nik/bitchat-android
1
0
Fork 0
mirror of https://github.com/permissionlesstech/bitchat-android.git synced 2026-11-08 08:01:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge 32d6d4eea2efcf66e3bb0b1a3f558f28f4f3f3d4 into 1f24973b06ee77492742ba522002e028f38f4381

Browse Source
This commit is contained in:
Taksh Kothari 2026-11-08 11:45:00 +05:30 committed by GitHub
commit d4850b973c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 38 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
README.md
View File

@ -12,6 +12,39 @@ This is the Android implementation of bitchat, fully protocol-compatible with th
[<img alt="Get it on Google Play" height="60" src="https://play.google.com/intl/en_us/badges/static/images/badges/en_badge_web_generic.png"/>](https://play.google.com/store/apps/details?id=com.bitchat.droid)
## Verify GitHub APKs
GitHub release APKs must match the signing-certificate SHA-256 below. This is the
certificate fingerprint, not the checksum of an APK file. It is the same pin
used by the release tooling in `gradle.properties`.
```text
com.bitchat.droid
3B:03:FA:66:A5:45:13:21:10:07:92:F5:B5:5A:7B:49:66:D5:C8:DC:10:C6:DA:A4:0A:A9:5E:A4:89:53:1B:CA
```
[Copy the verification info](docs/github-apk-verification.txt) for
[AppVerifier](https://github.com/soupslurpr/AppVerifier), which compares the
installed app's package name and signing-certificate hashes with supplied
verification info. You can also verify an APK before installation:
```sh
apksigner verify --print-certs bitchat-android-arm64.apk
```
Verification must succeed, and the reported signer certificate SHA-256 must
match the pin above (ignoring case and colon separators). Stop on a mismatch;
do not uninstall an existing app to bypass a signature conflict. Google Play
can use a different app-signing key, so this pin is specifically for **GitHub
release APKs**, not an assertion about Play-delivered APKs.
For independent authentication, obtain the expected fingerprint through a
separately trusted project channel. A fingerprint and APK downloaded from the
same compromised page are not independent evidence. This repository does not
claim that a second publication channel has been provisioned. See
[the verification guide](docs/reproducible-builds.md) for provenance, payload,
and reproducibility checks and the separate Google Play verification process.
## See it in action
<table>

2
docs/github-apk-verification.txt Normal file
View File

@ -0,0 +1,2 @@
com.bitchat.droid
3B:03:FA:66:A5:45:13:21:10:07:92:F5:B5:5A:7B:49:66:D5:C8:DC:10:C6:DA:A4:0A:A9:5E:A4:89:53:1B:CA

4
docs/maintainer-release-guide.md
View File

@ -40,7 +40,9 @@ These are four separate signing identities:
commit. It is created locally by `git tag -s`.
2. **GitHub APK signature**: lets Android install and update the APKs published
on GitHub. Use the existing GitHub release key. Its certificate SHA-256 must
match `BITCHAT_GITHUB_RELEASE_CERT_SHA256` in `gradle.properties`.
match `BITCHAT_GITHUB_RELEASE_CERT_SHA256` in `gradle.properties`. If a
deliberate key rotation changes that pin, update the README verification
block and `docs/github-apk-verification.txt` in the same change.
3. **Play upload signature**: the maintainer signs both AABs with the Play
upload key so Play will accept them.
4. **Play app signature**: Google generates device APKs and signs them with the