By publishing the hash, users downloading the android .apk for github can verify using AppVerifier app or manually through apksigner verify --print-certs <path_to_apk> command that the .apk app has not been tampered with and is exactly the same as the developer published. Increases security + helps maintain integrity.
A lot of developers releasing their apps on GitHub does so. Few of them are as follows - Brave Browser, LocalSend, ImageToolBox, Ente Photos, Ente Auth, Ente Locker, Fossify File Manager and all their apps, Aves Gallery, Mullvad VPN, etc..
The hash can be published on both repo’s readme on github where the apk is hosted as well as obsidian website. Publishing on website also mitigates a “theoretically risk” in case an attacker gains access to github repo, it can’t change the hash published on the website, even if they tamper with .apk + change the hash according on github repo, they can’t change the hash published on website.
Hi, can you please escalate this to the devs. It seems they haven’t noticed this issue yet. Plus on github, obsidianmd/obsidian-releases there is no option to file an issue.
Thanks, does that mean, it’s been worked on?
Honestly, there is just 10 lines of PR to be submitted for this issue to be closed.
Here is even a template for you to get this merged quickly, as friction-less as possible. Just edit the hash lines and add this in github readme https://github.com/obsidianmd/obsidian-releases
## Certificate Fingerprints
- **SHA1**: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
- **SHA256**: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
To verify these fingerprints, use the following command:
```bash
apksigner verify --print-certs <path_to_apk>
The SHA256 hashsum produced by github is not the same as the App Developer’s Own Certificate Signing Key Sha-256 Hashsum, they are two very different thing.
What about Obsidian CoC? Is it about pinging in the initial post for which I acknowledged my mistake or is it about something else?
Sorry I don’t understand if they are two different things, would this feature request (not really a “feature request” per say IMO) be implemented?
Also, I read the COC, I believe you want to hint at the following, am I right?
Security concerns: If you have a security issue to report about the application, please [contact Obsidian support]( https://help.obsidian.md/resources#Contact Obsidian support).
Publishing the SHA-256 signature hash for an Android APK is a smart security practice. It allows users to verify that the APK hasn’t been tampered with and matches what the developer intended. Adding the hash to the GitHub README or a separate website helps maintain trust and integrity, especially for apps distributed outside the Play Store. This simple step can prevent malicious modifications and improve overall app security.
Obsidian is one of my favorite apps. Being able to sync my notes between my phone and computer is severly useful to me. I am in the process of switching away from google, and would really love to be able to continue using Obsidian on my phone. In addition to just wanting access Obsidian (in general) on my phone, I also want to be able to continue syncing - but if I can’t sync between my phone and computer, then I will need to consider if I should keep or cancel my subscription.
As someone who has never made a company - let a lone an app - from the outside it looks like a simple addition (e.g. 5-10 minutes). But from the responses, it seems like it’s quite a bit more complicated than that? Would you be willing to share what makes this addition complicated / not worth it to implement?
Hi, I just recently tried to check my Obsidian app via appVerifier.
I get this
md.obsidian
BD:3B:D5:2F:44:27:B5:AB:7F:80:59:D0:71:A3:5E:3D:E9:43:C6:46:54:6D:32:31:3D:A5:F1:CA:C2:54:B7:E4
I’m not entirely sure … but I don’t think the result you got from the app you used and the sha256 available for the releases of Obsidian on GitHub are the same thing …
I don’t know exactly what the first one is, but I think this is something tied to Obsidian’s own developers certificates which, if I understand correctly this feature request here, aren’t published … so not (yet) verifyable ? (as stated in this post and somewhat implied in that one)
When it comes to GitHub’s sha256, it’s the sha GitHub generates automatically when Obsidian release something on GitHub and it’s only verifyable/valid for the specific asset/file within said release …
So, if you download Obsidian’s APK (for example) directly from obsidian-releases GitHub repo on desktop, you should be able to run, in the terminal, a shasum (or some other command, depending on your setup, environment, OS/shell, etc…) to verify the integrity of that specific file you just downloaded …
Edit:
Out of curiosity, I downloaded the most recent .apk available on GitHub (1.13.8) and ran the following in my Mac’s terminal (using zsh):
% shasum -a 256 -c <<<'b97cc8c3be48cffa58ea12dee59318fa704bc40b7c643acc27e61bf38d6bae7b */Users/<user>/Downloads/Obsidian-1.13.8.apk'
And it replied:
/Users/<user>/Downloads/Obsidian-1.13.8.apk: OK
Meaning that the .apk I downloaded from GitHub is the same as the one available on GitHub, that it hasn’t been tempered with, etc… (or something along these lines, as it might be a bit more complex than that and I’m fairly uneducated on that topic )
… but I don’t think the result you got from the app you used and the sha256 available for the releases of Obsidian on GitHub are the same thing 
…