diff --git a/android/PLAY.md b/android/PLAY.md index 422faa8..b6c9c84 100644 --- a/android/PLAY.md +++ b/android/PLAY.md @@ -30,12 +30,16 @@ changes that page in the same pull request; it changes the - [ ] **Play App Signing.** Google keeps the key the app is signed with for readers; this repository's four upload values (see [A release](README.md#a-release)) only prove an upload came from its owner. -- [ ] **Verified links.** Copy the SHA-256 of the app signing key from Setup, - App signing, into +- [x] **Verified links.** [`web/public/.well-known/assetlinks.json`](../web/public/.well-known/assetlinks.json) - as [Not here yet](README.md#not-here-yet) shows, merge, and let the site - deploy before the first install anyone keeps: a device that checked before the - file was right keeps its answer until the app is installed again. + names the app's three app signing keys and the upload key. Play signs a new + app with quantum-ready hybrid signing: a classical key for devices before + Android 17, and a classical and a post-quantum key together from Android 17. + Play Console shows them under Protected with Play, Play Store distribution, + Play app signing, and Android developer verification lists the same three. + If Play ever adds a key, it goes in beside them. Let the site deploy before + the first install anyone keeps: a device that checked before the file was + right keeps its answer until the app is installed again. - [ ] **The bundles.** `./gradlew :app:bundleRelease :wear:bundleRelease :automotive:bundleRelease` with the four upload values set. All three share the application ID, so each upload needs its own version code; the ranges are diff --git a/android/README.md b/android/README.md index 27536da..62d7d28 100644 --- a/android/README.md +++ b/android/README.md @@ -519,12 +519,19 @@ kilobytes. **A link opens the app only when the site says so.** The filter for `https://gridpointcode.com/play` asks Android to verify it, and Android asks the site, which answers at `/.well-known/assetlinks.json` with the app's package -name and its signing key. Until that names the key, a link does what it does -today: from Android 12 it opens in the browser unless the reader turns on the -app's links in its settings, and before that it asks. Both ends are held together by -[`audit/assetlinks.py`](../audit/assetlinks.py) in CI, because either one wrong -fails without a sound: the link opens in the browser, and the device keeps that -answer until the app is installed again. +name and the keys it may be signed with. Play signs a new app with +quantum-ready hybrid signing, so it has three app signing keys: a classical one +for devices before Android 17, and from Android 17 a classical and a +post-quantum one signing together. All three are listed, as Google's help asks, +and the upload key with them, so a release signed here and installed by hand +verifies too. A device that checked before the file named them +keeps its answer until the app is installed again; after that, `adb shell +pm get-app-links com.gridpointcode` says `verified` for `gridpointcode.com`. +Without it, from Android 12 a link opens in the browser unless the reader turns +on the app's links in its settings, and before that it asks. Both ends are held +together by [`audit/assetlinks.py`](../audit/assetlinks.py) in CI, because +either one wrong fails without a sound: the link opens in the browser, and the +device keeps that answer until the app is installed again. **What the app sends is on the site's privacy page.** Three hosts, the tile provider, this site's own files and GitHub's release downloads for a country's @@ -639,27 +646,3 @@ app's is 29, the oldest release the car's template host runs on. ## Not here yet The headset module, which waits for Jetpack XR to be stable. - -Verified links are built and wait only for the key: the app signing key Google -holds once the app is created in Play Console, under Setup, App signing. Its -SHA-256 fingerprint goes into -[`web/public/.well-known/assetlinks.json`](../web/public/.well-known/assetlinks.json), -which is an empty list until then: - -```json -[ - { - "relation": ["delegate_permission/common.handle_all_urls"], - "target": { - "namespace": "android_app", - "package_name": "com.gridpointcode", - "sha256_cert_fingerprints": ["14:6D:E9:..."] - } - } -] -``` - -A release signed with the upload key and installed by hand verifies too if that -key's fingerprint is added beside it. Once the site has deployed, a fresh -install verifies, and `adb shell pm get-app-links com.gridpointcode` says -`verified` for `gridpointcode.com`. diff --git a/web/public/.well-known/assetlinks.json b/web/public/.well-known/assetlinks.json index fe51488..cc87b21 100644 --- a/web/public/.well-known/assetlinks.json +++ b/web/public/.well-known/assetlinks.json @@ -1 +1,17 @@ -[] +[ + { + "relation": [ + "delegate_permission/common.handle_all_urls" + ], + "target": { + "namespace": "android_app", + "package_name": "com.gridpointcode", + "sha256_cert_fingerprints": [ + "81:FA:A3:B1:0D:4E:5E:A4:19:AA:06:08:8A:FB:14:79:74:35:7C:85:99:46:E5:18:AC:4A:52:A2:84:E6:BD:A9", + "F5:DF:36:39:15:5D:99:AE:3C:0F:1F:7C:4C:D1:8A:02:10:A8:D9:F1:B4:27:82:0C:C4:F4:42:43:F9:C5:00:65", + "2B:FF:F9:E7:9C:B1:D7:33:D5:98:FC:F4:BA:DA:29:58:C5:37:C6:05:F5:EF:E7:5F:61:32:B6:38:7D:05:EE:A0", + "DB:42:9E:40:51:66:72:90:AC:56:BB:99:A9:A0:0B:61:0B:85:7C:A0:7A:FB:A9:E1:75:5C:4D:B0:B0:70:A8:C5" + ] + } + } +]