Has the packageName changed?

[IzzySoft]

While it was com.m3u.androidApp before, APKs at v1.15.0 now identify as com.m3u.smartphone – which makes our updater reject them as the package name does not match (err, while the versionCode remained identical? Oops…) Further, there's an additional "lite" variant now.

There's no clue in the release notes, nor is in the Readme. May I kindly ask how this should be handled now for IzzyOnDroid (and probably F-Droid as well)?

[oxyroid]

Yes we changed it. I think the previous package name is not very good, and now the codes for mobile phones and TVs are split into two packages. I assigned two package names to them respectively, and changed the signatures uniformly.

[oxyroid]

Do you need me to do anything on fdroid and lzzyOnDroid?

[IzzySoft]

A different packageName means it's a different app. Those already using one of the previous releases won't get update notifications, and there's no mechanism on our end to notify them they have to switch. Maybe this cannot be avoided in this case (as you had to split the package) – I just wanted you to be aware of it.

Do you need me to do anything on fdroid and lzzyOnDroid?

For IzzyOnDroid, just tell me if that's final and I initiate the move. For F-Droid, you'll need to file a new request for packaging, or open the corresponding merge requests, to bring the new app in and have update checks disabled for the original one.

and changed the signatures uniformly

So the signing key changed as well?

[oxyroid]

yes. the signing key is changed as well. My macbook air with old key is broken and I didn't backup it. 😭

[IzzySoft]

And no backup I fear? 😱 Then we have another problem here: we need to verify the key change (to rule out a hostile takeover of your Github account), see e.g. How to keep your key safe and what measures to take for the event of loss?

• your commits are not signed, so we cannot go by those
• there was no second channel of communications (e.g. email, website) set up here
• are there any of your (core) contributors having a "second channel" with you and able to confirm? Or from other projects you participate in?
• your Afdian profile unfortunately shows no timestamps either, so we cannot use that (e.g. leaving a comment there which can be deleted again after verification), as that could have been created "after key loss". Any other anchors that go back to before the last release (ouch, that would be 12/2023)?
• any other ideas?

As this also means updates cannot be applied to existing installations, maybe for starters there should be at least a release note mentioning the key change?

[IzzySoft]

"closed as not planned", hm… So what is planned now? I guess we should establish the app with the new packageName at IzzyOnDroid? And maybe you want F-Droid to do the same (though that's not in our scope at IoD, you'd need to do that there)?

[oxyroid]

@IzzySoft I don't have the time to handle issues related to a series of FOSS application markets such as fdroid until I complete the automated packaging.

But I should have a backup of the previous signature. When I am ready, I will contact you here. Before that, you don't need to do anything with the m3uandroid.

[IzzySoft]

OK, then I'll just disable updates here entirely and wait for your ping – unless you want us to remove the "old variant" from IzzyOnDroid until then (to avoid people from asking about updates etc)?