Hello,
In order to verify that the Application is genuine, please consider publishing the apk signing certificate hash. This could then be included in https://github.com/privacyguides/verified-apps. It would also allow for verification in the Android apps https://github.com/privacyguides/verified-apps-android, https://github.com/soupslurpr/AppVerifier, https://github.com/RoundSalmon4/AppVerifierBG; website https://roundsalmon4.github.io/certhashviewer/; or CLI tools (apksigner).
Now I do understand that F-Droid has their own signing key (?); I'm not too clear on that. Edit: though my latest understanding is that if reproducible builds are enabled in Fdroid then the Fdroid signing key would not be used.
Thanks for the consideration.
Hello,
In order to verify that the Application is genuine, please consider publishing the apk signing certificate hash. This could then be included in https://github.com/privacyguides/verified-apps. It would also allow for verification in the Android apps https://github.com/privacyguides/verified-apps-android, https://github.com/soupslurpr/AppVerifier, https://github.com/RoundSalmon4/AppVerifierBG; website https://roundsalmon4.github.io/certhashviewer/; or CLI tools (apksigner).
Now I do understand that F-Droid has their own signing key (?); I'm not too clear on that. Edit: though my latest understanding is that if reproducible builds are enabled in Fdroid then the Fdroid signing key would not be used.
Thanks for the consideration.