From 3f3db71f149f1cc60c0529a8eabb15215fdefd2c Mon Sep 17 00:00:00 2001
From: austinried <4966622+austinried@users.noreply.github.com>
Date: Thu, 8 Oct 2026 18:02:42 +0000
Subject: [PATCH] docs: commit the release signing certificate and fingerprint

Add the release key's public certificate (signing/release-certificate.pem)
and its SHA-256 to signing/README.md.
---
 signing/README.md               | 15 ++++++++++++---
 signing/release-certificate.pem | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 3 deletions(-)
 create mode 100644 signing/release-certificate.pem

diff --git a/signing/README.md b/signing/README.md
index ae23706c..8d6ff947 100644
--- a/signing/README.md
+++ b/signing/README.md
@@ -2,8 +2,10 @@
 
 subtracks ships through four channels:
 
-- **GitHub releases** — the APK is signed with the release key. Every release
-  attaches the public certificate `release-certificate.pem` and a `SHA256SUMS`.
+- **GitHub releases** — the APK is signed with the release key. Its public
+  certificate is committed here as
+  [`release-certificate.pem`](release-certificate.pem) and attached to each
+  release, along with a `SHA256SUMS`.
 - **Google Play** — uses Play App Signing, so Google re-signs the app it
   delivers. The release key is only the *upload* key there: it signs the AAB we
   send to Play, not the APK users install. The installed app verifies against
@@ -34,7 +36,14 @@ committed at [`nightly-certificate.pem`](nightly-certificate.pem)).
 
 ## GitHub releases
 
-Each release attaches the APK, the checksums and the certificate:
+The APK is signed with the release key. Certificate SHA-256:
+
+```
+02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01
+```
+
+Each release attaches the APK, the checksums and the certificate (committed here
+as [`release-certificate.pem`](release-certificate.pem)):
 
 ```sh
 sha256sum -c SHA256SUMS
diff --git a/signing/release-certificate.pem b/signing/release-certificate.pem
new file mode 100644
index 00000000..cd602bff
--- /dev/null
+++ b/signing/release-certificate.pem
@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFfTCCA2WgAwIBAgIEFf1YeTANBgkqhkiG9w0BAQwFADBvMRAwDgYDVQQGEwdV
+bmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYD
+VQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRMwEQYDVQQDEwphdXN0aW5y
+aWVkMB4XDTIxMDgyMzA2MzMyMVoXDTQ5MDEwODA2MzMyMVowbzEQMA4GA1UEBhMH
+VW5rbm93bjEQMA4GA1UECBMHVW5rbm93bjEQMA4GA1UEBxMHVW5rbm93bjEQMA4G
+A1UEChMHVW5rbm93bjEQMA4GA1UECxMHVW5rbm93bjETMBEGA1UEAxMKYXVzdGlu
+cmllZDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPDxh5StdFjO/79y
+87/RbFoZ2H8SLqY8WPpgrAKg/DU/T+jz/S6EPIB6houZDMPs0xo0fbXU0w5iGxGw
+FBunzHucugs/iU0HfBk+XbCJDaAzxe13b/KY1y2EuaCjRanGQRqpEXspoQwEz0GZ
+VbBci/UsPlVZzoC+hxUtwfCogdvzEAPtdHogvYgC4VXhr85FBs03H91o6hRgeJBK
+kbxo2kWrl/Xd6Gz2Lu59AKTRjXD3cu7b51u6Hx5+MSpnx8V3UWdGalTrDsDzocP1
+JRnmlHG21ivlpaphZy0xMMz3EQDuEXZaZFkPDIP6KUPP7+92d/eWnWwsrB+YGBjg
+Olu1cLekzf7zjy150GtoCVe664bwZ91RP3Ih9mjqql8tJSwZGHqoYdN+isXd7ffR
+mT/elwA5ZZMLvE/JwLCd+M8Av2QA7Vusz8bJid/Ppc/5BkdgpC7uhUq233/T6j6U
+qKFrFcNLRzrRE9Av/p+ZgQRghqDH8JcZp3FYqXDq0ldeyUM0PTzmfWgYnyg+PALx
+w9b8xGP6qVxD0fL/QGj8SoRd535UjEpjNcGdmbC6QmSWPEpnq2OLfnShucKZAeUk
+qu0u+ba2WN5TX68Tp7h7kERxwggahGSTC4pPxn0c3fo7fFOVFqMhieOlRdMZV6K3
+r4RwwZs6lxThNPljxLsAOlUI36LZAgMBAAGjITAfMB0GA1UdDgQWBBTOqOVaPyDQ
+NNd1tT+8yiSq4GWH6zANBgkqhkiG9w0BAQwFAAOCAgEAHgEtVhsFCumGoRBpjyTB
+WJ4cka0BHWgIptFzBcS5DaLY+pyOT5J1LFmDYzmF5HTQdJNv+k+i+x4MUcXgg09e
+haZGJq2t8BZVrF/ynmwbaPxa81WdKCTEQYz0B+hlaAYG+c2XwTfx9TMtJv/Tg8U0
+iSUXPlOkWzv4vL8axbBizYsegjgv/L/znQHdvmoVb9GUguP+0qNqfTSkA7SF01cj
+eWfP9JhtzxV6BlEfhialiKq6hoZzwDgye1k12zNqjvAj4IiFzDyxZafBgPMZrAC8
+XkorfRoJtCAJck/EInXDre2Aosi3uQ9GoUHylHaJlpWDje3G4e9FdBBk9voVnY0u
+EaE9orgteRukzYd6jQiVIJZl+Ol9hBJQgaL2ChrVSC2DRQaTtmsBg1D+DOU8P3q0
+/P//iAcPyAYOPj9d06Vm8JATAJg4jRiomA4CddSJ8/IHNkdSgcwkU+3mpzzbnolt
+/y0z6sPxcfLb1SGNrqevOKdfpKhxb9lhgBiro7F3uu7schkrcB8MczS/pTLzjyKd
+7o4QVEehbFEG5czMX9eb1cobiTE3cnTAMuHEfSrs+WKmHot19R54zb19d3X7eyiT
+rLzCFrqjict5aA0ckZlsmh2zRO1tNoB4YkiPvgmV/kaxg1UoK7pbgN3foMTFgjph
+CbcA2PhHua2HFcHcoAwUgFI=
+-----END CERTIFICATE-----