TheAnachronism/tt-rss-viewer
1
0
Fork 0
Code Issues Pull requests Projects Releases 5 Packages Wiki Activity Actions

Signing and update trust #54

New issue
Closed
opened 2026-08-03 22:43:04 +00:00 by TheAnachronism · 1 comment
TheAnachronism commented 2026-08-03 22:43:04 +00:00
Owner
Copy link

Part of #41
Blocked by: #52, #53

Question

What signing and update-trust story is the minimum for sideload-to-friends 1.0 beta (keystore ownership, how friends receive updates, when signature changes break updates)?

Part of #41 Blocked by: #52, #53 ## Question What signing and update-trust story is the minimum for sideload-to-friends 1.0 beta (keystore ownership, how friends receive updates, when signature changes break updates)?
TheAnachronism commented 2026-08-04 19:16:38 +00:00
Author
Owner
Copy link

Resolution

Signing and update-trust bar for sideload-to-friends 1.0 beta (criteria only — implement later):

Must

  1. Project-owned release keystore in CI: tagged beta builds use a dedicated release keystore (or PKCS12) injected via Forgejo secrets/CI — not the runner debug keystore. Private key is never committed.
  2. Signer continuity: friends can update in place across beta releases when package id stays dev.theanachronism.ttrssviewer, versionCode rises (epoch seconds per App identity and versioning), and the same release cert signs both APKs.
  3. v3-capable signing: CI/release config must produce APKs with APK Signature Scheme v3 enabled under the project release key so a future key rotation is possible. No second key / live lineage required for beta day one.
  4. Update delivery: friends get newer APKs from Forgejo Releases and install manually — no in-app updater.
  5. Friend-facing note (plain language): friend install/update docs include a one-time alpha → beta may need uninstall/reinstall note (package-id change from App identity and versioning); no certificate/signing jargon for friends.
  6. Operator-facing notes: document key custody, that key loss without a prepared rotation forces uninstall/reinstall, and that updates require matching package id + rising versionCode + same cert.

Not must for beta

  • In-app update checks
  • Creating a live signing-key lineage with a backup/rotated key before friends install
  • Making debug-signed local builds part of the friends update path

Why

Alpha APK signing reality shows debug-keystore signing cannot guarantee update-in-place. Friends beta needs a durable project signer and a simple Releases download path; v3 keeps a rotation door open without overbuilding day-one key ceremony. Friend docs stay simple; operators own the key risk.

## Resolution **Signing and update-trust bar** for sideload-to-friends **1.0 beta** (criteria only — implement later): ### Must 1. **Project-owned release keystore in CI:** tagged beta builds use a dedicated release keystore (or PKCS12) injected via Forgejo secrets/CI — **not** the runner debug keystore. Private key is never committed. 2. **Signer continuity:** friends can update in place across beta releases when package id stays `dev.theanachronism.ttrssviewer`, `versionCode` rises (epoch seconds per [App identity and versioning](https://git.anachronis.dev/TheAnachronism/tt-rss-viewer/issues/52)), and the **same release cert** signs both APKs. 3. **v3-capable signing:** CI/release config must produce APKs with **APK Signature Scheme v3** enabled under the project release key so a future key rotation is possible. No second key / live lineage required for beta day one. 4. **Update delivery:** friends get newer APKs from **Forgejo Releases** and install manually — no in-app updater. 5. **Friend-facing note (plain language):** friend install/update docs include a one-time **alpha → beta may need uninstall/reinstall** note (package-id change from [App identity and versioning](https://git.anachronis.dev/TheAnachronism/tt-rss-viewer/issues/52)); **no** certificate/signing jargon for friends. 6. **Operator-facing notes:** document key custody, that key loss without a prepared rotation forces uninstall/reinstall, and that updates require matching package id + rising versionCode + same cert. ### Not must for beta - In-app update checks - Creating a live signing-key lineage with a backup/rotated key before friends install - Making debug-signed local builds part of the friends update path ### Why [Alpha APK signing reality](https://git.anachronis.dev/TheAnachronism/tt-rss-viewer/issues/53) shows debug-keystore signing cannot guarantee update-in-place. Friends beta needs a durable project signer and a simple Releases download path; v3 keeps a rotation door open without overbuilding day-one key ceremony. Friend docs stay simple; operators own the key risk.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
beta/0.0.4
beta/0.0.3
beta/0.0.2
beta/0.0.1
alpha/0.0.2
Labels
Clear labels   
needs-info
Waiting on reporter for more information

  
needs-triage
Maintainer needs to evaluate this issue

  
ready-for-agent
Fully specified, ready for an AFK agent

  
ready-for-human
Requires human implementation

  
wayfinder:grilling
HITL grilling/decision ticket

  
wayfinder:map
Wayfinder effort map

  
wayfinder:prototype
HITL prototype ticket

  
wayfinder:research
AFK research ticket

  
wayfinder:task
Unblocking manual task ticket

  
wontfix
Will not be actioned

No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wayfinder:grilling
wayfinder:map
wayfinder:prototype
wayfinder:research
wayfinder:task
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
TheAnachronism
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
TheAnachronism/tt-rss-viewer#54
No description provided.