From 19f3a5a48e8b9fbfe3d1afe98c6885204616aeca Mon Sep 17 00:00:00 2001 From: Lukas Holzner Date: Fri, 2 Oct 2026 16:44:58 +0200 Subject: [PATCH] Wave 3 (#3): chunked keystore secrets with per-chunk verification --- .gitea/workflows/release.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 4ac61bb..9d70c69 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -74,13 +74,22 @@ jobs: - name: Restore release keystore env: - KEYSTORE_BASE64: ${{ secrets.RELEASE_KEYSTORE_BASE64 }} + KS1: ${{ secrets.RELEASE_KS_1 }} + KS2: ${{ secrets.RELEASE_KS_2 }} + KS3: ${{ secrets.RELEASE_KS_3 }} + KS4: ${{ secrets.RELEASE_KS_4 }} STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }} KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }} KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }} run: | - test -n "$KEYSTORE_BASE64" || { echo "::error::Missing RELEASE_KEYSTORE_BASE64 secret"; exit 1; } - echo "$KEYSTORE_BASE64" | base64 -d > android/mindlist-release.keystore + test -n "$KS1" || { echo "::error::Missing RELEASE_KS_* secrets"; exit 1; } + # Per-chunk integrity first (pinpoints a bad paste), then full hash. + # NB: printf, not echo — reference hashes are over raw chunk bytes. + printf '%s' "$KS1" | sha256sum | grep -q '^52725c9484af20ba' || { echo "::error::keystore chunk 1 mismatch"; exit 1; } + printf '%s' "$KS2" | sha256sum | grep -q '^9babcf38c4486686' || { echo "::error::keystore chunk 2 mismatch"; exit 1; } + printf '%s' "$KS3" | sha256sum | grep -q '^570b472c2ff9f449' || { echo "::error::keystore chunk 3 mismatch"; exit 1; } + printf '%s' "$KS4" | sha256sum | grep -q '^294b486d5531b5ae' || { echo "::error::keystore chunk 4 mismatch"; exit 1; } + printf '%s%s%s%s' "$KS1" "$KS2" "$KS3" "$KS4" | base64 -d > android/mindlist-release.keystore printf 'storeFile=../mindlist-release.keystore\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \ "$STORE_PASSWORD" "$KEY_ALIAS" "$KEY_PASSWORD" > android/keystore.properties echo "sdk.dir=$ANDROID_HOME" > android/local.properties