What do you mean by this? Isn’t Google’s signing key only used to verify an update for an app is actually the for correct app?
Even if Google could decompile the app, they wouldn’t have access to Signal’s servers or any encryption keys so they couldn’t read any messages.
Google requires source code to publish in the play store. Google owns a copy of the signing key. Google can rewrite your software in your name. It has been this way for years.
I don’t know what an app bundle consists of, which the page you linked says google needs, but it can’t include the source code because google has recently been paying some developers for access to their source code - https://www.techrepublic.com/article/news-google-android-code-offer/
In any case, having access to the source code will not grant access to encryption keys or allow anyone to decrypt messages. After all Signal is already open source so anyone can use the Signal protocol for encrypting messages, which is exactly what WhatsApp does.
Paying for access means licensing. And your second argument is downright incorrect.
https://developer.android.com/guide/app-bundle/
I just had to check, it doesn’t require source, but just some compiler resource files, but that also doesn’t matter. Google keeps the signing keys and can read all input and also signals private keys, and the user wouldn’t know.
It says specifically, google generates the apk. That means they can shim the whole app, regardless of source code. People subject to government surveillance shouldn’t consider any app store application safe.
What do you mean by this? Isn’t Google’s signing key only used to verify an update for an app is actually the for correct app? Even if Google could decompile the app, they wouldn’t have access to Signal’s servers or any encryption keys so they couldn’t read any messages.
Google requires source code to publish in the play store. Google owns a copy of the signing key. Google can rewrite your software in your name. It has been this way for years.
I don’t know what an app bundle consists of, which the page you linked says google needs, but it can’t include the source code because google has recently been paying some developers for access to their source code - https://www.techrepublic.com/article/news-google-android-code-offer/
In any case, having access to the source code will not grant access to encryption keys or allow anyone to decrypt messages. After all Signal is already open source so anyone can use the Signal protocol for encrypting messages, which is exactly what WhatsApp does.
Paying for access means licensing. And your second argument is downright incorrect.
https://developer.android.com/guide/app-bundle/ I just had to check, it doesn’t require source, but just some compiler resource files, but that also doesn’t matter. Google keeps the signing keys and can read all input and also signals private keys, and the user wouldn’t know.
It says specifically, google generates the apk. That means they can shim the whole app, regardless of source code. People subject to government surveillance shouldn’t consider any app store application safe.