It wants me to uninstall and reinstall since the signature of different, which makes sense as it from a different source, but it doesn’t mention anything in the changelog.

  • chris2112@lemmy.world
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    Do you know why the signatures would be different? At my company we release our app on Google play, galaxy and Amazon store and I’m pretty sure we use the same signing key for each

    • Ɀeus@lemmy.world
      link
      fedilink
      arrow-up
      0
      ·
      1 year ago

      because fdroid build all of their apps themselves, so every app on the fdroid repo uses the fdroid signing key

      • chris2112@lemmy.world
        link
        fedilink
        arrow-up
        0
        ·
        1 year ago

        Interesting, I was not aware of that. sounds like a security risk, as you don’t know who actually published it, but I guess since its open source that doesn’t really matter as much

        • Vittelius@feddit.de
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          You know who published it. It’s the fdroid devs. Fdroid follows very much the old Linux repository philophosy where the owner of the repo acts as a middleman, providing the central layer of trust. You don’t have to trust the developers because the distributor has done their due diligence and checked it. That’s why fdroid takes a couple of days to push updates. They are doing some basic quality control first.

          This model made a lot of sense in the world of traditional Linux packaging, where every obscure distribution has their own package format and developers couldn’t possibly be expected to support all of these. It makes less sense on Android (or in a word where flatpak exists for that matter).