background, 0);
- array4[6] = new SubscriberMethodInfo(s, Location.class, background, 0);
- array4[7] = new SubscriberMethodInfo(Events$RestartApp.class);
- putIndex(new SimpleSubscriberInfo(BackgroundService.class, array4));
+ final SubscriberMethodInfo[] array4 = new SubscriberMethodInfo[n];
+ final String s2 = "onEventMainThread";
+ array4[0] = new SubscriberMethodInfo(s2, clazz2, background, 0);
+ array4[n3] = new SubscriberMethodInfo(s2, clazz, background, 0);
+ putIndex(new SimpleSubscriberInfo(MemoryContactsRepo.class, array4));
}
private static void putIndex(final SubscriberInfo subscriberInfo) {And that is a known RB bug in eventbus: greenrobot/EventBus#715 |
|
Thanks Fay! So my observation was right. Great, puzzle solved! The new signing key is hereby enabled in my repo now (and the old one disabled as well as its APKs are removed). With the next sync, the new version (v2.4.12) will be listed then – thanks @growse for your efforts! |
|
A late PS, @growse: as OwnTracks is listed at IzzyOnDroid since 2022-10-28 already, maybe you want to pick a badge and link there from your Readme? |
|
I'll add it to my to-do, but will accept a PR too :) |
|
Seems like you prefer shields? So something like this then? Would mean just to add this: [<img src="https://img.shields.io/endpoint?url=https://apt.izzysoft.de/fdroid/api/v1/shield/org.owntracks.android">](https://apt.izzysoft.de/packages/org.owntracks.android)A bit overkill to fork, clone and PR for this little piece – but if you insist, please let me know at which position to insert it 😉 would also be possibly by adding [<img src="https://img.shields.io/endpoint?url=https://apt.izzysoft.de/fdroid/api/v1/shield/org.owntracks.android&logo=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAADAFBMVEUA0////wAA0v8A0v8A0////wD//wAFz/QA0/8A0/8A0/8A0/8A0v///wAA0/8A0/8A0/8A0/8A0//8/gEA0/8A0/8B0/4A0/8A0/8A0/+j5QGAwwIA0//C9yEA0/8A0/8A0/8A0/8A0/8A0/+n4SAA0/8A0/8A0/+o6gCw3lKt7QCv5SC+422b3wC19AC36zAA0/+d1yMA0/8A0/+W2gEA0/+w8ACz8gCKzgG7+QC+9CFLfwkA0/8A0////wAA0/8A0/8A0/8A0/+f2xym3iuHxCGq5BoA1P+m2joI0vONyiCz3mLO7oYA0/8M1Piq3Ei78CbB8EPe8LLj9Ly751G77zWQ1AC96UYC0fi37CL//wAA0/8A0////wD//wCp3jcA0/+j3SGj2i/I72Sx4zHE8FLB8zak1kYeycDI6nRl3qEA0/7V7psA0v6WzTa95mGi2RvB5XkPy9zH5YJ3uwGV1yxVihRLiwdxtQ1ZkAf//wD//wD//wD//wD//wCn5gf//wD//wD//wD//wD//wAA0/+h4A3R6p8A0/+X1w565OD6/ARg237n9csz2vPz+gNt37V/vifO8HW68B/L6ZOCwxXY8KRQsWRzhExAtG/E612a1Rd/pTBpmR9qjysduKVhmxF9mTY51aUozK+CsDSA52T//wD//wAA0////wD//wBJ1JRRxFWjzlxDyXRc0pGT1wCG0CWB3VGUzSTh8h6c0TSr5CCJ5FFxvl6s4H3m8xML0/DA5CvK51EX1N+Y2gSt4Dag3ChE3fax2ki68yO57NF10FRZnUPl88eJxhuCxgCz5EOLwEGf1DFutmahzGW98x0W1PGk3R154MHE6bOn69qv3gy92oG90o+Hn07B7rhCmiyMwECv1nO+0pQfwrCo57xF2daXsVhKrEdenQAduaee1Bsjr42z5D9RoCXy+QNovXpy2Z5MtWDO/TiSukaF3UtE1K6j3B4YwLc5wXlzpyIK0u5zy3uJqg4pu5RTpkZmpVKyAP8A0wBHcExHcEyBUSeEAAABAHRSTlP///9F9wjAAxD7FCEGzBjd08