AppVerifier needs an update ASAP

filastinhurra

This app's last update was 11 months ago. At least one app I know has a new signing key that results in a failure when checking it with AppVerifier.

AppVerifier is available in Accrescent Store which is highly trusted by GOS users. Keeping it updated should be required to be in high trust Accrescent Store.

I love the idea of AppVerifier, but they also need to add more apps to their data base.

(The app in question: https://github.com/ReadYouApp/ReadYou/issues/1219)

userofgos

filastinhurra I love the idea of AppVerifier, but they also need to add more apps to their data base.

See here: https://github.com/soupslurpr/AppVerifier/issues/188#issuecomment-2565864587

The plan is to remove the internal database once Accrescent is open and has more apps. Users can always source the hashes and manually verify. It's easy to share verification info and it can be shared to AppVerifier as well to conveniently verify with others.

And here: https://github.com/soupslurpr/AppVerifier/issues/192

Hi. The internal database won't be accepting new entries. It will eventually be removed once Accrescent is stable. This is because maintaining and adding new entries to the database is too difficult.

Developers publishing apps on secure app stores like Accrescent is the solution.

de0u

filastinhurra AppVerifier is available in Accrescent Store which is highly trusted by GOS users.

Is AppVerifier decreasing end-user security by improperly causing users to trust invalid APKs? Or is there some other way that AppVerifier poses a risk to GrapheneOS users?

filastinhurra Keeping it updated should be required to be in high trust Accrescent Store.

Whose security would be improved if AppVerifier were removed from Accrescent? In what way?

schweizer

filastinhurra AppVerifier is available in Accrescent Store which is highly trusted by GOS users.

This is a huge mistake. Accresent is officially in "early alpha" stage. Such an app should not be used other than for playing around. It is completely intransparent as to what you can expect from it.

de0u Is AppVerifier decreasing end-user security

With Appverifier users get aquainted to install apps with missing/invalid signatures. I do find that problematic.

Novalissoide

filastinhurra need to add more apps to their data base.

It should rather remove the internal database, like they plan to do. As users runs the risk of interpreting a no-result as alarming.

But something maybe also need to prevent users from first tapping 'copy' and immediately tap 'verify from clipboard' and believe they now verified their apps integrity since it says 'Success'.

de0u

schweizer With Appverifier users get aquainted to install apps with missing/invalid signatures. I do find that problematic.

Perhaps users who otherwise would use some better approach are becoming acquainted to doing this, but it's not clear to me how to be sure about that.

If there is a better alternative that users would actually shift to if AppVerifier vanished, then the existence of AppVerifier with an incomplete/stale database may be making things worse. Is it clear what that alternative would be?

dhhdjbd

Novalissoide

I agree, i think the second one is probably the bigger issue

The databse beeing outdated is very unlikely / almost impossible to cause any harm, it is just annoying and confusing, but not any danger unlike this

Novalissoide

dhhdjbd Yes, I confess that the first times using Appverifier, I did that mistake. Since I had no experience and no prior reading-up on what a signing hash even was for, not knowing the inner workings of the appverifier, and the buttons being placed exactly like they would be if intended to be used in that way, yep, with a strange feeling, I totally did this a few times.

Norman

Considering the (lack of) progress on Accrescent, this just makes AppVerifier look dead to me

koocmit

Norman I am not sure where you are getting "lack of progress", I see plenty of activity:

Novalissoide

koocmit they're working their ---es off, and that shows how intricate and huge the challenge they've taken on creating Accrescent

Norman

koocmit I guess I wasn't looking at the right repo, it does look like a lot of work is still going into it. I was looking also at the release cadence of the Accrescent app

soupslurpr

Please make an issue if you think a database entry is outdated and provide the new verification info so it can be updated in the next version.