From 8cab348eedb9cee42fcbe510d691e8b18420eac9 Mon Sep 17 00:00:00 2001 From: Imran Remtulla Date: Fri, 1 Nov 2024 11:24:51 -0400 Subject: [PATCH] Build online but do not sign --- .github/workflows/release.yml | 38 ++++--------------- .github/workflows/temp.yml | 71 ----------------------------------- sign.sh | 38 +++++++++++++++++++ 3 files changed, 46 insertions(+), 101 deletions(-) delete mode 100644 .github/workflows/temp.yml create mode 100755 sign.sh diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bc88098..022f8c1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,9 +6,6 @@ on: beta: type: boolean description: Is beta? - draft: - type: boolean - description: Is draft? jobs: build: @@ -27,13 +24,6 @@ jobs: id: flutter_doctor run: | flutter doctor -v - - - name: Import GPG key - id: import_pgp_key - uses: crazy-max/ghaction-import-gpg@v6 - with: - gpg_private_key: ${{ secrets.PGP_KEY_BASE64 }} - passphrase: ${{ secrets.PGP_PASSPHRASE }} - name: Check submodule id: check_submodule @@ -57,24 +47,13 @@ jobs: for file in build/app/outputs/flutter-apk/app-*normal*.apk*; do mv "$file" "${file//-normal/}"; done flutter build apk --flavor fdroid -t lib/main_fdroid.dart && flutter build apk --split-per-abi --flavor fdroid -t lib/main_fdroid.dart rm ./build/app/outputs/flutter-apk/*.sha1 + cp ./sign.sh ./build/app/outputs/flutter-apk/ ls -l ./build/app/outputs/flutter-apk/ - - - name: Sign APKs - env: - KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }} - KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }} - PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }} - run: | - echo "${KEYSTORE_BASE64}" | base64 -d > apksign.keystore - for apk in ./build/app/outputs/flutter-apk/*-release*.apk; do - unsignedFn=${apk/-release/-unsigned} - mv "$apk" "$unsignedFn" - ${ANDROID_HOME}/build-tools/$(ls ${ANDROID_HOME}/build-tools/ | tail -1)/apksigner sign --ks apksign.keystore --ks-pass pass:"${KEYSTORE_PASSWORD}" --out "${apk}" "${unsignedFn}" - sha256sum ${apk} | cut -d " " -f 1 > "$apk".sha256 - gpg --batch --pinentry-mode loopback --passphrase "${PGP_PASSPHRASE}" --sign --detach-sig "$apk".sha256 - done - rm apksign.keystore - PGP_KEY_FINGERPRINT="${{ steps.import_pgp_key.outputs.fingerprint }}" + + - name: Save Unsigned APKs as Action Artifacts + uses: actions/upload-artifact@v4 + with: + path: build/app/outputs/flutter-apk/* - name: Create Tag uses: mathieudutour/github-tag-action@v6.1 @@ -83,12 +62,11 @@ jobs: custom_tag: "${{ steps.extract_version.outputs.tag }}" tag_prefix: "" - - name: Create Release And Upload APKs + - name: Create Draft Release uses: ncipollo/release-action@v1 with: token: ${{ secrets.GH_ACCESS_TOKEN }} tag: "${{ steps.extract_version.outputs.tag }}" prerelease: "${{ steps.extract_version.outputs.beta }}" - draft: "${{ inputs.draft }}" - artifacts: ./build/app/outputs/flutter-apk/*-release*.apk* + draft: "true" generateReleaseNotes: true diff --git a/.github/workflows/temp.yml b/.github/workflows/temp.yml deleted file mode 100644 index 587a1fb..0000000 --- a/.github/workflows/temp.