Makussu/subtracks
1
0
Fork 0
mirror of https://github.com/austinried/subtracks.git synced 2026-11-10 15:11:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

docs: drop the private Play Console references from signing/README

Browse Source
This commit is contained in:
austinried
2026-10-08 18:52:44 +00:00
parent 4f04129b0e
commit 6af43c9c16
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
signing/README.md
+3 -3
View File
@@ -3,7 +3,7 @@
subtracks ships through four channels:
- **GitHub releases** — the APK and the AAB are signed with the release key. The public certificate is committed here as [`release-certificate.pem`](release-certificate.pem) and attached to each release, along with a `SHA256SUMS`.
- **Google Play** — uses Play App Signing, so Google re-signs the app it delivers. The release key is only the *upload* key there: it signs the AAB we send to Play, not the APK users install. The installed app verifies against Google's app signing certificate (Play Console → App integrity), and the upload key only proves the AAB we uploaded.
- **Google Play** — uses Play App Signing, so Google re-signs the app it delivers. The release key is only the *upload* key there: it signs the AAB we send to Play, not the APK users install. The installed app is signed by Google's app signing key, and the upload key only proves the AAB we uploaded.
- **F-Droid** — re-signed by F-Droid with its own key; see [F-Droid's signing keys](https://f-droid.org/docs/Release_Channels_and_Signing_Keys/).
- **`nightly` builds** (the `subtracks-nightly` artifact from CI) — signed with the public debug key committed at [`app/debug.keystore`](../app/debug.keystore), whose certificate is [`nightly-certificate.pem`](nightly-certificate.pem).
@@ -12,7 +12,7 @@ subtracks ships through four channels:
The APK and the AAB are signed with the release key. Certificate SHA-256:
```
# keytool -printcert, and Play Console → App integrity (upload key)
# keytool -printcert
02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01
# apksigner verify --print-certs
02da2cb7b8214e53bdbfb455698dcb965222f91c954b5210aeac96fe329c8f01
@@ -31,7 +31,7 @@ The `.aab` is the exact bundle uploaded to Google Play (install it by generating
## Google Play
The AAB we upload is signed with the release (upload) key, and that is what Play checks; Google then re-signs the delivered APKs with its own app signing key. So a Play-installed app is verified against Play's app signing certificate (shown in Play Console → App integrity), not `release-certificate.pem`.
The AAB we upload is signed with the release (upload) key, and that is what Play checks; Google then re-signs the delivered APKs with its own app signing key. So a Play-installed app is signed by Google's key, not `release-certificate.pem`.
To check the AAB that was sent: