From 4f9950f21ba8e2d707510a773febbfce3d3704c9 Mon Sep 17 00:00:00 2001 From: jjbrunton Date: Sun, 30 Aug 2026 18:06:42 +0100 Subject: [PATCH] feat(invite-funnel): set real Android app signing cert fingerprint Replace the assetlinks.json placeholder with the Play App Signing key SHA-256 certificate fingerprint so Android App Links for https://sauci.app/join/* can verify. Co-Authored-By: Claude Fable 5 --- apps/web/public/.well-known/assetlinks.json | 2 +- apps/web/public/.well-known/well-known.test.ts | 6 +++--- docs/couple-pairing.md | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/apps/web/public/.well-known/assetlinks.json b/apps/web/public/.well-known/assetlinks.json index b4693c1..bceffb8 100644 --- a/apps/web/public/.well-known/assetlinks.json +++ b/apps/web/public/.well-known/assetlinks.json @@ -5,7 +5,7 @@ "namespace": "android_app", "package_name": "com.sauci.app", "sha256_cert_fingerprints": [ - "PLACEHOLDER_ANDROID_RELEASE_SHA256_CERT_FINGERPRINT" + "65:2F:E7:60:3F:2E:D2:54:8B:4A:EF:0E:F1:AC:35:3E:DD:13:13:EF:35:E7:90:A7:01:1F:89:0F:4F:71:E2:21" ] } } diff --git a/apps/web/public/.well-known/well-known.test.ts b/apps/web/public/.well-known/well-known.test.ts index 28459fe..5295685 100644 --- a/apps/web/public/.well-known/well-known.test.ts +++ b/apps/web/public/.well-known/well-known.test.ts @@ -23,8 +23,8 @@ describe('assetlinks.json', () => { expect(data[0].target.package_name).toBe('com.sauci.app') expect(data[0].target.namespace).toBe('android_app') - // The real release cert fingerprint is not present in this repository; - // this placeholder must be replaced before Android App Links will verify. - expect(data[0].target.sha256_cert_fingerprints[0]).toContain('PLACEHOLDER') + // Must be the Play App Signing key certificate fingerprint (Play Console > + // Test and release > Setup > App signing), colon-separated uppercase hex. + expect(data[0].target.sha256_cert_fingerprints[0]).toMatch(/^([0-9A-F]{2}:){31}[0-9A-F]{2}$/) }) }) diff --git a/docs/couple-pairing.md b/docs/couple-pairing.md index b4e948a..74d1348 100644 --- a/docs/couple-pairing.md +++ b/docs/couple-pairing.md @@ -285,10 +285,10 @@ and `apps/web/public/.well-known/assetlinks.json` authorize `sauci.app` to open the app for `/join/*`. The Apple Team ID (`BXVPBATDZY`, from `apps/mobile/app.json` and `apps/mobile/eas.json`) and bundle/package id (`com.sauci.app`) are real values already used elsewhere in the repo. The -Android release certificate SHA-256 fingerprint in `assetlinks.json` is a -placeholder (`PLACEHOLDER_ANDROID_RELEASE_SHA256_CERT_FINGERPRINT`) and must -be replaced with the real release signing certificate fingerprint before -Android App Links will verify. +SHA-256 fingerprint in `assetlinks.json` is the Play App Signing key +certificate fingerprint from the Play Console (Test and release > Setup > +App signing); if the app signing key ever rotates, this file must be updated +or Android App Links will stop verifying. **Mobile link handling:** `apps/mobile/app.json` declares `associatedDomains: ["applinks:sauci.app"]` (iOS) and an intent filter for