The Android job has four secrets in it -- keystore, its password, the key
alias and key password -- and the repo had none of them set. That fails
in the worst available way: `echo "" | base64 -d` exits 0 and writes a
zero-byte file, so the keystore step goes green and the failure surfaces
minutes later inside gradle's signing task, at the tail of a ~1h20m run.
Generated a 4096-bit RSA key (PKCS12, valid to 2054, alias `bikecontrol`)
and uploaded all four to Gitea with `tea actions secrets create --stdin`.
PKCS12 does not support a key password differing from the store password,
so ANDROID_KEY_PASSWORD is deliberately the same value as
ANDROID_KEYSTORE_PASSWORD rather than a second secret.
The password is hex on purpose. CI writes keystore.properties through an
unquoted heredoc, so the shell expands `$` and backticks, and .properties
treats backslash as an escape -- hex is inert in both.
Local side: android-keystore/ holds the key and its password, gitignored
as a directory so the password file is covered as well as the *.jks glob.
scripts/local-keystore.sh points a local build at it by writing
gen/android/keystore.properties, the same file CI writes from secrets.
`tauri android init` deletes that file, so the script is idempotent and
meant to be re-run after any init.
Verified: a local `cargo tauri android build --apk` now produces an APK
that apksigner reports as CN=BikeControl, O=Tourolle, C=FR, where before
it was silently debug-signed -- build.gradle.kts falls back to the debug
signature when keystore.properties is absent rather than failing.
The keystore is NOT recoverable if lost: Android will refuse any future
update signed by a different key. It needs a backup somewhere off this
machine.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
