APK Signature Conflict?

[deleted]

I have a big problem, I installed keepassdx from playstore then I tried to confirm that it came from the right developer by installing the github version and there is a conflict! The two apk don't have the same signature

I thought that the applications on the playstore were the same as on github but no

MetropleX

Please don't tag specific mods for a general query anyone in the community could answer.

You should only be using one source for each app and this is easily resolved by using the same source across profiles. That way updating the app in one profile will update it globally across all. You can use Aurora in another profile to install it if you prefer that the updates are taken care of by Play in the profile you are running it.

[deleted]

MetropleX The problem is that the playstore and github versions are different. I have only one profile.

The playstore is supposed to use the apk signed by the developer. This is not the case since some apk don't match with the one on github.

Arnauld

MetropleX oh, so if I update an app in owner profile it also updates it in other profiles (if the app was installed from the same source, whatever it is, GitHub, f-droid, Aurora)?

MetropleX

Developers have always been recommended to use separate app ids and signing keys for each variant of their app. They were only meant to use the same ones for the same variant of the app. Developers often have differences between releases of their apps across different platforms.

Play Store now requires that all newly published apps use Play Signing and recommends for existing developers to move to Play Signing.
When using Play Signing, developers sign app bundles they upload to the Play Store and the Play Store generates and signs the apks from those.

Quoted from the project response to your tweet:
https://nitter.net/Gui80351748/status/1555816626712461313

MetropleX

Arnauld Correct also works in reverse update in secondary updates in owner.