dtourolleandClaude Opus 5
33c92e38b7
The Android job has four secrets in it -- keystore, its password, the key alias and key password -- and the repo had none of them set. That fails in the worst available way: `echo "" | base64 -d` exits 0 and writes a zero-byte file, so the keystore step goes green and the failure surfaces minutes later inside gradle's signing task, at the tail of a ~1h20m run. Generated a 4096-bit RSA key (PKCS12, valid to 2054, alias `bikecontrol`) and uploaded all four to Gitea with `tea actions secrets create --stdin`. PKCS12 does not support a key password differing from the store password, so ANDROID_KEY_PASSWORD is deliberately the same value as ANDROID_KEYSTORE_PASSWORD rather than a second secret. The password is hex on purpose. CI writes keystore.properties through an unquoted heredoc, so the shell expands `$` and backticks, and .properties treats backslash as an escape -- hex is inert in both. Local side: android-keystore/ holds the key and its password, gitignored as a directory so the password file is covered as well as the *.jks glob. scripts/local-keystore.sh points a local build at it by writing gen/android/keystore.properties, the same file CI writes from secrets. `tauri android init` deletes that file, so the script is idempotent and meant to be re-run after any init. Verified: a local `cargo tauri android build --apk` now produces an APK that apksigner reports as CN=BikeControl, O=Tourolle, C=FR, where before it was silently debug-signed -- build.gradle.kts falls back to the debug signature when keystore.properties is absent rather than failing. The keystore is NOT recoverable if lost: Android will refuse any future update signed by a different key. It needs a backup somewhere off this machine. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
47 lines
1.2 KiB
Plaintext
47 lines
1.2 KiB
Plaintext
# Rust
|
|
/target
|
|
**/*.rs.bk
|
|
|
|
# Node
|
|
node_modules/
|
|
dist/
|
|
.vite/
|
|
|
|
# Tauri
|
|
src-tauri/target/
|
|
# All of gen/ is generated and none of it is tracked. `tauri android init`
|
|
# rebuilds gen/android from scratch, so the hand-maintained Android files — the
|
|
# manifest with the BLE permissions, MainActivity, the app gradle script,
|
|
# ProGuard rules, the theme — live in src-tauri/android/ and are copied in by
|
|
# scripts/sync-android-sources.sh after every init.
|
|
src-tauri/gen/
|
|
|
|
# src-tauri/android/ is source, but it holds a build.gradle.kts with no
|
|
# settings.gradle beside it, so any Gradle daemon that scans the tree — an IDE's,
|
|
# not the wrapper's — mistakes that directory for a project root and drops a
|
|
# cache in it. Nothing it writes is ours.
|
|
src-tauri/android/**/.gradle/
|
|
|
|
# Android signing material. A keystore in the repo is a signing key given away;
|
|
# CI writes both of these from secrets.
|
|
*.jks
|
|
*.keystore
|
|
src-tauri/android/keystore.properties
|
|
# The whole directory, so the password kept beside the key is covered too.
|
|
android-keystore/
|
|
|
|
# Editors / OS
|
|
.DS_Store
|
|
*.swp
|
|
|
|
# Ride data
|
|
*.fit
|
|
/rides/
|
|
|
|
# Arch packaging (makepkg work dirs + built packages)
|
|
/packaging/arch/pkg/
|
|
/packaging/arch/src/
|
|
/packaging/arch/*.pkg.tar.zst
|
|
/.cargo-arch/
|
|
bikecontrol.log
|