From 3c3fe5eaac354c5fee80185970c7b76bca36c044 Mon Sep 17 00:00:00 2001 From: Taksh Date: Mon, 5 Oct 2026 16:10:55 +0530 Subject: [PATCH 1/3] Publish copyable APK certificate verification info Split the existing PR change into a smaller reviewable piece. Original change: Publish copyable GitHub APK certificate verification info --- docs/github-apk-verification.txt | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 docs/github-apk-verification.txt diff --git a/docs/github-apk-verification.txt b/docs/github-apk-verification.txt new file mode 100644 index 000000000..35586c64d --- /dev/null +++ b/docs/github-apk-verification.txt @@ -0,0 +1,2 @@ +com.bitchat.droid +3B:03:FA:66:A5:45:13:21:10:07:92:F5:B5:5A:7B:49:66:D5:C8:DC:10:C6:DA:A4:0A:A9:5E:A4:89:53:1B:CA From 63e7fe97da0b84c121d9c567961edff47d13c449 Mon Sep 17 00:00:00 2001 From: Taksh Date: Mon, 5 Oct 2026 16:10:55 +0530 Subject: [PATCH 2/3] Document certificate verification beside APK downloads Split the existing PR change into a smaller reviewable piece. Original change: Publish copyable GitHub APK certificate verification info --- README.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/README.md b/README.md index a8a66cb19..5c0dfbbe0 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,39 @@ This is the Android implementation of bitchat, fully protocol-compatible with th [Get it on Google Play](https://play.google.com/store/apps/details?id=com.bitchat.droid) +## Verify GitHub APKs + +GitHub release APKs must match the signing-certificate SHA-256 below. This is the +certificate fingerprint, not the checksum of an APK file. It is the same pin +used by the release tooling in `gradle.properties`. + +```text +com.bitchat.droid +3B:03:FA:66:A5:45:13:21:10:07:92:F5:B5:5A:7B:49:66:D5:C8:DC:10:C6:DA:A4:0A:A9:5E:A4:89:53:1B:CA +``` + +[Copy the verification info](docs/github-apk-verification.txt) for +[AppVerifier](https://github.com/soupslurpr/AppVerifier), which compares the +installed app's package name and signing-certificate hashes with supplied +verification info. You can also verify an APK before installation: + +```sh +apksigner verify --print-certs bitchat-android-arm64.apk +``` + +Verification must succeed, and the reported signer certificate SHA-256 must +match the pin above (ignoring case and colon separators). Stop on a mismatch; +do not uninstall an existing app to bypass a signature conflict. Google Play +can use a different app-signing key, so this pin is specifically for **GitHub +release APKs**, not an assertion about Play-delivered APKs. + +For independent authentication, obtain the expected fingerprint through a +separately trusted project channel. A fingerprint and APK downloaded from the +same compromised page are not independent evidence. This repository does not +claim that a second publication channel has been provisioned. See +[the verification guide](docs/reproducible-builds.md) for provenance, payload, +and reproducibility checks and the separate Google Play verification process. + ## See it in action From 32d6d4eea2efcf66e3bb0b1a3f558f28f4f3f3d4 Mon Sep 17 00:00:00 2001 From: Taksh Date: Mon, 5 Oct 2026 16:10:55 +0530 Subject: [PATCH 3/3] Keep certificate publication in the rotation checklist Split the existing PR change into a smaller reviewable piece. Original change: Publish copyable GitHub APK certificate verification info --- docs/maintainer-release-guide.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/maintainer-release-guide.md b/docs/maintainer-release-guide.md index 5bcb4742d..69a2b2554 100644 --- a/docs/maintainer-release-guide.md +++ b/docs/maintainer-release-guide.md @@ -40,7 +40,9 @@ These are four separate signing identities: commit. It is created locally by `git tag -s`. 2. **GitHub APK signature**: lets Android install and update the APKs published on GitHub. Use the existing GitHub release key. Its certificate SHA-256 must - match `BITCHAT_GITHUB_RELEASE_CERT_SHA256` in `gradle.properties`. + match `BITCHAT_GITHUB_RELEASE_CERT_SHA256` in `gradle.properties`. If a + deliberate key rotation changes that pin, update the README verification + block and `docs/github-apk-verification.txt` in the same change. 3. **Play upload signature**: the maintainer signs both AABs with the Play upload key so Play will accept them. 4. **Play app signature**: Google generates device APKs and signs them with the