Can we get a sha256 hash of the apk? Like fairemail does pls? about accrescent HOT 10 CLOSED

They're exactly the same, Accrescent just doesn't include a : between each hex pair. If you prefer that, it's easy enough to add them manually 🤷‍♂️

from accrescent.

?? The current sha 256 of the apk accrescent-0.12.5.apk is 389e53223140a36a93fe91d1794d7c49b74d2e378b3b15c88cf6729236c4647c
On github signing certificate is something different. I dont think they're the same.

from accrescent.

Mine match 🤔🤷‍♂️ you looking at signing certificate?

from accrescent.

Yes there is no sha256 on github for us to match the apk

from accrescent.

The accrescent sha256 is in 3 places, one of them is github
GitHib
Twitter
Webpage

from accrescent.

If the devs would publish the sha256 of the apk rather the sha256 of the signing key, they would need to update all those places every time a new release is made.

If you download an apk from github and compare it to the sha256 sum next to it you won nothing. If the apk got corrupted during download it will fail to install and if a malicious actor got access to upload the apk, they can also replace the sha256. However gaining access to the signing key is (hopefully) more difficult.

from accrescent.

ok ty 4 input. how do i check the apk hasnt been tampered with? i dont get what the signing certificate does? what am i suppose to do with it? sorry for my noob'ness

from accrescent.

It works similar to a GPG signature (to understand what it technical does).

PrivacyGuides has a good noob guide for verifying apk fingerprints https://www.privacyguides.org/en/android/#verifying-apk-fingerprints

from accrescent.

The signing certificate proves the app was signed by the owner of the signing key, in this case hopefully only Logan. Anyone can see the hash of the apk itself so publishing that is kinda meaningless. What you want to verify is who it came from.

from accrescent.

Ok now I get it now. Maybe someone should link that or write it somewhere. I made a termux script if any1 wants it.
https://pastebin.com/8b3ifv72

Use it like this.

./nameofscript.sh accresent.apk

I'm closing this issue. Is resolved.

from accrescent.