Skip to content

New signing scheme (v2) not recognized by fdroidserver

Some developers started to switch to Google's new v2 scheme. As a result, the .apk doesn't hold the certificates anymore in META-INF/ if signed "v2 only" (devs can still decide combining the two, thus adding a layer of security without risking compatibility). Examples:

Not sure whether fdroidserver can do anything about that at all, or a solution must rather be implemented by the devs of the corresponding app ("different flavor"). Not being a dev, I lack the required insight. Luckily, this no longer "breaks index creation" (those .apk files can be ignored with a proper warning) – but neither can new versions being made available via "simple binary repo" as long as only this signing type is used.

Are there any proper approaches/solutions?

Edited by Izzy
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information