Signing key?

[WeLikeTermux]

Hey there, I'm pretty new to this world but learned that checking PGP/hash signatures is pretty important. Forgive me if I'm overlooking something, but after trying for 20 mins to find a .asc .sig or any mention of signing verification, I couldn't see one. Seems many of the cool apps don't have this, or am I just a super newb? Cheers!

[Hamza417]

The signature is listed in the Certificates screen,

[WeLikeTermux]

The signature is listed in the Certificates screen,

Where can i find that?

[Hamza417]

You can open any app page and look into Certificates signature. If you are looking for something specific, then could you elaborate the requirements to what you actually want?

[WeLikeTermux]

To be specific, I am looking for a way to verify the download is authentic - in order to ensure

a) download source not tampered with
b) download not modified during transit
c) download not corrupted
...etc

Many developers will include a sha256, pgp key, or something similar in order to easily verify the app using an android app called AppVerifier (https://github.com/soupslurpr/AppVerifier).

If it's a pgp key then OpenKeychain (https://github.com/open-keychain).

Many times such a signing key can be found bundled with the release, on a different website to compartmentalize for security, or just written on the github page.

Sorry if I wasn't specific enough initially or my question was unclear. If that exists somewhere here please link or explain as I am not finding it after searching for a long time. Thanks!

[Hamza417]

I have created a feature request issue here: #401