Skip to main content

Verify Signatures

FMD cryptographically signs its releases. This ensures integrity and authenticity of the compiled artifacts.

As a one-time setup, you need to obtain an authentic copy of the public keys corresponding to FMD's private signing keys. The public keys are listed at the bottom of this page.

On a high level, the steps to verify an APK are as follows (the process is similar for other artifacts):

  1. Download the attestation file and the certificate file for the fmd-android-rsa key below. Note down the published public key fingerprint.
  2. Verify the attestation. The public key fingerprint should match.
  3. Verify the APK. The public key fingerprint should match.

Verify APK​

You can verify an APK by running:

sudo apt install --no-install-recommends apksigner

apksigner verify --verbose --print-certs /path/to/app.apk

This will print the fingerprints of the certificate and the fingerprints of the public key that were used to verify the APK signature.

tip

You only need to verify the APK signature once. Usually, you would do this before the first install. Once an app is installed, Android enforces that all updates must be signed by the same key that was used to sign the original APK.

Verify F-Droid repository​

You can display the certificate fingerprint of a repository inside the F-Droid client app.

Screenshot

Screenshot of the FMD repository in the F-Droid client app

Additionally, you can include the certificate fingerprint when sharing URLs to the repository:

https://fdroid.link/#https://packages.fmd-foss.org/fdroid/repo?fingerprint=4eb0318002fae79a0e771422ff07468087e65adb23f554c119636f2f0a0746b2

Verify FMD Server​

Use the verify_server.sh script:

./verify_server.sh server.zip server.pub.der server.zip.sig

Verify attestations​

For all of the signing keys, you can verify their attestations. These prove that the keys were generated inside a Nitrokey HSM. For instructions, please see the attestation guide.

Helper commands​

tip

Note the difference between a certificate fingerprint and a public key fingerprint. The first is a hash of the entire self-signed X.509 certificate, the second is a hash of only the public key.

Android and F-Droid tooling often shows the certificate fingerprint. To link the certificate to a public key, use these helper commands.

To get the SHA-256 fingerprint of a certificate from a certificate file:

openssl x509 -in fmd-android-rsa.crt.pem -noout -sha256 -fingerprint | tr -d ':' | tr '[:upper:]' '[:lower:]'

To get the SHA-256 fingerprint of a public key from a certificate file:

openssl x509 -in fmd-android-rsa.crt.pem -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256

To get the SHA-256 fingerprint of a public key from a public key file:

openssl pkey -in fmd-android-rsa.pub.der -pubin -outform DER | openssl dgst -sha256

By computing the fingerprints from the files and comparing them against the values published below, you can verify that you have downloaded the correct public key/certificate files.

Get the files and fingerprints​

This section lists all files and fingerprints for the public keys, certificates, and attestations that you need to verify the signatures of FMD release artifacts.

FMD Android (F-Droid)​

Historically, the FMD Android APKs that are published on F-Droid have been signed by F-Droid. These signing keys are controlled and managed by F-Droid. We list their fingerprints here to provide an independent source.

  • FMD Android:
  • FMD Android edge:

FMD Android​

FMD signs FMD Android APKs and publishes them in an F-Droid-compatible repository (see below). These APKs use the following signing key. The same key is used for both FMD and FMD edge.

tip

On our test devices with GrapheneOS and LineageOS, APKs signed with an EC key installed just fine. However, we decided to use RSA anyway, since this is what all Android apps use (that we have seen in the wild), and we wanted to avoid running into potential incompatibilities with obscure Android ROMs.

FMD F-Droid Repository​

The F-Droid-compatible repository that is hosted at https://packages.fmd-foss.org/fdroid/repo/ uses the following signing key.

tip

The Nitrokey HSM does not support Ed25519.

FMD Server​

The FMD Server release ZIPs published at https://packages.fmd-foss.org/server/ use the following signing key.

tip

The APKs and the F-Droid repository use Java Keystores for signing, and that ecosystem requires certificates. (Usually, these certificates are self-signed.) The FMD Server ZIPs are signed directly with openssl and pkcs11-tool, that is why a public key is enough.