I'm adding my app to f-droid : What is next step?

[bux]

Hello !

I just created a merge request to add my application to f-droid : Add rolling game dashboard application (!10176) · Merge requests · F-Droid / Data · GitLab

Do I have to make something more ? Or I just have to wait maintainer availability ?

Thanks !

[Licaon_Kter]

If you sign the resulting APK, it runs fine? https://gitlab.com/sevajol-bastien/fdroiddata/-/jobs/1859219241/artifacts/browse/tmp/

[bux]

Hello @Licaon_Kter

I have multiple question about yours.

• I suppose unsigned apk is a problem. Where can I see It is a problem on the merge request continuous integration ? (To be able to see when I signed it correctly)
• How I should sign it for this f-droid integration process ?

Thanks !

[linsui]

It’s not a problem. But you need to sign it to test if it works well.

[Licaon_Kter]

As said ^^^ I was just asking you to test the output APK for correctness for now.

For publishing in the repo, F-Droid will sign as needed.

[bux]

Hi again @Licaon_Kter and @linsui , I’m sorry I am a newbie with Android app (this is my first app). You suggest me to sign the APK file like with :

jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name

To check if signing is working, is that right ? Do you ask about trying to install it on my phone to test the signed apk installation too ?

[bux]

Look like fine

➜  rolldash git:(main) ✗ ~/Logiciels/android-studio/jre/bin/jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore /home/bastiensevajol/Documents/Bastien\ Sevajol/Work/Rolling/APK/Key/fr.bux.rollingdashboard.jks /home/bastiensevajol/Téléchargements/fr.bux.rollingdashboard.apk rollingdashboard 
Enter Passphrase for keystore: 
   adding: META-INF/MANIFEST.MF
   adding: META-INF/ROLLINGD.SF
   adding: META-INF/ROLLINGD.RSA
  signing: META-INF/com/android/build/gradle/app-metadata.properties
  signing: META-INF/androidx.activity_activity-ktx.version
  signing: META-INF/androidx.activity_activity.version
  signing: META-INF/androidx.annotation_annotation-experimental.version
  [...]
  signing: res/zQ.png
  signing: res/zq.xml
  signing: resources.arsc

>>> Signer
    X.509, CN=Bastien Sevajol, O=bux, L=Charavines, ST=Isere, C=FR
    [trusted certificate]

jar signed.

Warning: 
The signer's certificate is self-signed.
The SHA1 algorithm specified for the -digestalg option is considered a security risk. This algorithm will be disabled in a future update.
The SHA1withRSA algorithm specified for the -sigalg option is considered a security risk. This algorithm will be disabled in a future update.
POSIX file permission and/or symlink attributes detected. These attributes are ignored when signing and are not protected by the signature.

[linsui]

Then you just need to wait for reviewers.

[Licaon_Kter]

Signing always works

Yes, testing the built app is more important.