Makussu/subtracks
1
0
Fork 0
mirror of https://github.com/austinried/subtracks.git synced 2026-11-10 15:11:58 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
d3373261d2263e72020820436aa2409a4908bd9c
subtracks/signing/README.md
T
austinried d3373261d2 release: publish checksums and the signing certificate 
Print the artifact SHA-256 and the APK signer certificate in the release
log, attach SHA256SUMS and the public release certificate to the GitHub
release, list the APK and certificate SHA-256 in the release notes, print
the next build checksums, and commit the next build's public certificate
with verification steps in signing/README.md.
2026-10-08 18:52:44 +00:00

1.3 KiB
Raw Blame History

Verifying a subtracks download

subtracks ships through three channels, each with its own signer:

  • GitHub releases and Google Play — signed with the release key. Every GitHub release attaches subtracks.apk, a SHA256SUMS file and the public certificate release-certificate.pem.
  • next builds (the subtracks-next artifact from CI) — signed with the public debug key committed here as next-certificate.pem.
  • F-Droid — re-signed by F-Droid with its own key; see F-Droid's published signing key.

next builds

Certificate SHA-256:

DF:31:3F:18:58:E9:AD:F4:7F:44:65:B2:80:8F:DC:E5:B9:F8:8A:48:35:DC:D0:79:95:19:61:C3:05:05:08:37

To check a next APK:

apksigner verify --print-certs subtracks-next.apk

The SHA-256 digest line must equal the fingerprint above (the certificate is committed at next-certificate.pem).

GitHub releases

Each release attaches the APK, the checksums and the certificate:

sha256sum -c SHA256SUMS
apksigner verify --print-certs subtracks.apk              # compare with the .pem
keytool -printcert -file release-certificate.pem          # prints its SHA-256

The signing certificate SHA-256 is also listed in the release notes.

Reference in New Issue View Git Blame Copy Permalink