Releases and Signing

Releases and Signing

How a release is cut

Releases are built by .github/workflows/build-apk.yml:

• Triggered by pushing a tag vX.Y.Z (or a manual workflow run).
• It builds assembleRelease, signs with the permanent key, and attaches app-release.apk to a GitHub Release with auto-generated notes.

# bump versionCode/versionName in app/build.gradle.kts first, then:
git tag -a v0.5.0 -m "CoreMDM v0.5.0: <summary>"
git push origin v0.5.0

The latest release is always at https://github.com/yybam/coremdm/releases/latest.

Signing — the important part

Android only lets an app update in place if the new APK is signed with the same key as the installed one. And Google Sign-In is tied to the signing certificate's fingerprint.

• Builds before v0.3.1 were signed with a throwaway key generated per CI run — every one had a different signature, so they couldn't update over each other and Google Sign-In didn't work.
• From v0.3.1 on, every release is signed with one permanent key, stored as repo secrets:
  • RELEASE_KEYSTORE_BASE64 — the .p12 keystore, base64-encoded
  • RELEASE_KEYSTORE_PASSWORD — its password
• The signing key's SHA-1 and SHA-256 are registered in Firebase (Project settings → your Android app → fingerprints) so Google Sign-In works.

app/build.gradle.kts uses the CI key when RELEASE_KEYSTORE_FILE is present, else falls back to the Android debug keystore (local builds).

Consequences

• Updating from v0.3.1+ → newer: installs straight over the top. ✅
• Moving from a pre-v0.3.1 build to v0.3.1+: uninstall the old app first (one time).

Protect the key

Whoever owns the project must back up the permanent keystore and its password securely. If the key is lost, you can never ship an update that installs over existing installs — users would have to uninstall and reinstall.

Version numbers

• App version (versionCode/versionName in app/build.gradle.kts) must increase each release so phones accept the update. Current: 40 / 40.0.
• Release tag (vX.Y.Z) is the GitHub release name.

Release history

See the Releases page and the table in the repo README. Current: v0.4.2.