85 lines
2.5 KiB
Bash
Executable File
85 lines
2.5 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
umask 077
|
|
|
|
config_home=${XDG_CONFIG_HOME:-"$HOME/.config"}
|
|
SIGNING_DIR=${WNH_ANDROID_SIGNING_DIR:-"$config_home/who_need_help/android-release"}
|
|
KEYSTORE="$SIGNING_DIR/who-need-help-upload.p12"
|
|
PASSWORD_FILE="$SIGNING_DIR/who-need-help-upload.password"
|
|
KEY_ALIAS=${WNH_ANDROID_SIGNING_KEY_ALIAS:-who-need-help-upload}
|
|
KEY_IMAGE="gradle:9.6.1-jdk17@sha256:7364ce528f33bb6038672bcef990d524f1ad8fbc292935819c235db886d0fae7"
|
|
run_id="$$-$(openssl rand -hex 4)"
|
|
temporary_keystore="$SIGNING_DIR/.who-need-help-upload.$run_id.p12"
|
|
temporary_password="$SIGNING_DIR/.who-need-help-upload.$run_id.password"
|
|
|
|
cleanup() {
|
|
if [ -e "$temporary_keystore" ]; then
|
|
unlink "$temporary_keystore"
|
|
fi
|
|
if [ -e "$temporary_password" ]; then
|
|
unlink "$temporary_password"
|
|
fi
|
|
}
|
|
trap cleanup EXIT HUP INT TERM
|
|
|
|
case "$KEY_ALIAS" in
|
|
''|*[!A-Za-z0-9._-]*)
|
|
echo "WNH_ANDROID_SIGNING_KEY_ALIAS must use only letters, digits, dot, underscore, and dash." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
if [ -L "$SIGNING_DIR" ]; then
|
|
echo "Refusing to use a symlink as the Android signing directory: $SIGNING_DIR" >&2
|
|
exit 1
|
|
fi
|
|
|
|
install -d -m 700 "$SIGNING_DIR"
|
|
|
|
if [ -e "$KEYSTORE" ] || [ -e "$PASSWORD_FILE" ]; then
|
|
echo "Android upload signing material already exists; nothing was overwritten:" >&2
|
|
echo " $KEYSTORE" >&2
|
|
echo " $PASSWORD_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
openssl rand -hex 32 >"$temporary_password"
|
|
chmod 600 "$temporary_password"
|
|
|
|
docker run --rm \
|
|
--user "$(id -u):$(id -g)" \
|
|
--mount "type=bind,src=$SIGNING_DIR,dst=/secure" \
|
|
--entrypoint keytool \
|
|
"$KEY_IMAGE" \
|
|
-genkeypair \
|
|
-keystore "/secure/$(basename "$temporary_keystore")" \
|
|
-storetype PKCS12 \
|
|
-storepass:file "/secure/$(basename "$temporary_password")" \
|
|
-keypass:file "/secure/$(basename "$temporary_password")" \
|
|
-alias "$KEY_ALIAS" \
|
|
-keyalg RSA \
|
|
-keysize 2048 \
|
|
-validity 10000 \
|
|
-dname "CN=Who Need Help upload key"
|
|
|
|
docker run --rm \
|
|
--user "$(id -u):$(id -g)" \
|
|
--mount "type=bind,src=$SIGNING_DIR,dst=/secure,readonly" \
|
|
--entrypoint keytool \
|
|
"$KEY_IMAGE" \
|
|
-list \
|
|
-keystore "/secure/$(basename "$temporary_keystore")" \
|
|
-storetype PKCS12 \
|
|
-storepass:file "/secure/$(basename "$temporary_password")" \
|
|
-alias "$KEY_ALIAS" >/dev/null
|
|
|
|
chmod 600 "$temporary_keystore"
|
|
mv "$temporary_keystore" "$KEYSTORE"
|
|
mv "$temporary_password" "$PASSWORD_FILE"
|
|
|
|
echo "Generated a dedicated Android upload key without placing secrets in the repository."
|
|
echo "Private keystore: $KEYSTORE"
|
|
echo "Password file: $PASSWORD_FILE"
|
|
echo "Back up both files before the first Play Console upload."
|