From 772ab5f563321a3617bd517ec9dcd605861ecdfd Mon Sep 17 00:00:00 2001
From: austinried <4966622+austinried@users.noreply.github.com>
Date: Thu, 8 Oct 2026 18:12:18 +0000
Subject: [PATCH] docs: note the fingerprint formats and normalize the
 release-notes one

---
 .github/workflows/release.yml | 2 +-
 signing/README.md             | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 28a663e9..0fd1636c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -97,7 +97,7 @@ jobs:
           echo "APK signature:"
           certs=$(nix develop --command bash -c '"$ANDROID_HOME/build-tools/37.0.0/apksigner" verify --print-certs subtracks.apk')
           printf '%s\n' "$certs"
-          fingerprint=$(printf '%s\n' "$certs" | sed -n 's/.*certificate SHA-256 digest: //p' | head -1)
+          fingerprint=$(printf '%s\n' "$certs" | sed -n 's/.*certificate SHA-256 digest: //p' | head -1 | tr '[:lower:]' '[:upper:]' | sed 's/\(..\)/\1:/g; s/:$//')
           echo "fingerprint=$fingerprint" >> "$GITHUB_OUTPUT"
       - name: Compose release notes
         run: |
diff --git a/signing/README.md b/signing/README.md
index 4578ddba..1cb51d9c 100644
--- a/signing/README.md
+++ b/signing/README.md
@@ -7,6 +7,8 @@ subtracks ships through four channels:
 - **F-Droid** — re-signed by F-Droid with its own key; see [F-Droid's signing keys](https://f-droid.org/docs/Release_Channels_and_Signing_Keys/).
 - **`nightly` builds** (the `subtracks-nightly` artifact from CI) — signed with the public debug key committed at [`app/debug.keystore`](../app/debug.keystore), whose certificate is [`nightly-certificate.pem`](nightly-certificate.pem).
 
+Fingerprints below are written in `keytool`'s colon-separated uppercase form. `apksigner` prints the same digest as lowercase hex with no colons, so compare them ignoring colons and case.
+
 ## GitHub releases
 
 The APK and the AAB are signed with the release key. Certificate SHA-256: