Skip to content

gitlab-ci: punt reworking index-v1.jar verify

The index-v1.jar tests need to verify its SHA1 signature. Java's default is to treat SHA1 as unsigned. Ideally, our code would use apksig to verify those JAR sigs so that it would use the apksigner rules for whether a SHA1 signature is valid.

https://android.googlesource.com/platform/tools/apksig/+/master/src/main/java/com/android/apksig/internal/apk/v1/V1SchemeVerifier.java

The failure looks like: https://gitlab.com/fdroid/fdroidclient/-/jobs/3728296505

Edited by Hans-Christoph Steiner

Merge request reports