[INFRA]: Sign GitHub release APKs with a stable key

Ouverte
  • Quelque chose ne va pas ?
#243 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
2/5
Temps estimé
1-3 heures
Accessibilité débutants
25/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
android, dart, flutter, github-actions
Domaine
release, security

Piste de recherche

Read .github/workflows/android-release.yaml at the “Set up release signing” step and mobile/android/app/build.gradle.kts at signingConfigs. The issue says this requires maintainer access to repository secrets, so a first-time contributor cannot complete the setup independently. Done means the release uses the stable keystore without the debug-key warning and the release notes explain the one-time reinstall.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

area: infra chore

Context

The release workflow signs APKs with four secrets: ANDROID_KEYSTORE_BASE64, ANDROID_KEYSTORE_PASSWORD, ANDROID_KEY_ALIAS and ANDROID_KEY_PASSWORD. None of them is set on this repository, so every GitHub release so far was signed with a throwaway debug key. The v0.3.2 run logged:

ANDROID_KEYSTORE_BASE64 is not set; APKs are signed with a throwaway debug key and can't update each other.

Anyone who installs from GitHub Releases can't update to the next release in place: Android rejects it (INSTALL_FAILED_UPDATE_INCOMPATIBLE) and they have to uninstall, which deletes their local messages and keys. F-Droid builds are not affected (F-Droid signs them itself).

What to do

  • Create a release keystore and keep a backup somewhere safe (losing it means the same problem again).
  • Add the four repository secrets (ANDROID_KEYSTORE_BASE64 is the keystore file, base64-encoded).
  • Check that the next release run has no "throwaway debug key" warning.
  • Say in the release notes that people who installed an earlier GitHub APK need to reinstall once.

Where to look

.github/workflows/android-release.yaml (step "Set up release signing"), mobile/android/app/build.gradle.kts (signingConfigs).

Good to know

Only a maintainer can do this, since it needs repository secrets. Ideally before tagging v0.3.3.

Langage dominant
Dart
Étoiles
9
Forks
5
Merge moyen
49 min
PR mergées (30 j)
34

Préparer son environnement

  • Fournit un Dockerfile ou un fichier Docker Compose
  • Aucun modèle de pull request
  • Aucun guide de contribution

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de CommandLineCoding/Elephant

Toutes les issues de CommandLineCoding/Elephant

Issues similaires

Plus d'issues Dart

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.