r11594 Nightly and some release Android apk appear to be invalid on my devices

[asl97]

Sourcing from

https://github.com/simutrans/simutrans/releases/tag/

https://sourceforge.net/projects/simutrans/files/simutrans/

The release apk seem to be invalid on my devices, POCO F3, android 13, HyperOS 1.0.2.0 and Sony Xperia L2, android 7.1.1

POCO F3

App not installed as package appears to be invalid

Sony L2

App not installed.
The package appears to be corrupt

✅simuandroid-multi-123-0-1.apk
❌simuandroid-124-0.apk
✅simutrans-124-2-2.apk
❌simuandroid-124-3.apk
❌simuandroid-nightly.apk (r11589)
❌simuandroid-nightly.apk (r11594)

I can install r11594 from the playstore with no issue though.

[Roboron]

The APKs and the Play Store releases come from the same file, but the Play Store file is signed as part of the process of submitting the the Play Store. The APKs are unsigned and that's why you can't install them (I don't know why we offer them).

[prissi]

One can install them as untrusted. The problem is that google does not allow to download my own key, it is kept only with google. They did only allow to import old keys for very very old project before 2017 or so (and with aab files). Thus, the key bound to simutrans.com is ONLY with google. Any version we compile is incompatible with the play store version, as only google has the key. We can sign them, but with our own invalid key, which only google recognizes for uploads to the play store.

One can install simutrans on customs roms without google unless I messed something up. The version are for that. Actually, that problem has everybody offering Android. (One could of course download the apk from google in all the version it is build (intel, arm, mics) and offer them. But I think that was forbidden by google.

[asl97]

One can install them as untrusted. ...
Thus, the key bound to simutrans.com is ONLY with google.
Any version we compile is incompatible with the play store version,
We can sign them, but with our own invalid key, which only google recognizes for uploads to the play store.

One can install simutrans on customs roms without google unless I messed something up. The version are for that.

Not everybody is on custom roms, the only two apk that's working for me is the latest 123.0.1 and 124.2.2

Please look into self signed release on github/sourceforge, so regular user can actually install the game.

It's fine to be incompatible, other projects usually have three versions, the play store, f-droid and github release, they have mostly the same binary just signed with different keys, users just have to update from where they download from.

[prissi]

The problem is that I cannot build an Android project on my pc. Google make this more difficult with each iteration of their Android tools and it was impossible on Windows the last time I tried. I had once set up the key signing on github. Maybe this is broken. I will delete the apk for now (and since I cannot build an aab, there will no apk from us).

I had set up a script for signing on my old, now broken PC. I will have the find out about this again.

By the way, for joining any server game, test builds are not recommended.

Finally, I really wonder where other stores get the simutrans apk if not illegally siphon it off google play store ...

[asl97]

I had once set up the key signing on github. Maybe this is broken.
...
Finally, I really wonder where other stores get the simutrans apk if not illegally siphon it off google play store

It seem this commit remove the signing and changed to upload the unsigned apk

https://github.com/simutrans/simutrans/commit/cf38d1460e85156e65a8b85c5b5ceefbe4dd9bd5#diff-3b8d5d88bb7f63c646b99ba9177a421c03c9fe7450ca24d916bf2cf54450ae6aR100

Isn't there a signed version in `/android-sdl/simutrans-android-project/simutrans/build/outputs/apk/release/`?

gradlew should output an apk signed with a cert, if one isn't provided it should generate one to use for signing.

not setting it up to use a specific cert causes issue with updating to newer version but that's a minor issue.

to properly fix this issue, you just need to sign the apk using apksigner like how the aab is currently being signed, you probably want to use a seperate cert to avoid leaking any secret.

as for the other store, it's likely they just siphon off the play store, it has the same hash and everything.

[prissi]

As I told, I failed to get Simutrans built on my PC with the stupid Android studio always interfering and breaking my command line. Roboron kindly set up the current building system, and that was when the change was needed as the old build script did no longer worked but gradle was required by google.

The aab is still signed, or else the upload to the google store would fail. That was quite an exercise to get it working. That key is apparently now no longer allowed to be used for the apk.

I am happy to get patches fixing the apk without breaking the aab upload. But since I failed to get Simutrans to built on my PC, I have only github for Android and MacOS builds.