Wave 3 (#3): chunked keystore secrets with per-chunk verification

.gitea/workflows/release.yml

@@ -74,13 +74,22 @@ jobs:
 
       - name: Restore release keystore
         env:
-          KEYSTORE_BASE64: ${{ secrets.RELEASE_KEYSTORE_BASE64 }}
+          KS1: ${{ secrets.RELEASE_KS_1 }}
+          KS2: ${{ secrets.RELEASE_KS_2 }}
+          KS3: ${{ secrets.RELEASE_KS_3 }}
+          KS4: ${{ secrets.RELEASE_KS_4 }}
           STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
           KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
           KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
         run: |
-          test -n "$KEYSTORE_BASE64" || { echo "::error::Missing RELEASE_KEYSTORE_BASE64 secret"; exit 1; }
+          test -n "$KS1" || { echo "::error::Missing RELEASE_KS_* secrets"; exit 1; }
-          echo "$KEYSTORE_BASE64" | base64 -d > android/mindlist-release.keystore
+          # Per-chunk integrity first (pinpoints a bad paste), then full hash.
+          # NB: printf, not echo — reference hashes are over raw chunk bytes.
+          printf '%s' "$KS1" | sha256sum | grep -q '^52725c9484af20ba' || { echo "::error::keystore chunk 1 mismatch"; exit 1; }
+          printf '%s' "$KS2" | sha256sum | grep -q '^9babcf38c4486686' || { echo "::error::keystore chunk 2 mismatch"; exit 1; }
+          printf '%s' "$KS3" | sha256sum | grep -q '^570b472c2ff9f449' || { echo "::error::keystore chunk 3 mismatch"; exit 1; }
+          printf '%s' "$KS4" | sha256sum | grep -q '^294b486d5531b5ae' || { echo "::error::keystore chunk 4 mismatch"; exit 1; }
+          printf '%s%s%s%s' "$KS1" "$KS2" "$KS3" "$KS4" | base64 -d > android/mindlist-release.keystore
           printf 'storeFile=../mindlist-release.keystore\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
             "$STORE_PASSWORD" "$KEY_ALIAS" "$KEY_PASSWORD" > android/keystore.properties
           echo "sdk.dir=$ANDROID_HOME" > android/local.properties