Android release checksums currently authenticate neither the checksum manifest nor its signer independently of GitHub. This adds optional armored OpenPGP signing for the final public manifest and an isolated-keyring verifier that requires a separately trusted complete primary-key fingerprint. The existing download verifier enables this check when a pin is supplied; older releases retain their current attestation path.
Addresses the tooling portions of #311 and #732 together. A checksum signature covers all APK/AAB payloads without replacing their embedded signatures or canonical-byte verification. The release guide describes publishing the public key, distributing the pin independently, and including the two new metadata assets.
Validation: 10 offline tests using temporary synthetic keys and artifacts cover successful verification, wrong pins, changed assets/manifests, extra files, duplicate/traversal entries, symlinks, existing-output protection, and short-key-ID rejection. Shell syntax and whitespace checks pass. No app, protocol, or device behavior changes.
This is a draft until maintainers designate a release key, publish its fingerprint through trusted project channels, and run the flow on a real prepared release. It does not claim either issue is fully resolved by unpublished signing metadata.
Related: #324 explicitly suggests OpenPGP as an alternative for independent release authentication. This PR supplies that optional verification path; production key designation and publishing its trusted fingerprint remain maintainer tasks.
Activity
5
chatgpt-codex-connector[bot]16d agoCodex Review Summary
This comment shows the latest Codex review activity on this pull request.
| Review | Status | Commit | Review trigger |
|---|---|---|---|
| 📝 Code Review | ✅ Completed 2026-10-14T11:22:58.320961Z | 498b7e7 | Draft marked ready |
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review" or "@codex security review".
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.
This pull request is a draft
Merging is unavailable until it is marked ready for review.
reviewed the explicit fingerprint pin, isolated verification keyring, manifest inventory and tamper tests. production signing-key provisioning and independent pin publication remain required; this pass is source review only.