Android Release Signing

GitHub Actions Setup (Recommended)

Push a tag to auto-build and release:

git tag v0.1.0
git push origin v0.1.0

Required GitHub secrets:

KEYSTORE_BASE64: Run base64 -w 0 android/release.keystore and paste output
KEYSTORE_PASSWORD: Your keystore password from .env

Manual Release (Local)

Generate Signing Key (First Time Only)

# Generate random passwords
STORE_PASS=$(openssl rand -base64 32)
KEY_PASS=$(openssl rand -base64 32)

# Create keystore (use fake info for CN, OU, O, L, ST, C - it's publicly visible in APKs)
keytool -genkey -v \
  -keystore android/release.keystore \
  -alias sup-release \
  -keyalg RSA \
  -keysize 4096 \
  -validity 10000 \
  -storepass "$STORE_PASS" \
  -keypass "$KEY_PASS"

# Output passwords to save to .env
echo ""
echo "Add to .env (gitignored):"
echo "KEYSTORE_FILE=./android/release.keystore"
echo "KEYSTORE_PASSWORD=$STORE_PASS"
echo "KEY_ALIAS=sup-release"
echo "KEY_PASSWORD=$KEY_PASS"

Get Certificate Fingerprint

For Obtainium/F-Droid verification:

keytool -list -v \
  -keystore android/release.keystore \
  -alias sup-release \
  | grep "SHA256:"

Save this fingerprint - users will verify it in Obtainium to ensure APK authenticity.

Build Signed Release

# Load env vars
source .env

# Build
bun run build:android

Output will be at: android/app/build/outputs/apk/release/app-release.apk

GitHub Release Process

Build signed APK: bun run build:android
Create GitHub release with tag (e.g., v0.1.0)
Upload app-release.apk
Include SHA256 hash and certificate fingerprint in release notes
Users can install via:
- Obtainium: Add repo URL, verify certificate fingerprint
- Direct: Download APK, verify SHA256, install

Obtainium Setup for Users

Install Obtainium from F-Droid
Add app: https://github.com/yourusername/sup
Verify certificate fingerprint matches published value
Auto-updates on new GitHub releases

Reproducible Builds

Dependency lockfile committed: android/gradle.lockfile

To update dependencies:

cd android
./gradlew dependencies --write-locks
git add gradle.lockfile
git commit -m "Update Android dependencies"

2.2 KiB Raw Blame History