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Playing around (temp) - -on: - workflow_dispatch: - inputs: - beta: - type: boolean - description: Is beta? - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - - uses: actions/checkout@v3 - - uses: subosito/flutter-action@v2 - - uses: actions/setup-java@v4 - with: - distribution: 'temurin' # See 'Supported distributions' for available options - java-version: '17' - - - name: Flutter Doctor - id: flutter_doctor - run: | - flutter doctor -v - - - name: Check submodule - id: check_submodule - run: | - git checkout ${{ inputs.checkout }} - - - name: Extract Version - id: extract_version - run: | - VERSION=$(grep -oP "^version: [^\+]+" pubspec.yaml | tail -c +10) - echo "version=$VERSION" >> $GITHUB_OUTPUT - if [ ${{ inputs.beta }} == true ]; then BETA=true; else BETA=false; fi - echo "beta=$BETA" >> $GITHUB_OUTPUT - TAG="v$VERSION" - echo "tag=$TAG" >> $GITHUB_OUTPUT - - - name: Build APKs - run: | - sed -i 's/signingConfig signingConfigs.release//g' android/app/build.gradle - flutter build apk --flavor normal && flutter build apk --split-per-abi --flavor normal - for file in build/app/outputs/flutter-apk/app-*normal*.apk*; do mv "$file" "${file//-normal/}"; done - flutter build apk --flavor fdroid -t lib/main_fdroid.dart && flutter build apk --split-per-abi --flavor fdroid -t lib/main_fdroid.dart - rm ./build/app/outputs/flutter-apk/*.sha1 - ls -l ./build/app/outputs/flutter-apk/ - - - name: Save Unsigned APKs as Action Artifacts - uses: actions/upload-artifact@v4 - with: - path: build/app/outputs/flutter-apk/* - - #- name: Create Tag - # uses: mathieudutour/github-tag-action@v6.1 - # with: - # github_token: ${{ secrets.GH_ACCESS_TOKEN }} - # custom_tag: "${{ steps.extract_version.outputs.tag }}" - # tag_prefix: "" - - #- name: Create Draft Release - # uses: ncipollo/release-action@v1 - # with: - # token: ${{ secrets.GH_ACCESS_TOKEN }} - # tag: "${{ steps.extract_version.outputs.tag }}" - # prerelease: "${{ steps.extract_version.outputs.beta }}" - # draft: "true" - # generateReleaseNotes: true diff --git a/sign.sh b/sign.sh new file mode 100755 index 0000000..00bd038 --- /dev/null +++ b/sign.sh @@ -0,0 +1,38 @@ +#!/bin/bash +set -e + +# Script to sign unsigned APKs +# Assumptions: +# 1. Your PGP key is already imported on the locally running agent +# 2. An Android SDK is located at $ANDROID_HOME (or ~/Android/Sdk as fallback) + +usage() { + echo "sign.sh " + exit 1 +} + +if [ -z "$1" ] || [ -z "$2" ] || [ ! -f "$1" ] || [ ! -d "$2" ]; then + usage +fi + +KEYSTORE_LOCATION="$1" +BUILD_DIR="$2" + +read -s -p "Enter your keystore password: " KEYSTORE_PASSWORD + +if [ -z "$ANDROID_HOME" ]; then + ANDROID_HOME=~/Android/Sdk +fi +if [ ! -d "$ANDROID_HOME" ]; then + echo "Could not find Android SDK!" >&2 + exit 1 +fi + +for apk in "$BUILD_DIR"/*-release*.apk; do + unsignedApk=${apk/-release/-unsigned} + mv "$apk" "$unsignedApk" + ${ANDROID_HOME}/build-tools/$(ls ${ANDROID_HOME}/build-tools/ | tail -1)/apksigner sign --ks "$KEYSTORE_LOCATION" --ks-pass pass:"${KEYSTORE_PASSWORD}" --out "${apk}" "${unsignedApk}" + sha256sum ${apk} | cut -d " " -f 1 >"$apk".sha256 + gpg --batch --sign --detach-sig "$apk".sha256 + rm "$unsignedApk" +done