Add SHA-256 certificate fingerprint to GitHub Releases

.github/workflows/release.yml

@@ -81,6 +81,17 @@ jobs:
           echo "apk_suffix=${SUFFIX}" >> $GITHUB_OUTPUT
         id: rename
 
+      - name: Get certificate fingerprint
+        id: cert
+        run: |
+          APK="app/build/outputs/apk/release/CompareApp-${{ steps.version.outputs.version_with_build }}-${{ steps.rename.outputs.apk_suffix }}.apk"
+          FINGERPRINT=$(keytool -printcert -jarfile "${APK}" | awk -F'SHA256: ' '/SHA256:/ {print $2; exit}')
+          if [ -z "${FINGERPRINT}" ]; then
+            echo "::error::Failed to extract the SHA-256 certificate fingerprint from ${APK}."
+            exit 1
+          fi
+          echo "sha256_fingerprint=${FINGERPRINT}" >> $GITHUB_OUTPUT
+
       - name: Create Release
         uses: softprops/action-gh-release@v3
         with:
@@ -97,6 +108,15 @@ jobs:
             ### Installation
             Download the APK file below and install it on your Android device.
 
+            ### Verify the APK signature
+            Signing certificate SHA-256 fingerprint:
+            ```
+            ${{ steps.cert.outputs.sha256_fingerprint }}
+            ```
+            Compare this against the output of `keytool -printcert -jarfile CompareApp-*.apk`
+            (or `apksigner verify --print-certs`) before installing, to confirm the APK was
+            signed with the same certificate as the currently installed app.
+
             ### Requirements
             - Android 7.0 (API 24) or higher
             - Uber app (for Uber comparison)

docs/DEPLOYMENT.md

@@ -235,6 +235,26 @@ Enter key password for <compareapp>
 
 **Output**: `release.keystore` file
 
+### Getting the SHA-256 Certificate Fingerprint
+
+Google Play Console (and other services, e.g. Digital Asset Links or OAuth client
+registration) may ask you to register your app by entering the SHA-256 fingerprint of
+its signing certificate. To get it from your keystore:
+
+```bash
+keytool -list -v -keystore release.keystore -alias compareapp
+```
+
+Look for the line starting with `SHA256:` under "Certificate fingerprints". Alternatively,
+to check the fingerprint actually embedded in a built APK:
+
+```bash
+keytool -printcert -jarfile CompareApp-<version>-signed.apk
+```
+
+Every GitHub Release built by `.github/workflows/release.yml` also prints this fingerprint
+in its release notes, so you can copy it from there instead of rebuilding locally.
+
 ### Keystore Security Best Practices
 
 1. **Backup**: Store keystore in multiple secure locations