Makussu/subtracks
1
0
Fork 0
mirror of https://github.com/austinried/subtracks.git synced 2026-11-11 07:29:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

release: attach the signed AAB to the GitHub release

Browse Source 
Publish the exact bundle sent to Play alongside the APK, cover both in
SHA256SUMS and the release notes, and document verifying the AAB.
This commit is contained in:
austinried
2026-10-08 18:52:44 +00:00
parent 3f3db71f14
commit 368f53d589
2 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+8 -5
View File
@@ -90,9 +90,10 @@ jobs:
id: checksums id: checksums
run: | run: |
cp dist/apk/release/app-release.apk subtracks.apk cp dist/apk/release/app-release.apk subtracks.apk
sha256sum subtracks.apk > SHA256SUMS cp dist/bundle/release/app-release.aab subtracks.aab
sha256sum subtracks.apk subtracks.aab > SHA256SUMS
echo "Artifact SHA-256:" echo "Artifact SHA-256:"
sha256sum dist/apk/release/app-release.apk dist/bundle/release/app-release.aab sha256sum subtracks.apk subtracks.aab
echo "APK signature:" echo "APK signature:"
certs=$(nix develop --command bash -c '"$ANDROID_HOME/build-tools/37.0.0/apksigner" verify --print-certs subtracks.apk') certs=$(nix develop --command bash -c '"$ANDROID_HOME/build-tools/37.0.0/apksigner" verify --print-certs subtracks.apk')
printf '%s\n' "$certs" printf '%s\n' "$certs"
@@ -105,11 +106,13 @@ jobs:
echo echo
echo '---' echo '---'
echo echo
echo "APK SHA-256: \`$(cut -d ' ' -f1 SHA256SUMS)\`" echo "APK SHA-256: \`$(grep 'subtracks\.apk$' SHA256SUMS | cut -d ' ' -f1)\`"
echo
echo "AAB SHA-256: \`$(grep 'subtracks\.aab$' SHA256SUMS | cut -d ' ' -f1)\`"
echo echo
echo "Signing certificate SHA-256: \`${{ steps.checksums.outputs.fingerprint }}\`" echo "Signing certificate SHA-256: \`${{ steps.checksums.outputs.fingerprint }}\`"
echo echo
echo 'The signing certificate is attached as `release-certificate.pem`.' echo 'The signing certificate is attached as `release-certificate.pem`. The `.aab` is the exact bundle uploaded to Google Play; the `.apk` is the universal APK for sideloading.'
} > release-notes.md } > release-notes.md
- name: Create GitHub release - name: Create GitHub release
env: env:
@@ -119,4 +122,4 @@ jobs:
if [ "${{ steps.stable.outputs.value }}" != "true" ]; then if [ "${{ steps.stable.outputs.value }}" != "true" ]; then
args+=(--prerelease) args+=(--prerelease)
fi fi
gh release create "$GITHUB_REF_NAME" subtracks.apk SHA256SUMS dist/release-certificate.pem "${args[@]}" gh release create "$GITHUB_REF_NAME" subtracks.apk subtracks.aab SHA256SUMS dist/release-certificate.pem "${args[@]}"
signing/README.md
+9 -5
View File
@@ -2,8 +2,8 @@
subtracks ships through four channels: subtracks ships through four channels:
- **GitHub releases** — the APK is signed with the release key. Its public - **GitHub releases** — the APK and the AAB are signed with the release key. The
certificate is committed here as public certificate is committed here as
[`release-certificate.pem`](release-certificate.pem) and attached to each [`release-certificate.pem`](release-certificate.pem) and attached to each
release, along with a `SHA256SUMS`. release, along with a `SHA256SUMS`.
- **Google Play** — uses Play App Signing, so Google re-signs the app it - **Google Play** — uses Play App Signing, so Google re-signs the app it
@@ -42,16 +42,20 @@ The APK is signed with the release key. Certificate SHA-256:
02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01 02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01
``` ```
Each release attaches the APK, the checksums and the certificate (committed here Each release attaches the APK, the AAB, the checksums and the certificate
as [`release-certificate.pem`](release-certificate.pem)): (committed here as [`release-certificate.pem`](release-certificate.pem)):
```sh ```sh
sha256sum -c SHA256SUMS sha256sum -c SHA256SUMS
apksigner verify --print-certs subtracks.apk # compare with the .pem apksigner verify --print-certs subtracks.apk # compare with the .pem
keytool -printcert -jarfile subtracks.aab # the AAB
keytool -printcert -file release-certificate.pem # prints its SHA-256 keytool -printcert -file release-certificate.pem # prints its SHA-256
``` ```
The signing certificate SHA-256 is also listed in the release notes. The `.aab` is the exact bundle uploaded to Google Play (install it by generating
device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk`
is the universal APK for sideloading. The signing certificate SHA-256 is also
listed in the release notes.
## Google Play ## Google Play