Makussu/subtracks
1
0
Fork 0
mirror of https://github.com/austinried/subtracks.git synced 2026-11-11 07:29:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

release: attach the signed AAB to the GitHub release

Browse Source 
Publish the exact bundle sent to Play alongside the APK, cover both in
SHA256SUMS and the release notes, and document verifying the AAB.
This commit is contained in:
austinried
2026-10-08 18:52:44 +00:00
parent 3f3db71f14
commit 368f53d589
2 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
signing/README.md
+9 -5
View File
@@ -2,8 +2,8 @@
subtracks ships through four channels:
- **GitHub releases** — the APK is signed with the release key. Its public
certificate is committed here as
- **GitHub releases** — the APK and the AAB are signed with the release key. The
public certificate is committed here as
[`release-certificate.pem`](release-certificate.pem) and attached to each
release, along with a `SHA256SUMS`.
- **Google Play** — uses Play App Signing, so Google re-signs the app it
@@ -42,16 +42,20 @@ The APK is signed with the release key. Certificate SHA-256:
02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01
```
Each release attaches the APK, the checksums and the certificate (committed here
as [`release-certificate.pem`](release-certificate.pem)):
Each release attaches the APK, the AAB, the checksums and the certificate
(committed here as [`release-certificate.pem`](release-certificate.pem)):
```sh
sha256sum -c SHA256SUMS
apksigner verify --print-certs subtracks.apk # compare with the .pem
keytool -printcert -jarfile subtracks.aab # the AAB
keytool -printcert -file release-certificate.pem # prints its SHA-256
```
The signing certificate SHA-256 is also listed in the release notes.
The `.aab` is the exact bundle uploaded to Google Play (install it by generating
device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk`
is the universal APK for sideloading. The signing certificate SHA-256 is also
listed in the release notes.
## Google Play