From 412ec169052f5febb4931ec132865effb61dc3c1 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 10 Jul 2026 20:02:35 +0000 Subject: [PATCH] docs: publish APK signing certificate SHA-256 for verification (#972) Adds a 'Verifying the APK signature' section to the README so users sideloading via Obtainium/AppVerifier/GitHub Releases can check the signing certificate of their download. The fingerprint was COMPUTED (not transcribed) from official release artifacts of the latest release, v1.12.6: - amethyst-fdroid-arm64-v8a-v1.12.6.apk https://github.com/vitorpamplona/amethyst/releases/download/v1.12.6/amethyst-fdroid-arm64-v8a-v1.12.6.apk (file SHA-256 ed95fdb39d668ad2100ca6ff90f21617537790c8db47850f36ca36f75bc7aeea, matching the GitHub release asset digest) - amethyst-googleplay-arm64-v8a-v1.12.6.apk https://github.com/vitorpamplona/amethyst/releases/download/v1.12.6/amethyst-googleplay-arm64-v8a-v1.12.6.apk (file SHA-256 dacc6db1ba14c914504c6629f8fc039de0918a2ea9d35483915b4721391c3b19, matching the GitHub release asset digest) Extracted with 'apksigner verify --print-certs' (build-tools 37.0.0) and cross-checked with 'keytool -printcert -jarfile'. Both flavors are signed with the identical certificate (CN=Vitor Pamplona, O=Amethyst Labs), consistent with create-release.yml signing both flavors with the same SIGNING_KEY secret: SHA-256: c2d0aa86bcb6b62090561a41bbe336e98b78c2d0210a498dc885f28e1348cf17 Fixes #972 Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_0148shLViyE1KjFc69J6xYux --- README.md | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/README.md b/README.md index 9148b6b1be..f00faeabf3 100644 --- a/README.md +++ b/README.md @@ -56,6 +56,37 @@ _Coming soon (separate PR): Scoop (Windows), AUR (Arch Linux)._ +## Verifying the APK signature + +If you sideload Amethyst (Obtainium, GitHub Releases, Zap Store), verify that your +APK is signed by the official release key before installing. All official Amethyst +APKs — both the `googleplay` and `fdroid` flavors — are signed with the same +certificate, whose SHA-256 fingerprint is: + +``` +C2:D0:AA:86:BC:B6:B6:20:90:56:1A:41:BB:E3:36:E9:8B:78:C2:D0:21:0A:49:8D:C8:85:F2:8E:13:48:CF:17 +``` + +To check a downloaded APK yourself, run (`apksigner` ships with the Android SDK +build-tools): + +```bash +apksigner verify --print-certs amethyst-*.apk +``` + +and confirm the reported `Signer #1 certificate SHA-256 digest` is +`c2d0aa86bcb6b62090561a41bbe336e98b78c2d0210a498dc885f28e1348cf17`. +Without the Android SDK, `keytool -printcert -jarfile amethyst-*.apk` (bundled +with any JDK) prints the same SHA-256 fingerprint. + +With [AppVerifier](https://github.com/soupslurpr/appverifier), paste or share the +APK and compare against: + +``` +com.vitorpamplona.amethyst +C2:D0:AA:86:BC:B6:B6:20:90:56:1A:41:BB:E3:36:E9:8B:78:C2:D0:21:0A:49:8D:C8:85:F2:8E:13:48:CF:17 +``` + ## Supported Features