franzap on Nostr: Found out that the Android keystore used to sign the Termux apps is committed to ...
Found out that the Android keystore used to sign the Termux apps is committed to their repository.
Meaning that all updates are untrusted, or trusted to the release source - in this case their Github user.
Most apps are predictable but there are wild edge cases.
Published at
2026-09-14 19:22:24 UTCEvent JSON
{
"id": "42a28a9f1c36dffc3457026a78a79e4ef2888a30e5d577b7ff63cf50db2a65bf",
"pubkey": "726a1e261cc6474674e8285e3951b3bb139be9a773d1acf49dc868db861a1c11",
"created_at": 1789413744,
"kind": 1,
"tags": [
[
"r",
"wss://aggr.nostr.land/",
"read"
],
[
"r",
"wss://nostr.land/"
],
[
"client",
"Primal Web"
]
],
"content": "Found out that the Android keystore used to sign the Termux apps is committed to their repository.\n\nMeaning that all updates are untrusted, or trusted to the release source - in this case their Github user.\n\nMost apps are predictable but there are wild edge cases.",
"sig": "02f26bb74f1266d6f1343c6ae511fee2c78db3d1ca8775119417da43c2f97e849314d3703b9bbf3c0f98c40d494be75e0f452b93a007debd66a4b4c3b1f469ab"
}
