From 2aa6920fb1568249d2466fa1b13760d1a51c0e8f Mon Sep 17 00:00:00 2001 From: Lena Date: Wed, 1 Jul 2026 00:00:00 +0000 Subject: ci: pin toolchains and verify release artifacts Checksum-pin every downloaded toolchain archive. Before publishing, verify the APK was built from HEAD, the tag matches versionName, apksigner passes, and the tree is clean; publish a sha256 sidecar and treat published assets as immutable. Compare full unsigned APKs in verify-repro and run the Android unit tests in CI. --- rsh/e2e_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'rsh') diff --git a/rsh/e2e_test.go b/rsh/e2e_test.go index 1fa80c7..88cd317 100644 --- a/rsh/e2e_test.go +++ b/rsh/e2e_test.go @@ -23,7 +23,7 @@ func TestEndToEndRealRsync(t *testing.T) { // Build the rsh binary so rsync can exec it as its remote shell. rshBin := filepath.Join(t.TempDir(), "rsh") - if out, err := exec.Command("go", "build", "-o", rshBin, ".").CombinedOutput(); err != nil { + if out, err := exec.Command("go", "build", "-buildvcs=false", "-o", rshBin, ".").CombinedOutput(); err != nil { t.Fatalf("build rsh: %v\n%s", err, out) } -- cgit v1.2.3