Makussu/subtracks
1
0
Fork 0
mirror of https://github.com/austinried/subtracks.git synced 2026-11-11 07:29:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

docs: unwrap the lines in signing/README.md

Browse Source
This commit is contained in:
austinried
2026-10-08 18:52:44 +00:00
parent 368f53d589
commit 3d2ec5e931
1 changed files with 9 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
signing/README.md
+9 -27
View File
@@ -2,20 +2,10 @@
subtracks ships through four channels: subtracks ships through four channels:
- **GitHub releases** — the APK and the AAB are signed with the release key. The - **GitHub releases** — the APK and the AAB are signed with the release key. The public certificate is committed here as [`release-certificate.pem`](release-certificate.pem) and attached to each release, along with a `SHA256SUMS`.
public certificate is committed here as - **Google Play** — uses Play App Signing, so Google re-signs the app it delivers. The release key is only the *upload* key there: it signs the AAB we send to Play, not the APK users install. The installed app verifies against Google's app signing certificate (Play Console → App integrity), and the upload key only proves the AAB we uploaded.
[`release-certificate.pem`](release-certificate.pem) and attached to each - **`nightly` builds** (the `subtracks-nightly` artifact from CI) — signed with the public debug key committed here as [`nightly-certificate.pem`](nightly-certificate.pem).
release, along with a `SHA256SUMS`. - **F-Droid** — re-signed by F-Droid with its own key; see F-Droid's published signing key.
- **Google Play** — uses Play App Signing, so Google re-signs the app it
delivers. The release key is only the *upload* key there: it signs the AAB we
send to Play, not the APK users install. The installed app verifies against
Google's app signing certificate (Play Console → App integrity), and the upload
key only proves the AAB we uploaded.
- **`nightly` builds** (the `subtracks-nightly` artifact from CI) — signed with
the public debug key committed here as
[`nightly-certificate.pem`](nightly-certificate.pem).
- **F-Droid** — re-signed by F-Droid with its own key; see F-Droid's published
signing key.
## `nightly` builds ## `nightly` builds
@@ -31,19 +21,17 @@ To check a `nightly` APK:
apksigner verify --print-certs subtracks-nightly.apk apksigner verify --print-certs subtracks-nightly.apk
``` ```
The `SHA-256 digest` line must equal the fingerprint above (the certificate is The `SHA-256 digest` line must equal the fingerprint above (the certificate is committed at [`nightly-certificate.pem`](nightly-certificate.pem)).
committed at [`nightly-certificate.pem`](nightly-certificate.pem)).
## GitHub releases ## GitHub releases
The APK is signed with the release key. Certificate SHA-256: The APK and the AAB are signed with the release key. Certificate SHA-256:
``` ```
02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01 02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01
``` ```
Each release attaches the APK, the AAB, the checksums and the certificate Each release attaches the APK, the AAB, the checksums and the certificate (committed here as [`release-certificate.pem`](release-certificate.pem)):
(committed here as [`release-certificate.pem`](release-certificate.pem)):
```sh ```sh
sha256sum -c SHA256SUMS sha256sum -c SHA256SUMS
@@ -52,17 +40,11 @@ keytool -printcert -jarfile subtracks.aab # the AAB
keytool -printcert -file release-certificate.pem # prints its SHA-256 keytool -printcert -file release-certificate.pem # prints its SHA-256
``` ```
The `.aab` is the exact bundle uploaded to Google Play (install it by generating The `.aab` is the exact bundle uploaded to Google Play (install it by generating device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk` is the universal APK for sideloading. The signing certificate SHA-256 is also listed in the release notes.
device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk`
is the universal APK for sideloading. The signing certificate SHA-256 is also
listed in the release notes.
## Google Play ## Google Play
The AAB we upload is signed with the release (upload) key, and that is what Play The AAB we upload is signed with the release (upload) key, and that is what Play checks; Google then re-signs the delivered APKs with its own app signing key. So a Play-installed app is verified against Play's app signing certificate (shown in Play Console → App integrity), not `release-certificate.pem`.
checks; Google then re-signs the delivered APKs with its own app signing key. So
a Play-installed app is verified against Play's app signing certificate (shown in
Play Console → App integrity), not `release-certificate.pem`.
To check the AAB that was sent: To check the AAB that was sent: