Makussu/subtracks
1
0
Fork 0
mirror of https://github.com/austinried/subtracks.git synced 2026-11-10 15:11:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

docs: unwrap the lines in signing/README.md

Browse Source
This commit is contained in:
austinried
2026-10-08 18:52:44 +00:00
parent 368f53d589
commit 3d2ec5e931
1 changed files with 9 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
signing/README.md
+9 -27
View File
@@ -2,20 +2,10 @@
subtracks ships through four channels:
- **GitHub releases** — the APK and the AAB are signed with the release key. The
public certificate is committed here as
[`release-certificate.pem`](release-certificate.pem) and attached to each
release, along with a `SHA256SUMS`.
- **Google Play** — uses Play App Signing, so Google re-signs the app it
delivers. The release key is only the *upload* key there: it signs the AAB we
send to Play, not the APK users install. The installed app verifies against
Google's app signing certificate (Play Console → App integrity), and the upload
key only proves the AAB we uploaded.
- **`nightly` builds** (the `subtracks-nightly` artifact from CI) — signed with
the public debug key committed here as
[`nightly-certificate.pem`](nightly-certificate.pem).
- **F-Droid** — re-signed by F-Droid with its own key; see F-Droid's published
signing key.
- **GitHub releases** — the APK and the AAB are signed with the release key. The public certificate is committed here as [`release-certificate.pem`](release-certificate.pem) and attached to each release, along with a `SHA256SUMS`.
- **Google Play** — uses Play App Signing, so Google re-signs the app it delivers. The release key is only the *upload* key there: it signs the AAB we send to Play, not the APK users install. The installed app verifies against Google's app signing certificate (Play Console → App integrity), and the upload key only proves the AAB we uploaded.
- **`nightly` builds** (the `subtracks-nightly` artifact from CI) — signed with the public debug key committed here as [`nightly-certificate.pem`](nightly-certificate.pem).
- **F-Droid** — re-signed by F-Droid with its own key; see F-Droid's published signing key.
## `nightly` builds
@@ -31,19 +21,17 @@ To check a `nightly` APK:
apksigner verify --print-certs subtracks-nightly.apk
```
The `SHA-256 digest` line must equal the fingerprint above (the certificate is
committed at [`nightly-certificate.pem`](nightly-certificate.pem)).
The `SHA-256 digest` line must equal the fingerprint above (the certificate is committed at [`nightly-certificate.pem`](nightly-certificate.pem)).
## GitHub releases
The APK is signed with the release key. Certificate SHA-256:
The APK and the AAB are signed with the release key. Certificate SHA-256:
```
02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01
```
Each release attaches the APK, the AAB, the checksums and the certificate
(committed here as [`release-certificate.pem`](release-certificate.pem)):
Each release attaches the APK, the AAB, the checksums and the certificate (committed here as [`release-certificate.pem`](release-certificate.pem)):
```sh
sha256sum -c SHA256SUMS
@@ -52,17 +40,11 @@ keytool -printcert -jarfile subtracks.aab # the AAB
keytool -printcert -file release-certificate.pem # prints its SHA-256
```
The `.aab` is the exact bundle uploaded to Google Play (install it by generating
device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk`
is the universal APK for sideloading. The signing certificate SHA-256 is also
listed in the release notes.
The `.aab` is the exact bundle uploaded to Google Play (install it by generating device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk` is the universal APK for sideloading. The signing certificate SHA-256 is also listed in the release notes.
## Google Play
The AAB we upload is signed with the release (upload) key, and that is what Play
checks; Google then re-signs the delivered APKs with its own app signing key. So
a Play-installed app is verified against Play's app signing certificate (shown in
Play Console → App integrity), not `release-certificate.pem`.
The AAB we upload is signed with the release (upload) key, and that is what Play checks; Google then re-signs the delivered APKs with its own app signing key. So a Play-installed app is verified against Play's app signing certificate (shown in Play Console → App integrity), not `release-certificate.pem`.
To check the AAB that was sent: