{"action":"created","issue":{"url":"https://api.github.com/repos/walleth/walleth/issues/143","repository_url":"https://api.github.com/repos/walleth/walleth","labels_url":"https://api.github.com/repos/walleth/walleth/issues/143/labels{/name}","comments_url":"https://api.github.com/repos/walleth/walleth/issues/143/comments","events_url":"https://api.github.com/repos/walleth/walleth/issues/143/events","html_url":"https://github.com/walleth/walleth/issues/143","id":283248482,"node_id":"MDU6SXNzdWUyODMyNDg0ODI=","number":143,"title":"Sign APK with TREZOR","user":{"login":"ligi","id":111600,"node_id":"MDQ6VXNlcjExMTYwMA==","avatar_url":"https://avatars2.githubusercontent.com/u/111600?v=4","gravatar_id":"","url":"https://api.github.com/users/ligi","html_url":"https://github.com/ligi","followers_url":"https://api.github.com/users/ligi/followers","following_url":"https://api.github.com/users/ligi/following{/other_user}","gists_url":"https://api.github.com/users/ligi/gists{/gist_id}","starred_url":"https://api.github.com/users/ligi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ligi/subscriptions","organizations_url":"https://api.github.com/users/ligi/orgs","repos_url":"https://api.github.com/users/ligi/repos","events_url":"https://api.github.com/users/ligi/events{/privacy}","received_events_url":"https://api.github.com/users/ligi/received_events","type":"User","site_admin":false},"labels":[{"id":612985561,"node_id":"MDU6TGFiZWw2MTI5ODU1NjE=","url":"https://api.github.com/repos/walleth/walleth/labels/Security%20:policeman:","name":"Security :policeman:","color":"b60205","default":false},{"id":723052041,"node_id":"MDU6TGFiZWw3MjMwNTIwNDE=","url":"https://api.github.com/repos/walleth/walleth/labels/bounty%20:1st_place_medal:","name":"bounty :1st_place_medal:","color":"e8b202","default":false},{"id":595818998,"node_id":"MDU6TGFiZWw1OTU4MTg5OTg=","url":"https://api.github.com/repos/walleth/walleth/labels/enhancement%20:rocket:","name":"enhancement :rocket:","color":"84b6eb","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":19,"created_at":"2017-12-19T14:27:40Z","updated_at":"2018-08-07T19:30:59Z","closed_at":null,"author_association":"MEMBER","body":"Motivation:\r\n * Hardware wallets like the TREZOR can be a great and secure way to sign APKs\r\n * Currently I am signing WallETH with an old separate offline laptop - but the process is painful (USB stick  juggling) and when I am on the road I most of the time do not have this offline laptop with me - this might be bad if e.g. a urgent HotFix is needed\r\n * Backups of signing keys are important - if you loose your key you are not able to publish an update of the app anymore - usually people do backups of their hardware wallet - so this could also be a good argument for using a HardWare wallet here\r\n * Signing keys are often not handled with the care they deserve (I have seen companies having them on the CI-Server with the potential of extracting them with a PR ..) If the process is easy with a Hardware wallet perhaps we can convince more people to treat signing keys with more respect\r\n\r\nBounty acceptance criteria:\r\n * Deliver a small CLI program that allows to sign APKs with a TREZOR\r\n * That program should be written in Kotlin or Java - I would prefer Kotlin. Limiting the languages has 2 main reasons: 1) I want to be able to give it a meaningful review 2) Make a potential future reuse in an Android app easier\r\n * Should not need modifications of the TREZOR firmware (If there are good reasons that this is needed there might be an exemption - e.g. if one would go the extra mile of supporting RSA to lower the minSDK)\r\n * Support signature scheme v1 and optionally v2 - but at least v1 so we do not have a high impact on the minSDK\r\n * support to specify a derviation path so different APKs can be signed with different keys\r\n\r\nLinks:\r\n  * here some examples of ECDSA signed apk's:\r\nhttps://android.googlesource.com/platform/cts/+/android-n-mr1-preview-1/hostsidetests/appsecurity/res/pkgsigverify?autodive=0%2F%2F\r\n * introduction of ECDSA support for signatures in Android: https://issuetracker.google.com/issues/36956587\r\n * Tweet by prusnak about the possibility of this: https://twitter.com/pavolrusnak/status/982944347418177536 \r\n * APKSigner source: https://android.googlesource.com/platform/build/+/8740e9d/tools/apksigner/core/src/com/android/apksigner/core/"},"comment":{"url":"https://api.github.com/repos/walleth/walleth/issues/comments/411174446","html_url":"https://github.com/walleth/walleth/issues/143#issuecomment-411174446","issue_url":"https://api.github.com/repos/walleth/walleth/issues/143","id":411174446,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMTE3NDQ0Ng==","user":{"login":"gitcoinbot","id":27903976,"node_id":"MDQ6VXNlcjI3OTAzOTc2","avatar_url":"https://avatars2.githubusercontent.com/u/27903976?v=4","gravatar_id":"","url":"https://api.github.com/users/gitcoinbot","html_url":"https://github.com/gitcoinbot","followers_url":"https://api.github.com/users/gitcoinbot/followers","following_url":"https://api.github.com/users/gitcoinbot/following{/other_user}","gists_url":"https://api.github.com/users/gitcoinbot/gists{/gist_id}","starred_url":"https://api.github.com/users/gitcoinbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gitcoinbot/subscriptions","organizations_url":"https://api.github.com/users/gitcoinbot/orgs","repos_url":"https://api.github.com/users/gitcoinbot/repos","events_url":"https://api.github.com/users/gitcoinbot/events{/privacy}","received_events_url":"https://api.github.com/users/gitcoinbot/received_events","type":"User","site_admin":false},"created_at":"2018-08-07T19:30:59Z","updated_at":"2018-08-07T19:30:59Z","author_association":"NONE","body":"Issue Status: 1. **Open** 2. Started 3. Submitted 4. Done \n\n<hr>\n\n__The funding of this issue was increased to 0.8 ETH (326.67 USD @ $408.33/ETH) .__\n\n \n* If you want to claim the bounty you can do so [here](https://gitcoin.co/issue/walleth/walleth/143/576)\n* Want to chip in? Add your own contribution [here](https://gitcoin.co/issue/walleth/walleth/143/576).\n* Questions? Checkout <a href='https://gitcoin.co/help'>Gitcoin Help</a> or the <a href='https://gitcoin.co/slack'>Gitcoin Slack</a>\n* $24,898.94 more funded OSS Work available on the [Gitcoin Issue Explorer](https://gitcoin.co/explorer)\n"}}
{"actor":{"display_login":"gitcoinbot"}}