Android.EweSticker icon indicating copy to clipboard operation
Android.EweSticker copied to clipboard
verified publisher icon FredHappyface

Feature: List Signing Certificate Fingerprint to Let Users Verify the Downloaded APK

Open deivpaukst opened this issue 10 months ago • 1 comments

Before You Begin

Before proceeding, please make sure to follow these steps:

  • [x] I have checked for similar feature requests in the project's issue tracker to avoid duplicates.
  • [x] I have searched existing issues to see if this feature has been discussed before.

Feature Details

List the signing certificate fingerprint, either in the README.md or the app's website, to let users verify the downloaded APK.

Is your feature request related to a problem? Please describe

I'm downloading this app using Obtanium and so I would like to make sure that the app I install is indeed the correct one. To do so I use AppVerifier. To be able to check whether the app downloaded is indeed from the developer I would need the hash of the signing certificate used to sign the app.

Describe the solution you'd like

The hash would be listed preferably on an external site. Like the app's site, but it could also be listed on Github if the external site is not an option.

Describe alternatives you've considered

I've also considered getting the app from Google Play or just hoping that I have indeed acquired the app from the developer. Neither option really resolves the issue for me.

Additional Context

It's slowly becoming a standard security practice to list the key's hash somewhere in your project for example: Thunderbird, Molly, AuroraStore, GeoShare.

deivpaukst avatar Apr 06 '25 08:04 deivpaukst

Hi

Thanks so much for this. Agreed that this would be ideal. Sadly got some busy weeks ahead but I'll look into this when I can add I've currently no idea how to do this

Cheers :)

FredHappyface avatar Apr 06 '25 13:04 FredHappyface

Heyo, I'm not an Android dev, but does this help? Link to StackOverflow

I'd like to use this app, but since it's technically a keyboard, I'd like to be sure I can verify it.

deivpaukst avatar Jul 17 '25 18:07 deivpaukst

Apologies for the delay in getting this info to you!

Unfortunately I do not have an external site to github at this time

com.fredhappyface.ewesticker-20250217-release.apk: 69:BD:0A:BA:48:A2:F4:7C:4D:C0:DE:81:BC:A8:6A:C3:94:83:8B:39:C5:1C:D9:53:50:AD:63:2D:DD:CC:CE:D8

FredHappyface avatar Jul 18 '25 17:07 FredHappyface

TYSM!

deivpaukst avatar Jul 18 '25 21:07 deivpaukst

Just a note as well that I've added this to the release and shall going forwards :)

FredHappyface avatar Jul 19 '25 14:07 FredHappyface