mynacol, 1 year ago

@Foxboron
Users of the #FDroid version have to reinstall the app. A guide is in the linked mail.

Why is there no automatic key rollover (switching to the new key with signature from the previous one)? Is #Android lacking that?

jr, 1 year ago

@mynacol @Foxboron yes Android (AFAIK except really new versions) does not know the concept of key rollover...

jr, 1 year ago

@mynacol @Foxboron just looked it up again: support for key rotation was introduced with APK signing scheme v3, which in turn was introduced with Android 9, but at least F-Droid does not support the key rotation...

Bubu, 1 year ago

@jr @mynacol @Foxboron

Which means, you can only use that if your app's minSDK is >= Android 9. (At least that's what I remember from when this feature was originally introduced)

Wireguard's minSDK is Android 5.0.

F-Droid might start to look into this though, it's only a few years off until this can can be reaslistically used in the wild.

jr, 1 year ago

@Bubu @mynacol @Foxboron looks like Google recommends signing the APK with a second non rotated certificate if your minSDK is lower...

Bubu, 1 year ago

@jr @mynacol @Foxboron Do you have a link or direct quote?

Also interesting that they chose to offer apks with the old signer via gplay but not via fdroid (which can do this as well) 🤔.

jr, 1 year ago

@Bubu @mynacol @Foxboron Not sure where I found it, will try to find it again when I'm back from work...

eighthave, 1 year ago

@jr @Bubu @mynacol @Foxboron I would love to see documentation of real world cases of that APK signing key rotation in action. Know of any? Seems like thing we should include in the #FDroid docs too.