Skip to content

Soft Space Play Integrity Whitelist — io.sagio.merchant

Package: io.sagio.merchant
Play Integrity GCP (Soft Space): 757874674469
As of: 2026-05-21

How we got here (full investigation): merchant-terminal-attestation-investigation.md
Chris Soft Space exchange files (~/wl): softspace-exchange-archive.md

Your Cloud HSM app signing key

Field Value
GCP project sagio-484122
KMS path projects/sagio-484122/locations/australia-southeast1/keyRings/sagio-production-ring/cryptoKeys/sagio-app-signer/cryptoKeyVersions/1
Public key (repo) apps/terminal/signing/sagio-app-signer.public.pem
HSM attestation blob Vendor proof only — not the Android cert fingerprint Soft Space needs

The .dat attestation file from Cloud HSM proves the key lives in HSM. Soft Space whitelisting uses the X.509 certificate SHA-256 of the key that signed the APK on the device, not the attestation blob and not the raw public-key (SPKI) hash.

Three different signing keys (do not mix them up)

Key Used when How to get SHA-256 for Soft Space
Debug ./gradlew assembleDebug, local dev ~/.android/debug.keystore → see script below
Play upload CI assembleRelease, Diawi APK SAGIO_KEYSTORE_* in GitHub Actions → keytool -list -v on that .jks
Play app signing (HSM) APK installed from Google Play (internal test / prod) Play Console or gcloud kms keys versions get-certificate

READY + attestation fails almost always means Chris’s APK was signed with a cert Soft Space has not whitelisted (e.g. debug APK while only HSM/production cert was sent).

Step 1 — Identify which APK Chris installed

cd apps/terminal
chmod +x scripts/print-softspace-fingerprints.sh
./scripts/print-softspace-fingerprints.sh
# Or on the exact APK file:
./scripts/print-softspace-fingerprints.sh /path/to/app-arm64-v8a-debug.apk

From a device with the same build:

adb shell pm path io.sagio.merchant
adb pull "$(adb shell pm path io.sagio.merchant | cut -d: -f2)" /tmp/sagio.apk
./scripts/print-softspace-fingerprints.sh /tmp/sagio.apk

Send Soft Space the SHA-256 from that output.

Step 2 — Play App Signing certificate (HSM key)

This is the key you exported from Cloud HSM. It signs APKs after Google Play re-signs them (not raw Diawi/CI APKs unless Play Console uses the same cert as upload).

gcloud kms keys versions get-certificate \
  --project=sagio-484122 \
  --location=australia-southeast1 \
  --keyring=sagio-production-ring \
  --key=sagio-app-signer \
  --version=1 \
  --certificate-output-file=/tmp/sagio-app-signer.crt

openssl x509 -in /tmp/sagio-app-signer.crt -noout -fingerprint -sha256
# Example output: sha256 Fingerprint=AB:CD:...

Verify the cert matches the repo public key:

openssl x509 -in /tmp/sagio-app-signer.crt -noout -pubkey \
  | diff - <(openssl pkey -pubin -in apps/terminal/signing/sagio-app-signer.public.pem -pubout)
# (no diff = match)

Cross-check Play Console → io.sagio.merchant → App signing → App signing key certificate SHA-256 must match openssl above.

SPKI reference (not a substitute for cert fingerprint):
64:90:79:B0:6F:92:10:A4:2E:48:2A:63:85:86:D2:92:24:7F:D4:71:67:5F:08:92:1D:3B:90:FC:AA:C0:61:1C

Step 3 — Email Soft Space (template)

Subject: UAT Play Integrity whitelist — io.sagio.merchant

Package name: io.sagio.merchant
Environment: UAT
Play Integrity project: 757874674469

Please whitelist the following signing certificate SHA-256 fingerprint(s):

1) [PASTE FROM apksigner/keytool ON CHRIS'S APK — primary]

Optional (if testing multiple channels):
2) Debug UAT: 8B:22:30:7E:BB:87:8E:A6:61:3B:51:44:AF:31:E7:EA:2A:99:49:AF:62:25:2C:E9:D5:02:8C:06:EB:FD:23:FD
3) Play App Signing (HSM): [PASTE FROM gcloud get-certificate OR Play Console]

MUID (FASSTAP_UNIQUE_ID): <portal MUID>
Company SSO (FASSTAP_DEVELOPER_ID): <portal SSO ID>

Please confirm when active.

Step 4 — After Soft Space confirms

  1. Chris reinstalls the same build type (or fresh install).
  2. Settings → Refresh SDK Credentials → READY.
  3. Card → Charge → should pass refreshToken() / attestation.
  4. If still failing: capture logcat (FasstapManager, statusMessage, integrity).

Fast path for UAT today (debug APK)

If Chris uses a debug APK from ./gradlew assembleDebug, whitelist this immediately (no HSM involved):

SHA-256: 8B:22:30:7E:BB:87:8E:A6:61:3B:51:44:AF:31:E7:EA:2A:99:49:AF:62:25:2C:E9:D5:02:8C:06:EB:FD:23:FD

HSM / Play App Signing cert only applies once he installs from Play (internal testing track).