From 32d6d4eea2efcf66e3bb0b1a3f558f28f4f3f3d4 Mon Sep 17 00:00:00 2001 From: Taksh Date: Mon, 5 Oct 2026 16:10:55 +0530 Subject: [PATCH] Keep certificate publication in the rotation checklist Split the existing PR change into a smaller reviewable piece. Original change: Publish copyable GitHub APK certificate verification info --- docs/maintainer-release-guide.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/maintainer-release-guide.md b/docs/maintainer-release-guide.md index 5bcb4742d..69a2b2554 100644 --- a/docs/maintainer-release-guide.md +++ b/docs/maintainer-release-guide.md @@ -40,7 +40,9 @@ These are four separate signing identities: commit. It is created locally by `git tag -s`. 2. **GitHub APK signature**: lets Android install and update the APKs published on GitHub. Use the existing GitHub release key. Its certificate SHA-256 must - match `BITCHAT_GITHUB_RELEASE_CERT_SHA256` in `gradle.properties`. + match `BITCHAT_GITHUB_RELEASE_CERT_SHA256` in `gradle.properties`. If a + deliberate key rotation changes that pin, update the README verification + block and `docs/github-apk-verification.txt` in the same change. 3. **Play upload signature**: the maintainer signs both AABs with the Play upload key so Play will accept them. 4. **Play app signature**: Google generates device APKs and signs them with the