All Bugbane APKs distributed outside of Google Play — GitHub Releases (direct APK or via Obtainium) and F-Droid (which verifies our reproducible builds and ships our developer-signed APK) — are signed with the same certificate:
| Subject | C=IT, CN=Osservatorio Nessuno OdV |
| SHA-256 | 8d301b7e49106b30011fe36d869ffd313ce8115a44f4c4abdfd48f8507b42c50 |
Fingerprint in colon-separated form:
8D:30:1B:7E:49:10:6B:30:01:1F:E3:6D:86:9F:FD:31:3C:E8:11:5A:44:F4:C4:AB:DF:D4:8F:85:07:B4:2C:50
This is also the certificate pinned in the F-Droid metadata (AllowedAPKSigningKeys) for both package ids:
org.osservatorionessuno.bugbane.beta (beta)org.osservatorionessuno.bugbane (stable)Before installing an APK downloaded from GitHub Releases, check its signing certificate with apksigner from the Android SDK build-tools:
apksigner verify --print-certs bugbane-<version>.apk
The reported Signer #1 certificate SHA-256 digest must match the fingerprint above. If it does not match, do not install the APK and please contact us.
Android itself enforces this on updates: once a correctly-signed Bugbane is installed, updates signed with a different key are rejected by the OS.
Note on Google Play: builds installed from the Play Store are distributed through Google Play App Signing and are signed by a Google-managed key, so they will show a different certificate.