QyEL39abMd6///8P/ZWAnipIv/cC6B//7////////L/1Dz/0D///////86/vYnquY3/v///5T//v///17///////////////84S3QNB/8L/////////////7r/////NP////9l/////wPD4yis/x7Ym2lWSP+em////0n////////v///////////////////7//7pdGN3Urr6/+v/6aT////+//H/o2P/1v+7r7jp4PM/3p4g////g///K///481LxO///v////9w////8v/////9/p3J///a+P9v/5KR/+n///+p/xf//8P//wAAe7FyaAAABCZJREFUSMdj+E8iYKBUgwIHnwQ3N7cEHxcH+///VayoAE0Dh41qR7aBnCIQ8MsJKHH9/99czYYMWlA0cIkJGjMgAKfq//9RNYzIgLcBWYOTiCgDMhDn+B9bh6LebiWyH6L5UZQzONoAHWSHoqEpDkkDsyKqelv1//9rG1HUN9YihZK9AKp6BkG+/6xNqA5ajhSsCkrIipmYGGRa//9vQXVQXSySBnkWJOUMfn5Myuz/G3hR1NdEIUUchwiy+bkTsg4dbW/fu6W/e1c3XMMy5JiOZkFxUFZo74mgKTqaKXu0+2HqVwkja3BH9kFu361JwcHTfPJD4mdfe8ULAdVRyGlJAcVFfg+CQOozZ4XrJ85+JgwBsVXIGriQw5Tp4ZScezd8JiWnBupru30qwJZa+ZAjmWlC8fUZM4qB6kPnLNSPLMWqQQ5ZQ5aOzs1HmamBaQHzFs6y+qAmJCTE8f9/QgKSBg4DJPWc6zVDQkIC09JkZSPD38kukpExFpT4z67uYI/QwCOOCCK/izvu5CWl6AcEWMnKWml7LWbKZfH9/99UkknQHhGsynDz+65eWXv3/JmJrq5eXienVlRUfH/z8VvCf45soKQIH1yDEQsszrp6gwq9C73T87xcXadKl5TkFev4A/2tygmSBqYXqAYJmK+ZuoJydDR1vP09DA0NOy2kpdML81+U/heCpH1JU3jig7lJ5nKOT4i/t6ZHkqGzs4lJmIVHfrj+JR4HqLQSD0yDkCNEpGNn5ix9D03/eJdElTZdKV2TpNOhkwt8YUlNUgimgV0dLMBvf1gz1MolPd5FRcVNSkpDQ8owJeBCDyIhrIDnOD5QcuIU+3/2QKSs9laQ+noNLS0zLWdtqyP7mBAFAw88TwsJgMuJYweBGjYngtWbmeuZOW+bvNQToUFOAlFqOBk4Ov3/L7Z60/aN0p1tUhpa5nqWlub7C3p2I9QzyAghlUvczOz/1fhzPT3XSIfpSmmYAdVbmm1gV0dSz8DSilpUQsqCddIWIA3meuZaJqdMJZEzl6gRqgZIWZAxUdoizERXN8yi5MltcZTChzMaRQM3JNUWHS8rL/+yaPGvMmvr5ywoGoxtkDWwQ+Pb89ycBeWfGSJeL/la+RS1eOPnRtbQKgMRjZg+t8x6PkP273nWQAoFOPAgaeAThKXAmXMrK39Kmr5fsuBlBqoXfJGLe3VbmHjG9Mczi9T//3h7vygXtcDlQtJg44iQiIjIBRbGPO7gghPJy0ZIxT2HOLIUgwxQzsgYrUR350HSIMaJLidhgKY+mw+pflBDrX8E7OGBjPCAPc76gQFSTqAIiYrb/8dRP4CyosJ/rmwU5XIxHMilt4QBJwsSkBMClxOQULBlkRRwEONmR2kJcDGjADX2/+xO8r5iqjExqmLyrWpcPFRta1BfAwCtyN3XpuJ4RgAAAABJRU5ErkJggg==">](https://apt.izzysoft.de/packages/org.owntracks.android)(for easier copy-paste 😉) |
|
Done! |
|
Cool, thanks! Just wondering: How comes there's a 2.5.2 at Play already when the latest tag is still 2.5.0? As said, no complaint, just wondering. PlayStore likes to replace apps installed on-device if they have the higher version (plenty of such reports a few months ago). So if the |
Should be a 2.5.2 tag, but the GH release needs me to fix a bug in the release gha that meant the wrong assets got uploaded. It's in draft, I'll have some time to look at it tomorrow morning. |
My updater just refused to accept the latest release, claiming the signature would not match. Taking a closer look it indeed sems that the current release was signed by a different key (sha256:
1fc4de52d0daa33a9c0e3d67217a77c895b46266ef020fad0d48216a6ad6cb70) than the previous one (sha256:94e6715957850cf5ec5e78b68587ee7128ba45e7323ba798c0269b4d8c695a99). May I ask what happened? There's no hint in the release notes.The text was updated successfully, but these errors were encountered: