How to verify the APK signing certificate fingerprint? (linux)

ABCbits

legendary

Activity: 2856

Merit: 7410

Crypto Swap Exchange

Quote from: Orneved50 on August 25, 2023, 06:29:03 AM

Hello,

To import a GPG key for the APK file from the GitHub repository "Blockstream/green_android" on Linux, follow these steps:
--snip--

OP already solved the problem, so i don't see necessity of giving more guide when it's flawed.

Quote from: Orneved50 on August 25, 2023, 06:29:03 AM

Download the repository's GPG key: gpg --recv-keys

Depending on PGP version/config on user device, they might see error/fail message like this.

Code:

$ gpg --recv-keys "04BE BF2E 35A2 AF2F FDF1 FA5D E7F0 54AA 2E76 E792"
gpg: key E7F054AA2E76E792: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg: w/o user IDs: 1

Quote from: Orneved50 on August 25, 2023, 06:29:03 AM

Verify the APK signing certificate fingerprint:

jarsigner -verify -verbose -certs

For detailed instructions and troubleshooting, refer to the repository's documentation or GPG and APK signing guides online.

Why would you suggest using jarsigner when OP ask about verifying file with GPG key and GPG signature? From quick search, it seems to impossible without converting GPG key to different format[1].

[1] https://stackoverflow.com/a/11219493

Orneved50

newbie

Activity: 1

Merit: 0

Quote from: Pocketchange on August 21, 2023, 06:02:45 PM

Hi btctalk!

I'm stumped on how to "import GPG key" on this apk file. I'm on linux and been trying for a couple days.

https://github.com/Blockstream/green_android

Can anyone point me to a resource to accomplish this? Mayo Clinic Patient Portal App

Thank you!

Hello,

To import a GPG key for the APK file from the GitHub repository "Blockstream/green_android" on Linux, follow these steps:

Download the repository's GPG key: gpg --recv-keys

Verify the APK signing certificate fingerprint:

jarsigner -verify -verbose -certs

For detailed instructions and troubleshooting, refer to the repository's documentation or GPG and APK signing guides online.

Pocketchange

jr. member

Activity: 44

Merit: 22

I really appreciate the help vv181! I looked at a lot of places for help except blockstreams articles. Huh

I thought it would be simpler if they just put the code on their github page.

Thank you!

vv181

legendary

Activity: 1932

Merit: 1273

As shown at https://help.blockstream.com/hc/en-us/articles/900002174043-How-do-I-verify-the-Blockstream-Green-binaries-, you can do:

Code:

$ gpg --keyserver keyserver.ubuntu.com --recv-keys "04BE BF2E 35A2 AF2F FDF1 FA5D E7F0 54AA 2E76 E792"

If it fails, try:

Code:

$ gpg --verbose --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys "04BE BF2E 35A2 AF2F FDF1 FA5D E7F0 54AA 2E76 E792"

Pocketchange

jr. member

Activity: 44

Merit: 22

Hi btctalk!

I'm stumped on how to "import GPG key" on this apk file. I'm on linux and been trying for a couple days.

https://github.com/Blockstream/green_android

Can anyone point me to a resource to accomplish this?

Thank you!

Topic: How to verify the APK signing certificate fingerprint? (linux) (Read 117 times)