From 36af7af9f646207dfe6774f91b53b5ccf8d288c2 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Mon, 2 Nov 2026 13:42:58 +0100 Subject: ci: sign and publish HardenedPass releases with the fork's own key Add the fork's release keystore and its signing properties, encrypted with openssl (aes-256-cbc, pbkdf2) as secrets/keystore.cipher and secrets/props.cipher; the key is the ENCRYPT_KEY repository secret. The plaintext files and the master copy never enter the repository. Rewrite deploy_github_releases.yml for the single FOSS build: on a vX.Y.Z tag it decrypts the signing secrets, builds the signed release APK, removes the secrets, and creates a draft GitHub Release with HardenedPass_.apk and its SHA-256 checksum using gh, replacing the archived actions/create-release and upload-release-asset actions. AGENTS.md records the certificate fingerprint and the procedure. Co-Authored-By: Claude Opus 5.5 --- AGENTS.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) (limited to 'AGENTS.md') diff --git a/AGENTS.md b/AGENTS.md index 0222ad6b..887fcb2a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -143,7 +143,16 @@ Last run: 2026-11-02. ## Releases -Not set up yet. Upstream's encrypted signing keystore was removed (only upstream could decrypt -it). `deploy_github_releases.yml` needs a keystore of our own, encrypted with -`scripts/encrypt-secret.sh` into `secrets/`, and the `ENCRYPT_KEY` secret. A different signing -key means the APK cannot update over upstream's install while `applicationId` is unchanged. +Signed with the maintainer's own key (certificate `CN=HardenedPass`, SHA-256 +`72:50:16:66:9E:48:2F:9A:C3:71:DE:E8:DF:19:A2:A1:B3:4F:A7:6D:1A:F0:5B:2A:23:78:47:25:B1:B4:9C:83`). +The master copy lives outside the repo, never in it. Losing it means installed copies can never +be updated again. + +- Local: `keystore.jks` and `keystore.properties` at the repo root (gitignored, `/keystore.*`) + make `./gradlew :app:assembleRelease` produce a signed `app-release.apk`. +- CI: `secrets/keystore.cipher` and `secrets/props.cipher` are those two files encrypted with + `openssl enc -aes-256-cbc -md sha256 -pbkdf2`; the key is the `ENCRYPT_KEY` repository + secret. `scripts/signing-setup.sh` decrypts them, `signing-cleanup.sh` deletes them. +- Pushing a `vX.Y.Z` tag runs `deploy_github_releases.yml`: it builds the signed APK and creates + a draft GitHub Release with `HardenedPass_vX.Y.Z.apk` and its `.sha256`. +- Never print, log or commit the keystore password or `ENCRYPT_KEY`. -- cgit v1.2.3