Skip to content

Make Android APK signing reproducible and preserve pairing across certificate migration #23

New issue
New issue
Open
Open
Make Android APK signing reproducible and preserve pairing across certificate migration#23

Description

@nonlog
nonlog
opened on Oct 29, 2026

Confirmed release defect

The Android APKs currently published from GitHub Actions are debug-signed with a runner-local key, not a persistent per-app signing identity. APK Signing Block v2 certificate SHA-256 extracted from released APKs:

  • v0.1.10: 7e291746c38d39810424c879aadf3f1055c05cc88dbc34a5ecab83c6e4aedf9b
  • v0.1.11: f68499a79a532cc0f4ed4d24bfd5d5df995c3983bd5f0d6d4ebf10d655131980

These differ. Android rejects in-place updates when the new APK's signing certificate does not match the installed package identity. Do not recommend uninstalling Conduit just to update: that erases app-private Noise identity, pairing state and history.

Required solution

  1. Configure a durable, private Android signing keystore in GitHub Actions encrypted secrets, never in the repository. Upload a signed optimized release APK, and verify the expected public certificate fingerprint before publishing a tag.
  2. Ensure every future release uses the same certificate; add CI check comparing signer identity and reproducible release artifact naming.
  3. Develop and test a one-time, verified, data-preserving migration from currently installed debug certificates. Do not attempt migration without an authenticated device and a verified backup/restore plan (the current test phone is not attached via ADB).
  4. Confirm upgrades, pairing identity and transfer history survive on real Android 16.

Independent from the v0.1.12 LAN/Relay reconnection logic in PR #22. Code-level network fixes do not make a differently signed Android APK safely upgradeable.

Activity

  1. nonlog commented on Nov 4, 2026

    @nonlog
    nonlog
    on Nov 4, 2026
    OwnerAuthor

    Verified code17 stable-signer migration

    Implemented on PR #27; not yet merged to the default branch.

    • Persistent private release signer is held only in encrypted CI secrets. Public certificate SHA-256: 41407a095b8f8dbe0cbf63084d1f7ca9ff1f35efad07d716fd95d64c8791d2ae. Tagged builds verify the certificate and publish the optimized signed APK, not a runner-local debug build.
    • Trusted workflow 41857249743 passed 22 Android UI/motion tests and a disposable certificate-change plus same-signer-upgrade preservation rehearsal.
    • The existing rooted OnePlus was safely migrated to optimized code17 / 0.1.15 after validating independent private phone/local backups and retaining the exact original APK. Every restored state file matched before restarting background services, and the immutable Noise identity was verified again after restoring permissions. Private backups are not uploaded.
    • The migrated phone re-established its existing authenticated Relay pairing. A real 8192-byte PC-to-phone-to-PC file round-trip matched SHA-256 at both destinations. Future updates use the same certificate in place.

    This verifies this controlled rooted-device migration, not a universal non-root migration path. Keep the issue linked to PR #27 until the stable signing changes are integrated; never recommend uninstalling without a verified backup and restore route.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions