Pun Butrach
34 lines
1.4 KiB
Markdown
34 lines
1.4 KiB
Markdown
# Lawnchair verification
|
|
|
|
Lawnchair apk are cryptographically signed and can be verified using two verifications system.
|
|
1. GitHub or SLSA attestations (Starting with Lawnchair 15 Beta 1)
|
|
2. SHA256 of android app certificate
|
|
|
|
## SLSA Attestation (Starting with Lawnchair 15 Beta 1)
|
|
|
|
Every release of Lawnchair with the exception of Nightly is attested and verified with SLSA provenance. This repository meet the requirements of SLSA-Level 2 compliance
|
|
|
|
> [!NOTE]
|
|
> It is possible to verify without GitHub CLI by cross-referencing check from
|
|
> [GitHub Attestation][github-attestation] with [Sigstore Rekor][sigstore-rekor]
|
|
|
|
1. Install GitHub CLI
|
|
2. Download the APK and attestation from [GitHub Attestation][github-attestation]
|
|
3. Run `gh attestation verify APK -R LawnchairLauncher/lawnchair`, replace {APK} with the
|
|
actual APK file
|
|
4. Done
|
|
|
|
## Android App Certificate
|
|
|
|
Lawnchair have two app certificates:
|
|
* Google Play:
|
|
`47:AC:92:63:1C:60:35:13:CC:8D:26:DD:9C:FF:E0:71:9A:8B:36:55:44:DC:CE:C2:09:58:24:EC:25:61:20:A7`
|
|
* Elsewhere:
|
|
`74:7C:36:45:B3:57:25:8B:2E:23:E8:51:E5:3C:96:74:7F:E0:AD:D0:07:E5:BA:2C:D9:7E:8C:85:57:2E:4D:C5`
|
|
|
|
On Android, using a verification app like [AppVerifier][3p-appverifier] can ease up the verifying process.
|
|
|
|
[github-attestation]: https://github.com/LawnchairLauncher/lawnchair/attestations
|
|
[sigstore-rekor]: https://search.sigstore.dev/
|
|
[3p-appverifier]: https://github.com/soupslurpr/AppVerifier
|