diff options
| author | Lena <lena@omega> | 2026-07-01 00:00:00 +0000 |
|---|---|---|
| committer | Lena <lena@omega> | 2026-07-13 22:00:29 +0000 |
| commit | 2aa6920fb1568249d2466fa1b13760d1a51c0e8f (patch) | |
| tree | 5cd196d2017228cac43f2574d559d9a59b123a47 /README | |
| parent | 2593151ca2c67256442ad25b074504e3ecd3371f (diff) | |
| download | rsend-2aa6920fb1568249d2466fa1b13760d1a51c0e8f.tar.gz | |
ci: pin toolchains and verify release artifacts
Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.
Diffstat (limited to 'README')
| -rw-r--r-- | README | 36 |
1 files changed, 25 insertions, 11 deletions
@@ -30,21 +30,35 @@ Layout Build ----- -The repository is self-contained: clone it and the build fetches and pins -everything else from source. The only host prerequisites are a POSIX shell, -curl, python3, tar, and git. The toolchain (JDK, Go, Android SDK and NDK, -Gradle) and the rsync source are downloaded and version-pinned by the build -(see versions for every pin). +The repository is self-contained: clone it and the build fetches everything +else. The host prerequisites are a POSIX shell, coreutils, make, curl, python3, +tar, and git. The toolchain archives and rsync source are version- and +checksum-pinned by the build (see versions for every pin). make setup # provision the toolchain into $HOME/toolchains . "$HOME/toolchains/env.sh" # put it on PATH (do this in each shell) make # rsync (NDK) -> rsh (Go) -> APK - make test # Go tests plus the host-side end-to-end push - make verify-repro # build twice, diff the artifacts - -The APK lands under app/build/outputs/apk/. It is unsigned by default; signing -config is local and gitignored. Continuous integration runs the same scripts: -ci/setup-toolchain.sh then ci/build.sh and ci/test.sh. + make test # Go, real-rsync integration, and Kotlin tests + make verify-repro # build twice, compare the unsigned APKs + +`make test` also requires host rsync. The APK lands under +app/build/outputs/apk/. It is unsigned by default and cannot be installed until +signed. Continuous integration runs the same scripts: ci/setup-toolchain.sh, +ci/build.sh, and ci/test.sh. + +For a locally installable APK, create a keystore and a gitignored +keystore.properties before building: + + keytool -genkeypair -keystore rsend.jks -alias rsend -keyalg EC -validity 3650 + cat > keystore.properties <<EOF + storeFile=rsend.jks + storePassword=change-me + keyAlias=rsend + keyPassword=change-me + EOF + +Keep both files private and backed up. The signed output is +app/build/outputs/apk/release/app-release.apk. Run |