weak signing key

[IzzySoft]

Checking the app, I receive a warning about a weak signing key being used:

package: name='be.digitalia.mediasession2mqtt' versionCode='2200113' versionName='1.1.3' platformBuildVersionName='15' platformBuildVersionCode='35' compileSdkVersion='35' compileSdkVersionCodename='15'
Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer #1 certificate DN: O=digitalia, C=BE
Signer #1 certificate SHA-256 digest: fb9f5fd52cc127f8b41b7bb6a889944f347923ceb5af083dc857f170b14b7532
Signer #1 certificate SHA-1 digest: f4118849bc95bef4b8f1993f6385ba8d72b16fc0
Signer #1 certificate MD5 digest: 6baed960a524d81930f3f6e5e5d44fe4
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 1024
Signer #1 public key SHA-256 digest: a7ab140011b79c755dd7dd1d0eeb917da3b06afa8757956c867f811800abb397
Signer #1 public key SHA-1 digest: 746e789ea354e0251b93fdf28efdcbc0d3d0fdbd
Signer #1 public key MD5 digest: 1d8e3ab052cb83cfb6d7142ef9aafa11
Signature algorithm name: SHA1withRSA (weak)
Subject Public Key Algorithm: 1024-bit RSA key (weak)
The certificate uses the SHA1withRSA signature algorithm which is considered a security risk. This algorithm will be disabled in a future update.
The certificate uses a 1024-bit RSA key which is considered a security risk. This key size will be disabled in a future update.

Do you plan to upgrade your key? I understand that will mean a "new signing key", and existing installations (at least those on Android versions < 9) would need to be uninstalled and re-installed (for 9+, see Signing Key Rotation). But the alternative doesn't look better…

[cbeyls]

I've been doing Android development for a while and when I created my personal key, SHA1withRSA with a 1024-bit RSA key was the default. I use it on Google Play and I can't change it yet because I still support apps that can be upgraded from Android 5-8 devices that don't allow key rotation.

But the key used to sign MediaSession2MQTT doesn't matter. You sideload it yourself so you already take a risk. The "security risk" in this case is that a third party could sign a malware version of the app with my key to make it look like I built it. But since you only download binaries from my Github repo directly (at least I hope you do), you already checked that the build originates from me.

And of course the project is open source so you can build it yourself from the source with your own key if you prefer, but if you change the key you'll have to reinstall the app from scratch.

[IzzySoft]

Yupp, I'm aware of this. And no, I don't "side-load from Github". I'm hailing from IzzyOnDroid (best known for its IzzyOnDroid repo). We provide the APKs offered by their resp. developers at forges like Codeberg, GitLab & Github, after running them through our scanners (which just brought this up on a pre-scan for adding the app; it was not yet added) and, if possible, also confirm them via Reproducible Builds (see e.g. Reproducible Builds, special client support and more at IzzyOnDroid for some background on that).

I'm no Android developer myself, and I have not yet tested this (confirmation welcome, positive or negative if proven), but would using key rotation and keeping both keys maybe keeping the app viable for Android < 9, while adding the secirity of the stronger key for 9+? I know that our server supports key rotation (and we have at least one such app in our repository). But I have no device with a single-digit Android version to test with.

[cbeyls]

I suppose I could create a separate APK file for Izzydroid if needed. But this app is not even a good candidate to be published on a store, it was designed as a hack for Android TV devices in the first place.

I think it would be easier if Izzydroid build it from source and sign it with their own certificate like F-Droid does, also because reproducible builds are hard on Android (I use R8 to reduce the size of the app).

[IzzySoft]

We do not sign ourselves (or maintain signing keys for any apps). Our builders are just for reproducible builds, as outlined above.

No pressure here; I just reported my findings in case you were not aware of the fact. If you don't want your app at our repo, we'll totally respect that. And would then happily comply if you'd reach out to us later, when you think the app is ready for this step.

because reproducible builds are hard on Android (I use R8 to reduce the size of the app).

I have almost 500 apps in my builder (at IzzyOnDroid, we have multiple builders, even independent ones not run by our team). Most of them use R8. We have some experience with RB. Taking a look at your gradle, it seems absolutely doable – though I'd recommend removing vcsInfo.include = false (embedded vcsInfo actually can be quite helpful when dealing with a failed RB, as it clearly shows what commit the APK was built from – though not whether the tree was clean then).

I've quickly set up a recipe for your app to find out: RB on the first run. No complications at all.

  {
    "upstream_signed_apk_sha256": "4d4c071d07e3f3674d9a3d0265da2bfedce2645779cd4de0d3044b00714ef51c",
    "built_unsigned_apk_sha256": "e433bf809df05ced602e077bbef2f42ce5707713ec00528d94eba7944328dc14",
    "signature_copied_apk_sha256": "4d4c071d07e3f3674d9a3d0265da2bfedce2645779cd4de0d3044b00714ef51c"
  }

You see the first hash (from your APK) and the last hash (the APK I've just built and then copied your signature over) are identical. Signature copying would have failed (well, or resulted in a different hash and not verified) if the builds had not byte-identical results.

So if you want us to, we can establish your app at IzzyOnDroid, even as reproducible build. Decision is up to you. Let me end this comment with the full build recipe, so in case you decide to have it listed we don't have to write it again (though that took no more than 2 minutes):

---
repository: https://github.com/cbeyls/MediaSession2MQTT.git
updates: releases
versions:
  - tag: 1.1.3
    apks:
      - apk_pattern: mediasession2mqtt.*\.apk
        apk_url: https://github.com/cbeyls/MediaSession2MQTT/releases/download/1.1.3/mediasession2mqtt-1.1.3.apk
        build:
          - ./gradlew assembleRelease
          - mv app/build/outputs/apk/release/*unsigned.apk /outputs/unsigned.apk
        build_cpus:
        build_home_dir: /build
        build_repo_dir: /build/repo
        build_timeout:
        build_user: build
        provisioning:
          android_home: /opt/sdk
          build_tools:
          cmake:
          cmdline_tools:
            version: '12.0'
            url: https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip
            sha256: 2d2d50857e4eb553af5a6dc3ad507a17adf43d115264b1afc116f95c92e5e258
          extra_packages: []
          image: debian:bookworm-slim
          jdk: openjdk-17-jdk-headless
          ndk:
          platform:
          platform_tools:
          tools:
          verify_gradle_wrapper: true

(our builds run in an ephemeral Podman container, hence the last command in the build: section is to move the resulting APK out for comparing it against yours).