Skip to content

docs: state the required APK signing key format #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmgilman merged 1 commit into from
Aug 26, 2026
Merged

docs: state the required APK signing key format #71

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion docs/how-to/adopt-the-release-workflows.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,11 +193,23 @@ fails before a publisher runs.

Before setting `sign-native-packages: true`, add:

- `RPM_SIGNING_KEY`: base64-encoded OpenPGP private key;
- `RPM_SIGNING_KEY`: base64-encoded armored OpenPGP private key;
- `RPM_SIGNING_PASSPHRASE`;
- `APK_SIGNING_KEY`: base64-encoded RSA private key; and
- `APK_SIGNING_PASSPHRASE`.

The APK key must be a traditional PKCS#1 PEM (`BEGIN RSA PRIVATE KEY`),
optionally encrypted with legacy PEM encryption (`Proc-Type: 4,ENCRYPTED`).
nFPM rejects a PKCS#8 `BEGIN ENCRYPTED PRIVATE KEY` document, which is what
`openssl genrsa -aes256` emits on OpenSSL 3. Generate a compatible encrypted
key with:

```sh
openssl genrsa -out apk-signing-plain.rsa 4096
openssl rsa -in apk-signing-plain.rsa -aes256 -traditional \
-passout file:passphrase.txt -out apk-signing.rsa
```

Map all four secrets in the `release-assets` call. Keep the `.goreleaser.yaml`
RPM and APK `key_file` expressions supplied by the example. The workflow writes
owner-only temporary key files, GoReleaser signs packages before checksums are
Expand Down
Loading