From 368f53d58912ade408816244bc7fc02586e89d18 Mon Sep 17 00:00:00 2001
From: austinried <4966622+austinried@users.noreply.github.com>
Date: Thu, 8 Oct 2026 18:03:40 +0000
Subject: [PATCH] release: attach the signed AAB to the GitHub release

Publish the exact bundle sent to Play alongside the APK, cover both in
SHA256SUMS and the release notes, and document verifying the AAB.
---
 .github/workflows/release.yml | 13 ++++++++-----
 signing/README.md             | 14 +++++++++-----
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e8942447..28a663e9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -90,9 +90,10 @@ jobs:
         id: checksums
         run: |
           cp dist/apk/release/app-release.apk subtracks.apk
-          sha256sum subtracks.apk > SHA256SUMS
+          cp dist/bundle/release/app-release.aab subtracks.aab
+          sha256sum subtracks.apk subtracks.aab > SHA256SUMS
           echo "Artifact SHA-256:"
-          sha256sum dist/apk/release/app-release.apk dist/bundle/release/app-release.aab
+          sha256sum subtracks.apk subtracks.aab
           echo "APK signature:"
           certs=$(nix develop --command bash -c '"$ANDROID_HOME/build-tools/37.0.0/apksigner" verify --print-certs subtracks.apk')
           printf '%s\n' "$certs"
@@ -105,11 +106,13 @@ jobs:
             echo
             echo '---'
             echo
-            echo "APK SHA-256: \`$(cut -d ' ' -f1 SHA256SUMS)\`"
+            echo "APK SHA-256: \`$(grep 'subtracks\.apk$' SHA256SUMS | cut -d ' ' -f1)\`"
+            echo
+            echo "AAB SHA-256: \`$(grep 'subtracks\.aab$' SHA256SUMS | cut -d ' ' -f1)\`"
             echo
             echo "Signing certificate SHA-256: \`${{ steps.checksums.outputs.fingerprint }}\`"
             echo
-            echo 'The signing certificate is attached as `release-certificate.pem`.'
+            echo 'The signing certificate is attached as `release-certificate.pem`. The `.aab` is the exact bundle uploaded to Google Play; the `.apk` is the universal APK for sideloading.'
           } > release-notes.md
       - name: Create GitHub release
         env:
@@ -119,4 +122,4 @@ jobs:
           if [ "${{ steps.stable.outputs.value }}" != "true" ]; then
             args+=(--prerelease)
           fi
-          gh release create "$GITHUB_REF_NAME" subtracks.apk SHA256SUMS dist/release-certificate.pem "${args[@]}"
+          gh release create "$GITHUB_REF_NAME" subtracks.apk subtracks.aab SHA256SUMS dist/release-certificate.pem "${args[@]}"
diff --git a/signing/README.md b/signing/README.md
index 8d6ff947..143add76 100644
--- a/signing/README.md
+++ b/signing/README.md
@@ -2,8 +2,8 @@
 
 subtracks ships through four channels:
 
-- **GitHub releases** — the APK is signed with the release key. Its public
-  certificate is committed here as
+- **GitHub releases** — the APK and the AAB are signed with the release key. The
+  public certificate is committed here as
   [`release-certificate.pem`](release-certificate.pem) and attached to each
   release, along with a `SHA256SUMS`.
 - **Google Play** — uses Play App Signing, so Google re-signs the app it
@@ -42,16 +42,20 @@ The APK is signed with the release key. Certificate SHA-256:
 02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01
 ```
 
-Each release attaches the APK, the checksums and the certificate (committed here
-as [`release-certificate.pem`](release-certificate.pem)):
+Each release attaches the APK, the AAB, the checksums and the certificate
+(committed here as [`release-certificate.pem`](release-certificate.pem)):
 
 ```sh
 sha256sum -c SHA256SUMS
 apksigner verify --print-certs subtracks.apk              # compare with the .pem
+keytool -printcert -jarfile subtracks.aab                 # the AAB
 keytool -printcert -file release-certificate.pem          # prints its SHA-256
 ```
 
-The signing certificate SHA-256 is also listed in the release notes.
+The `.aab` is the exact bundle uploaded to Google Play (install it by generating
+device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk`
+is the universal APK for sideloading. The signing certificate SHA-256 is also
+listed in the release notes.
 
 ## Google Play