release: publish checksums and the signing certificate

Print the artifact SHA-256 and the APK signer certificate in the release
log, attach SHA256SUMS and the public release certificate to the GitHub
release, list the APK and certificate SHA-256 in the release notes, print
the next build checksums, and commit the next build's public certificate
with verification steps in signing/README.md.
This commit is contained in:
austinried
2026-10-08 18:52:44 +00:00
parent 7f4e9703d4
commit d3373261d2
5 changed files with 103 additions and 4 deletions
+4
View File
@@ -26,6 +26,10 @@ subtracks is an open source Android client for [Subsonic-compatible](http://www.
<a href="https://github.com/austinried/subtracks/releases/"><img src=".assets/github-badge.png" width="250"/></a>
</div>
## Verifying releases
APKs are signed. Every GitHub release attaches `SHA256SUMS` and the signing certificate (`release-certificate.pem`); the `next` build key is committed. See [signing/README.md](signing/README.md) for the fingerprints and the commands to verify a download.
## Features
- **Large Libraries:** Built for very large libraries, from syncing the whole collection to playing playlists with thousands of tracks.