Replying to Avatar lunaticoin

I see devs sign their apps in 2 way:

- they sign a hash of the apk, zip etc

- or thr sign directly de apk, zip etc

What is the difference? Why choosing doing an extra step and hashing it first?
Avatar
vivab0rg 2y ago 💬 3

By signing the hash it's obvious they and only they acknowledge the .apk, .zip? Am I stupid?

Reply to this note

Please Login to reply.

Discussion

Avatar
lunaticoin 2y ago

If I could rephrase my Q would be:

- if its good enough to sign the apk/zip, why signing a hash? Isnt it an extra step?

Avatar
vivab0rg 2y ago 💬 2

nostr:npub1f3fvhppwgh00u2r0kq320avr984wf6wrupm6f98m4nyqfk0s28dqq03ny6 puso la respuesta correcta AFAIK. Stupid I am.

Avatar
lunaticoin 2y ago

Esta resouesta de Santochi en X me parece interesante