From 9d7a807d96cfd85ad8b056aa52f5b3680cfa5af7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 3 Sep 2026 15:23:47 +0000
Subject: [PATCH] Add SHA-256 certificate fingerprint to GitHub Releases

The release workflow now extracts the signing certificate's SHA-256
fingerprint from the built APK via keytool and includes it in the
release notes, so it's easy to verify the APK signature and to copy
the value when it's needed elsewhere (e.g. registering the app with
Google Play Console).

Also documents how to retrieve the fingerprint locally from the
keystore or an APK.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018xRix1BfBRuXMh9P1rrj64
---
 .github/workflows/release.yml | 20 ++++++++++++++++++++
 docs/DEPLOYMENT.md            | 20 ++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8bff115..7e1917e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,6 +81,17 @@ jobs:
           echo "apk_suffix=${SUFFIX}" >> $GITHUB_OUTPUT
         id: rename
 
+      - name: Get certificate fingerprint
+        id: cert
+        run: |
+          APK="app/build/outputs/apk/release/CompareApp-${{ steps.version.outputs.version_with_build }}-${{ steps.rename.outputs.apk_suffix }}.apk"
+          FINGERPRINT=$(keytool -printcert -jarfile "${APK}" | awk -F'SHA256: ' '/SHA256:/ {print $2; exit}')
+          if [ -z "${FINGERPRINT}" ]; then
+            echo "::error::Failed to extract the SHA-256 certificate fingerprint from ${APK}."
+            exit 1
+          fi
+          echo "sha256_fingerprint=${FINGERPRINT}" >> $GITHUB_OUTPUT
+
       - name: Create Release
         uses: softprops/action-gh-release@v3
         with:
@@ -97,6 +108,15 @@ jobs:
             ### Installation
             Download the APK file below and install it on your Android device.
 
+            ### Verify the APK signature
+            Signing certificate SHA-256 fingerprint:
+            ```
+            ${{ steps.cert.outputs.sha256_fingerprint }}
+            ```
+            Compare this against the output of `keytool -printcert -jarfile CompareApp-*.apk`
+            (or `apksigner verify --print-certs`) before installing, to confirm the APK was
+            signed with the same certificate as the currently installed app.
+
             ### Requirements
             - Android 7.0 (API 24) or higher
             - Uber app (for Uber comparison)
diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
index bd7c9d6..d3daee0 100644
--- a/docs/DEPLOYMENT.md
+++ b/docs/DEPLOYMENT.md
@@ -235,6 +235,26 @@ Enter key password for <compareapp>
 
 **Output**: `release.keystore` file
 
+### Getting the SHA-256 Certificate Fingerprint
+
+Google Play Console (and other services, e.g. Digital Asset Links or OAuth client
+registration) may ask you to register your app by entering the SHA-256 fingerprint of
+its signing certificate. To get it from your keystore:
+
+```bash
+keytool -list -v -keystore release.keystore -alias compareapp
+```
+
+Look for the line starting with `SHA256:` under "Certificate fingerprints". Alternatively,
+to check the fingerprint actually embedded in a built APK:
+
+```bash
+keytool -printcert -jarfile CompareApp-<version>-signed.apk
+```
+
+Every GitHub Release built by `.github/workflows/release.yml` also prints this fingerprint
+in its release notes, so you can copy it from there instead of rebuilding locally.
+
 ### Keystore Security Best Practices
 
 1. **Backup**: Store keystore in multiple secure locations