New signing key for F-Droid?

1

Hello,

I am currently planing to bring my app (GitHub - Drexel2k/OpenEatsJournal: Open Eats Journal is a free, data minimized and privacy friendly open source eats journal to track your food intake, nutritions, calories and weight. · GitHub) to F-Droid. I have already a signing key and a keystore for the Google Play Store.

Shall I reuse it or is it better to create a new one for F-Droid? Any recommendations/best practices?

Thanks for any help!

2

we encourage repro builds so we host the upstream APK: Submitting to F-Droid Quick Start Guide | F-Droid - Free and Open Source Android App Repository

but looking at Releases · Drexel2k/OpenEatsJournal · GitHub I don’t see you publish your signed APKs?

3

No I have nothing done yet, I am still in the state of reading and gathering information.

I am following this tutorial: How to Publish Your Flutter App on F-Droid - DEV Community

There I need a signing key to sign the APK…

4

Ok, when I read here:

This approach allows publishing both APKs signed by the (upstream) developer and APKs signed by F-Droid. This enables us to ship updates for users who installed apps from other sources than F-Droid (e.g. Play Store), while also shipping updates for apps which were built and signed by F-Droid.

it seems valid and reasonable to use the same signing key.

5

Just noticed that Google replaces my signature with it’s own signature before publishing (Google Play app signing: Use Play App Signing - Play Console Help ) to protect my own signature. This makes reproducible builds and cross updates impossible. Maybe it is not a good idea then to use my upload signature for the Play store to use as signature for the F-Droid release.

6

We can’t reproduce the Google signed APK, but we could yours…

7

Yes that’s clear, I just thought if I sould use another certificate for F-Droid signing to keep the signature I use for Play upload secret as Google suggests it, but that doesn’t make sense neither, then I would need to build 2 binaries, one for F-Droid and one for Google Play… So I leave it just as it is. One signing for upload in both repos.

But I added the my upload fingerprint to the trusted fingerprints in Google Play, I think this is necessary in the future. As the app will be installed by F-Droid with this signature.

8

One APK in github… for F-Droid and folks.

Whatever you push to Google, that’s unrelated.