Signal

Links

Homepage

https://signal.org/

Android APK

https://signal.org/android/apk/

Source

https://github.com/signalapp

https://github.com/signalapp/Signal-Android

Installing Signal from an APK

I wanted to do this to avoid installing Google Play.

Steps:

• Download the official APK from https://signal.org/android/apk/ (or look at https://updates.signal.org/android/latest.json to get the location of the latest APK)
• Get apksigner. On Nix you can do this with nix-shell -p apksigner
• Verify the package using apksigner
• Install using adb

Here’s how to verify the APK. Without --min-sdk-version 24 you get warnings about JAR signing. I’ve highlighted the SHA256 digest of the signer you need to verify. (2024-09-20 note: This section needs to be updated with the newer version of apksigner.)

$ apksigner verify --verbose --print-certs --min-sdk-version 24 Signal-Android-website-prod-universal-release-7.0.2.apk
Verifies
Verified using v1 scheme (JAR signing): false
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): true
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer #1 certificate DN: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Signer #1 certificate SHA-256 digest: 29f34e5f27f211b424bc5bf9d67162c0eafba2da35af35c16416fc446276ba26
Signer #1 certificate SHA-1 digest: 45989dc9ad8728c2aa9a82fa55503e34a8879374
Signer #1 certificate MD5 digest: d90db364e32fa3a7bda4c290fb65e310
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 1024
Signer #1 public key SHA-256 digest: 75336a3cc9edb64202cd77cd4caa6396a9b5fc3c78c58660313c7098ea248a55
Signer #1 public key SHA-1 digest: b46cbed18d6fbbe42045fdb93f5032c943d80266
Signer #1 public key MD5 digest: 0f9c33bbd45db0218c86ac378067538d

Then you want to sideload as follows:

$ adb install Signal-Android-website-prod-universal-release-7.0.2.apk
Performing Streamed Install
Success

When updating this way, do something like the following:

adb install -r Signal-Android-website-prod-universal-release-7.1.3.apk

The -r here just replaces the existing app. I’m not sure if this is necessary, but I don’t want to find out by accidentally removing my data.

Updating Signal desktop on Nix

Signal is pretty insistent that you keep the application up-to-date. This can kind of conflict with using immutable package managers like Nix (especially if you don’t regularly rebuild the system). Here’s how to get the latest version, for my own reference:

# As root
nix-channel --update nixos
# As your normal user
nix-shell -p signal-desktop
# Within the nix-shell:
nix-env -i $(which signal-desktop)

Here’s another way:

$ nix repl -I nixpkgs=channel:nixos-24.05 "<nixpkgs>"
warning: future versions of Nix will require using `--file` to load a file
Welcome to Nix 2.18.1. Type :? for help.

Loading installable ''...
Added 21581 variables.
nix-repl> :i signal-desktop
:i signal-desktop
replacing old 'signal-desktop-7.24.1.drv'
installing 'signal-desktop-7.24.1.drv'

Stickers

See Signal’s support page on stickers for how to make stickers.

• Animated Signal stickers use animated WebP APNG.
• See signalstickers.org for stickers. Adding stickers also uses some sgnl://addstickers/?pack_id=xxx&pack_key=xxx protocol links. Stickers are also end-to-end encrypted, from what I understand. If you go to https://signal.art/addstickers/ and check the source code, you’ll see how it uses the Web SubtleCrypto API to decrypt stickers (which looks like it also requires protobuf).

Miscellaneous

• See Wikipedia’s Signal Protocol page about the cryptography used. I used to know a bit about how the axolotl/double ratchet worked (and how it achieves forward secrecy), but now I forget. I also have no clue how any post-quantum cryptography works.