Certificate hash for the GitHub version

[gdnng]

As-salamu alaikum, users need a way to verify the apk they've downloaded is genuine by verifying the signing certificate hash.

It would be very helpful to have the developer's signing certificate hash posted somewhere on this repository or somewhere else.

Then, I will submit the hash to the Verified Apps database from Privacy Guides: https://github.com/privacyguides/verified-apps

[pingu-the-penguin]

Hello,

I will link the previous issue I opened here: meypod/al-azan#162 (comment)

It would be good to publish the APK hash regardless on GitHub and the website and potentially other places such as social media if they exist.

Yes if you had already installed the app then you will not be able to update if the repo was compromised and a malicious apk was uploaded. However users who are newly installing the APK will not know whether the APK they are installing is genuine or not.

Additionally, users who have already installed the app also have no way to guarantee the authenticity of the APK and the best way to do so is compare with the APK signing hash.

And as the person who opened the issue said, the hash could then be posted in the verified apps database so all users who install this app can verify its authenticity quickly and easily.

It probably was a good idea to separate signing keys regardless though.

Great job on the rewrite, it is looking great!