Is it common for the .apk released here to have different certificates?

[Unknown78]

I have obtainium to automate the updates with this regex, and disable the Include prereleases option.

^youtube-morphe-v.*-arm64-v8a\.apk$

It's been a few months with no issues, but today there is a notification from obtainium.

Error checking for updates
The downloaded APK is signed with a different certificate than the installed app. The install was skipped. [Youtube Morphe]

---

---

---

---

Build No. 260194

$ apksigner verify --print-certs youtube-morphe-v21.16.256-arm64-v8a.apk
V2 Signer: certificate DN: CN=ReVanced
V2 Signer: certificate SHA-256 digest: 637c226c67aec0cdbc6f49cd476d5247f999122606286273e16233a913a088b4
V2 Signer: certificate SHA-1 digest: cc36af8a665adc099bd421e64574a26a2ba8190a
V2 Signer: certificate MD5 digest: 526134fbafdc97ccb124d1accc53627b
WARNING: No SourceStamp signature

Build No. 260247

$ apksigner verify --print-certs youtube-morphe-v21.20.405-arm64-v8a.apk
V2 Signer: certificate DN: CN=nullcpy rvb signing key, O=nullcpy
V2 Signer: certificate SHA-256 digest: f7ebda591f43fb2c3b9258d92b791f8c46b25d4b42293e5c7f27f3cbe1bbbe5a
V2 Signer: certificate SHA-1 digest: 01d531c1b64eaafd6d66b5be19e9894b6125260c
V2 Signer: certificate MD5 digest: 3fb1200cbdd3916e82322220f69cbcbf
WARNING: No SourceStamp signature

---

The automation is broken, It can't be updated even with Install anyway.

Will there be multiple certificate changes in the future?
Is there any solution for better automation in this case?

[aashish254]

yeah this is expected, the signing key was rotated a few days ago. builds up to 260208 are signed with the old cert (CN=ReVanced, the one in your apksigner output) and builds from 260211 onward use the new maintainer cert (CN=nullcpy rvb signing key). i downloaded the apks from a few releases and compared the v2 signer certs and the switch happens exactly at 260211, and the repo's own signing notes say the rotation was announced on oct 8.

android treats a different signing cert as a different app, so an update can never install across the rotation and obtainium skipping it is the correct behavior.

in your case your installed copy already has the new cert and obtainium just pulled an older build (260194), so the fix is a one time clean reinstall. uninstall the current app, install the latest build fresh, and updates should work normally after that. just avoid mixing builds from before and after 260211 or you'll hit the same mismatch again.

[Unknown78]

What was the rationale to change the signing key in the first place?

Is this related?
248afb7

[fahim-ahmed05]

sorry! I should have posted this announcement on github.