diff options
| author | Danilo M. <danix@danix.xyz> | 2026-11-02 13:42:58 +0100 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-11-02 13:42:58 +0100 |
| commit | 36af7af9f646207dfe6774f91b53b5ccf8d288c2 (patch) | |
| tree | 6e183b3ef0efee27bb75fd087e2f1a8639180a69 /AGENTS.md | |
| parent | db49c998c7746812f78c6d7b8d2ae5cbb6bb25bc (diff) | |
| download | HardenedPass-36af7af9f646207dfe6774f91b53b5ccf8d288c2.tar.gz HardenedPass-36af7af9f646207dfe6774f91b53b5ccf8d288c2.zip | |
ci: sign and publish HardenedPass releases with the fork's own key
Add the fork's release keystore and its signing properties, encrypted
with openssl (aes-256-cbc, pbkdf2) as secrets/keystore.cipher and
secrets/props.cipher; the key is the ENCRYPT_KEY repository secret.
The plaintext files and the master copy never enter the repository.
Rewrite deploy_github_releases.yml for the single FOSS build: on a
vX.Y.Z tag it decrypts the signing secrets, builds the signed release
APK, removes the secrets, and creates a draft GitHub Release with
HardenedPass_<tag>.apk and its SHA-256 checksum using gh, replacing
the archived actions/create-release and upload-release-asset actions.
AGENTS.md records the certificate fingerprint and the procedure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'AGENTS.md')
| -rw-r--r-- | AGENTS.md | 17 |
1 files changed, 13 insertions, 4 deletions
@@ -143,7 +143,16 @@ Last run: 2026-11-02. ## Releases -Not set up yet. Upstream's encrypted signing keystore was removed (only upstream could decrypt -it). `deploy_github_releases.yml` needs a keystore of our own, encrypted with -`scripts/encrypt-secret.sh` into `secrets/`, and the `ENCRYPT_KEY` secret. A different signing -key means the APK cannot update over upstream's install while `applicationId` is unchanged. +Signed with the maintainer's own key (certificate `CN=HardenedPass`, SHA-256 +`72:50:16:66:9E:48:2F:9A:C3:71:DE:E8:DF:19:A2:A1:B3:4F:A7:6D:1A:F0:5B:2A:23:78:47:25:B1:B4:9C:83`). +The master copy lives outside the repo, never in it. Losing it means installed copies can never +be updated again. + +- Local: `keystore.jks` and `keystore.properties` at the repo root (gitignored, `/keystore.*`) + make `./gradlew :app:assembleRelease` produce a signed `app-release.apk`. +- CI: `secrets/keystore.cipher` and `secrets/props.cipher` are those two files encrypted with + `openssl enc -aes-256-cbc -md sha256 -pbkdf2`; the key is the `ENCRYPT_KEY` repository + secret. `scripts/signing-setup.sh` decrypts them, `signing-cleanup.sh` deletes them. +- Pushing a `vX.Y.Z` tag runs `deploy_github_releases.yml`: it builds the signed APK and creates + a draft GitHub Release with `HardenedPass_vX.Y.Z.apk` and its `.sha256`. +- Never print, log or commit the keystore password or `ENCRYPT_KEY`. |