subtracks/signing/README.md

Verifying a subtracks download

subtracks ships through four channels:

• GitHub releases — the APK and the AAB are signed with the release key. The public certificate is committed here as release-certificate.pem and attached to each release, along with a SHA256SUMS.
• Google Play — uses Play App Signing, so Google re-signs the app it delivers. The release key is only the upload key there: it signs the AAB we send to Play, not the APK users install. The installed app verifies against Google's app signing certificate (Play Console → App integrity), and the upload key only proves the AAB we uploaded.
• F-Droid — re-signed by F-Droid with its own key; see F-Droid's signing keys.
• nightly builds (the subtracks-nightly artifact from CI) — signed with the public debug key committed at app/debug.keystore, whose certificate is nightly-certificate.pem.

Fingerprints below are written in keytool's colon-separated uppercase form. apksigner prints the same digest as lowercase hex with no colons, so compare them ignoring colons and case.

GitHub releases

The APK and the AAB are signed with the release key. Certificate SHA-256:

02:DA:2C:B7:B8:21:4E:53:BD:BF:B4:55:69:8D:CB:96:52:22:F9:1C:95:4B:52:10:AE:AC:96:FE:32:9C:8F:01

Each release attaches the APK, the AAB, the checksums and the certificate (committed here as release-certificate.pem):

sha256sum -c SHA256SUMS
apksigner verify --print-certs subtracks.apk              # compare with the .pem
keytool -printcert -jarfile subtracks.aab                 # the AAB
keytool -printcert -file release-certificate.pem          # prints its SHA-256

The .aab is the exact bundle uploaded to Google Play (install it by generating device APKs with bundletool); the .apk is the universal APK for sideloading. The signing certificate SHA-256 is also listed in the release notes.

Google Play

The AAB we upload is signed with the release (upload) key, and that is what Play checks; Google then re-signs the delivered APKs with its own app signing key. So a Play-installed app is verified against Play's app signing certificate (shown in Play Console → App integrity), not release-certificate.pem.

To check the AAB that was sent:

keytool -printcert -jarfile app-release.aab

nightly builds

The signing key is the committed app/debug.keystore (a public key: alias androiddebugkey, password android). Certificate SHA-256:

DF:31:3F:18:58:E9:AD:F4:7F:44:65:B2:80:8F:DC:E5:B9:F8:8A:48:35:DC:D0:79:95:19:61:C3:05:05:08:37

To check a nightly APK:

apksigner verify --print-certs subtracks-nightly.apk

The SHA-256 digest line must equal the fingerprint above (the certificate is committed at nightly-certificate.pem).