Verifying signing key

📱 Desktop & mobile clients
,
1

OS: GrapheneOS
Installer: Obtainium
Source: F-droid-repository
Hey there, I tried validating my android installation out of curiosity and it failed. Now I am not sure wether I misunderstood the verifying process on the github. I tried verifying with the keys using “appverifier”
Thanks :slight_smile:

Screenshot_20250510-160031
Screenshot_20250510-1600311080Ă—2400 191 KB

Screenshot_20250510-160021
Screenshot_20250510-1600211080Ă—2400 157 KB

Screenshot_20250510-155859
Screenshot_20250510-1558591080Ă—2400 352 KB

2

The page says:

  • not suitable for Fdroid downloads, as Fdroid is signing it on their own
3

So I can only verify when using play store?

4

I’d say that in practice you can only verify downloads provided directly by Nextcloud via GitHub, namely the gplay-release-xxxxxxxx.apk and the nextcloud-xxxxxxxx.apk: Releases · nextcloud/android · GitHub

See also here: GitHub - nextcloud/android: 📱 Nextcloud Android app

Signing certificate fingerprint to verify the APK:

  • APK with “gplay” name, found here or distributed via Google Play Store
  • APK with “nextcloud”, found here
  • not suitable for Fdroid downloads, as Fdroid is signing it on their own

As far as I understand it, this is because F-Droid has its own build infrastructure, and developers can’t upload already-compiled apks. Google Play seems to be different, but I have no idea if and how you can verify an apk that you install directly via Play Store app. I mean, if you install it via the official Play Store app, it will be downloaded and installed directly, so you probably need to use some third-party Google Play client that only downloads the apk to be able to verify it before installing it, but I never tried that.