Dear #Android #App #Developers, as it still happens far too often (no naming, no shaming! 💩 happens to everyone of us) a reminder to take good care of your #signing keys – and also take precautions for the case that your keystore might get lost. Please take a look at: https://f-droid.org/2023/09/03/reproducible-builds-signing-keys-and-binary-repos.html#lessons-learned-2-how-to-keep-your-key-safe-and-what-measures-to-take-for-the-event-of-loss where I outline this topic.
Thanks!
#security
@IzzyOnDroid@floss.social How do you deal with key rotation ? And, is it planned for the client to inform about an application they have to reinstall (because of that) ?
@S1m@infosec.exchange Key rotation does no longer work at F-Droid.org, but it does at IzzyOnDroid (as we implemented the suggested patches instead of accepting their implementation of the “POC fix” back then). If Key rotation is used, no notifications are needed; IIRC, Android handles that (we have only 1 such app yet). And establishing RB here does not require it either, as we only ship the APKs signed by their resp. devs to begin with (RB runs on a “parallel track” here).
@IzzyOnDroid@floss.social Ok, great ! Hope they fix it too.
The notification is still required for developers that loses their keys 😬
@S1m@infosec.exchange I have my doubts towards the former (that would mean rolling back their implementation, at least in parts, and using the suggested patches instead, which they rejected. The argument was that f-droid.org itself does not need key rotation, IIRC.). And as long as we still use fdroidserver, the only way we can notify is via the inlined per-release changelogs (aka “Fastlane changelogs”), which is what we do.
@IzzyOnDroid@floss.social Hm, there should be a way to set a warning for a version in the index that the client can use to inform users
@S1m@infosec.exchange which needs to be implemented serverside (fdroidserver writing the index) AND clientside (to show it). Without the index itself supporting it, there’s nothing the clients can do. So: https://gitlab.com/fdroid/fdroidserver/-/issues/301 ? https://gitlab.com/fdroid/fdroidclient/-/issues/195 ? Does not look like this will happen.
@IzzyOnDroid@floss.social I’ll try to open issues for more specific messages then: metadata to warn about removed application, and metadata to warn about application that need to be reinstalled
@S1m@infosec.exchange Remember that WE cannot implement those. Everything that needs changes to the index, is out of our hands – at least as long as we’re still bound to fdroidserver. So such issues would need to be filed there – with the tools that generate the indexes. Our client devs would surely pick up those data once available.
