diff options
| author | Danilo M. <danix@danix.xyz> | 2026-11-02 13:42:58 +0100 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-11-02 13:42:58 +0100 |
| commit | 36af7af9f646207dfe6774f91b53b5ccf8d288c2 (patch) | |
| tree | 6e183b3ef0efee27bb75fd087e2f1a8639180a69 /secrets | |
| parent | db49c998c7746812f78c6d7b8d2ae5cbb6bb25bc (diff) | |
| download | HardenedPass-36af7af9f646207dfe6774f91b53b5ccf8d288c2.tar.gz HardenedPass-36af7af9f646207dfe6774f91b53b5ccf8d288c2.zip | |
ci: sign and publish HardenedPass releases with the fork's own key
Add the fork's release keystore and its signing properties, encrypted
with openssl (aes-256-cbc, pbkdf2) as secrets/keystore.cipher and
secrets/props.cipher; the key is the ENCRYPT_KEY repository secret.
The plaintext files and the master copy never enter the repository.
Rewrite deploy_github_releases.yml for the single FOSS build: on a
vX.Y.Z tag it decrypts the signing secrets, builds the signed release
APK, removes the secrets, and creates a draft GitHub Release with
HardenedPass_<tag>.apk and its SHA-256 checksum using gh, replacing
the archived actions/create-release and upload-release-asset actions.
AGENTS.md records the certificate fingerprint and the procedure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'secrets')
| -rw-r--r-- | secrets/keystore.cipher | bin | 0 -> 4288 bytes |
| -rw-r--r-- | secrets/props.cipher | bin | 0 -> 176 bytes |
2 files changed, 0 insertions, 0 deletions
diff --git a/secrets/keystore.cipher b/secrets/keystore.cipher Binary files differnew file mode 100644 index 00000000..999cf521 --- /dev/null +++ b/secrets/keystore.cipher diff --git a/secrets/props.cipher b/secrets/props.cipher Binary files differnew file mode 100644 index 00000000..4afdd22b --- /dev/null +++ b/secrets/props.cipher |