Currently users have no way of verifying the authenticity of the GitHub APK if they install it. The solution for this would be to publish the APK signing hash so users can verify the authenticity using an app like AppVerifier..
Additionally, it would be beneficial to post the hash across multiple sources such as on a blog post, website or social media. This is because if the has h is available on the same place that the APK is hosted, a malicious actor who compromised the account/website where the APK is hosted can publish a malicious APK and simply change the APK hash to their malicious version.
More information available here:
https://accrescent.app/faq#verifying
https://github.com/soupslurpr/AppVerifier?tab=readme-ov-file#download
Users will have no need to verify apps if they install them from secure app stores such as Google Play Store or Accrescent so it would be beneficial to publish the APK on a secure app store such as Accrescent for people who want to avoid the Play Store. (Accrescent is currently not accepting app submission but still an app store to be aware of).
Currently users have no way of verifying the authenticity of the GitHub APK if they install it. The solution for this would be to publish the APK signing hash so users can verify the authenticity using an app like AppVerifier..
Additionally, it would be beneficial to post the hash across multiple sources such as on a blog post, website or social media. This is because if the has h is available on the same place that the APK is hosted, a malicious actor who compromised the account/website where the APK is hosted can publish a malicious APK and simply change the APK hash to their malicious version.
More information available here:
https://accrescent.app/faq#verifying
https://github.com/soupslurpr/AppVerifier?tab=readme-ov-file#download
Users will have no need to verify apps if they install them from secure app stores such as Google Play Store or Accrescent so it would be beneficial to publish the APK on a secure app store such as Accrescent for people who want to avoid the Play Store. (Accrescent is currently not accepting app submission but still an app store to be aware of).