Makussu/subtracks
1
0
Fork 0
mirror of https://github.com/austinried/subtracks.git synced 2026-11-10 15:11:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

release: attach the signed AAB to the GitHub release

Browse Source 
Publish the exact bundle sent to Play alongside the APK, cover both in
SHA256SUMS and the release notes, and document verifying the AAB.
This commit is contained in:
austinried
2026-10-08 18:52:44 +00:00
parent 3f3db71f14
commit 368f53d589
2 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+8 -5
View File
@@ -90,9 +90,10 @@ jobs:
id: checksums
run: |
cp dist/apk/release/app-release.apk subtracks.apk
sha256sum subtracks.apk > SHA256SUMS
cp dist/bundle/release/app-release.aab subtracks.aab
sha256sum subtracks.apk subtracks.aab > SHA256SUMS
echo "Artifact SHA-256:"
sha256sum dist/apk/release/app-release.apk dist/bundle/release/app-release.aab
sha256sum subtracks.apk subtracks.aab
echo "APK signature:"
certs=$(nix develop --command bash -c '"$ANDROID_HOME/build-tools/37.0.0/apksigner" verify --print-certs subtracks.apk')
printf '%s\n' "$certs"
@@ -105,11 +106,13 @@ jobs:
echo
echo '---'
echo
echo "APK SHA-256: \`$(cut -d ' ' -f1 SHA256SUMS)\`"
echo "APK SHA-256: \`$(grep 'subtracks\.apk$' SHA256SUMS | cut -d ' ' -f1)\`"
echo
echo "AAB SHA-256: \`$(grep 'subtracks\.aab$' SHA256SUMS | cut -d ' ' -f1)\`"
echo
echo "Signing certificate SHA-256: \`${{ steps.checksums.outputs.fingerprint }}\`"
echo
echo 'The signing certificate is attached as `release-certificate.pem`.'
echo 'The signing certificate is attached as `release-certificate.pem`. The `.aab` is the exact bundle uploaded to Google Play; the `.apk` is the universal APK for sideloading.'
} > release-notes.md
- name: Create GitHub release
env:
@@ -119,4 +122,4 @@ jobs:
if [ "${{ steps.stable.outputs.value }}" != "true" ]; then
args+=(--prerelease)
fi
gh release create "$GITHUB_REF_NAME" subtracks.apk SHA256SUMS dist/release-certificate.pem "${args[@]}"
gh release create "$GITHUB_REF_NAME" subtracks.apk subtracks.aab SHA256SUMS dist/release-certificate.pem "${args[@]}"
signing/README.md
+9 -5
View File
@@ -2,8 +2,8 @@
subtracks ships through four channels:
- **GitHub releases** — the APK is signed with the release key. Its public
certificate is committed here as
- **GitHub releases** — the APK and the AAB are signed with the release key. The
public certificate is committed here as
[`release-certificate.pem`](release-certificate.pem) and attached to each
release, along with a `SHA256SUMS`.
- **Google Play** — uses Play App Signing, so Google re-signs the app it
@@ -42,16 +42,20 @@ The APK is signed with the release key. Certificate SHA-256:
02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01
```
Each release attaches the APK, the checksums and the certificate (committed here
as [`release-certificate.pem`](release-certificate.pem)):
Each release attaches the APK, the AAB, the checksums and the certificate
(committed here as [`release-certificate.pem`](release-certificate.pem)):
```sh
sha256sum -c SHA256SUMS
apksigner verify --print-certs subtracks.apk # compare with the .pem
keytool -printcert -jarfile subtracks.aab # the AAB
keytool -printcert -file release-certificate.pem # prints its SHA-256
```
The signing certificate SHA-256 is also listed in the release notes.
The `.aab` is the exact bundle uploaded to Google Play (install it by generating
device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk`
is the universal APK for sideloading. The signing certificate SHA-256 is also
listed in the release notes.
## Google Play