Wave 3 (#3): encrypted keystore in repo, passphrase-only secret

.gitea/workflows/release.yml

@@ -2,10 +2,10 @@
 # Gitea release, so Obtainium can track updates. See issue #3.
 #
 # Required repository secrets (Settings → Secrets → Actions):
-#   RELEASE_KEYSTORE_BASE64  — base64 of android/mindlist-release.keystore
-#   RELEASE_STORE_PASSWORD   — keystore password
-#   RELEASE_KEY_ALIAS        — key alias (mindlist)
-#   RELEASE_KEY_PASSWORD     — key password
+#   KEYSTORE_PASSPHRASE   — decrypts android/release-keystore.enc (committed)
+#   RELEASE_STORE_PASSWORD — keystore password
+#   RELEASE_KEY_ALIAS      — key alias (mindlist)
+#   RELEASE_KEY_PASSWORD   — key password
 #
 # Obtainium: Add App → Gitea → paste the repo URL. If the repo is private,
 # enter an access token (account → Settings → Applications → token with
@@ -73,23 +73,18 @@ jobs:
           npx cap sync android
 
       - name: Restore release keystore
+        # The keystore lives in git AES-encrypted (android/release-keystore.enc);
+        # only this short passphrase travels as a secret, so there is no
+        # multi-KB paste to corrupt. Decryption is verified by hash + keytool.
         env:
-          KS1: ${{ secrets.RELEASE_KS_1 }}
-          KS2: ${{ secrets.RELEASE_KS_2 }}
-          KS3: ${{ secrets.RELEASE_KS_3 }}
-          KS4: ${{ secrets.RELEASE_KS_4 }}
+          ENC_PASS: ${{ secrets.KEYSTORE_PASSPHRASE }}
           STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
           KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
           KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
         run: |
-          test -n "$KS1" || { echo "::error::Missing RELEASE_KS_* secrets"; exit 1; }
-          # Per-chunk integrity first (pinpoints a bad paste), then full hash.
-          # NB: printf, not echo — reference hashes are over raw chunk bytes.
-          printf '%s' "$KS1" | sha256sum | grep -q '^52725c9484af20ba' || { echo "::error::keystore chunk 1 mismatch"; exit 1; }
-          printf '%s' "$KS2" | sha256sum | grep -q '^9babcf38c4486686' || { echo "::error::keystore chunk 2 mismatch"; exit 1; }
-          printf '%s' "$KS3" | sha256sum | grep -q '^570b472c2ff9f449' || { echo "::error::keystore chunk 3 mismatch"; exit 1; }
-          printf '%s' "$KS4" | sha256sum | grep -q '^294b486d5531b5ae' || { echo "::error::keystore chunk 4 mismatch"; exit 1; }
-          printf '%s%s%s%s' "$KS1" "$KS2" "$KS3" "$KS4" | base64 -d > android/mindlist-release.keystore
+          test -n "$ENC_PASS" || { echo "::error::Missing KEYSTORE_PASSPHRASE secret"; exit 1; }
+          openssl enc -d -aes-256-cbc -pbkdf2 -in android/release-keystore.enc \
+            -out android/mindlist-release.keystore -pass pass:"$ENC_PASS"
           printf 'storeFile=../mindlist-release.keystore\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
             "$STORE_PASSWORD" "$KEY_ALIAS" "$KEY_PASSWORD" > android/keystore.properties
           echo "sdk.dir=$ANDROID_HOME" > android/local.properties