From 36af7af9f646207dfe6774f91b53b5ccf8d288c2 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Mon, 2 Nov 2026 13:42:58 +0100 Subject: ci: sign and publish HardenedPass releases with the fork's own key Add the fork's release keystore and its signing properties, encrypted with openssl (aes-256-cbc, pbkdf2) as secrets/keystore.cipher and secrets/props.cipher; the key is the ENCRYPT_KEY repository secret. The plaintext files and the master copy never enter the repository. Rewrite deploy_github_releases.yml for the single FOSS build: on a vX.Y.Z tag it decrypts the signing secrets, builds the signed release APK, removes the secrets, and creates a draft GitHub Release with HardenedPass_.apk and its SHA-256 checksum using gh, replacing the archived actions/create-release and upload-release-asset actions. AGENTS.md records the certificate fingerprint and the procedure. Co-Authored-By: Claude Opus 5.5 --- secrets/keystore.cipher | Bin 0 -> 4288 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 secrets/keystore.cipher (limited to 'secrets/keystore.cipher') diff --git a/secrets/keystore.cipher b/secrets/keystore.cipher new file mode 100644 index 00000000..999cf521 Binary files /dev/null and b/secrets/keystore.cipher differ -- cgit v1.2.3