feat: sign Android releases with the release keyHEADmain

assembleRelease reads the key from ~/.gradle/gradle.properties and fails
without it instead of falling back to the debug key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 42 insertions, 5 deletions

diff --git a/packages/meshbay-android/README.md b/packages/meshbay-android/README.md
index bfd82cf..5cb474e 100644
--- a/packages/meshbay-android/README.md
+++ b/packages/meshbay-android/README.md
@@ -32,13 +32,29 @@ holds the same service and the same visibility, for as long as it plays
 # needs JDK 17+ and an Android SDK (ANDROID_HOME, or sdk.dir in local.properties)
 ./gradlew assembleDebug        # app/build/outputs/apk/debug/app-debug.apk
 ./gradlew testDebugUnitTest    # JVM unit tests
+./gradlew assembleRelease      # app/build/outputs/apk/release/app-release.apk
 ```
 
+A release is signed with the release key, which never enters the repository.
+`assembleRelease` reads it from `~/.gradle/gradle.properties`, and stops if
+any of these is missing rather than signing with the debug key:
+
+```properties
+meshbayReleaseStoreFile=/path/to/meshbay-release.jks
+meshbayReleaseStorePassword=...
+meshbayReleaseKeyAlias=meshbay
+meshbayReleaseKeyPassword=...
+```
+
+`apksigner verify --print-certs app-release.apk` prints the certificate's
+SHA-256 fingerprint, the one the download page publishes (§8.2). A release
+does not install over a debug build, or the reverse: the keys differ.
+
 The security contract is also pinned from the Python suite by reading this
 source: `packages/meshbay-hub/tests/test_android_shell.py`.
 
 Not built yet: phone-specific behaviour (back button, network handover,
-keeping a download alive with the screen off), signed releases.
+keeping a download alive with the screen off), updates through a store.
 
 ## Icon
 
diff --git a/packages/meshbay-android/app/build.gradle.kts b/packages/meshbay-android/app/build.gradle.kts
index 3f29ac0..8afbc1a 100644
--- a/packages/meshbay-android/app/build.gradle.kts
+++ b/packages/meshbay-android/app/build.gradle.kts
@@ -8,6 +8,9 @@ val packageVersion = (JsonSlurper().parse(rootDir.resolve("../meshbay-client/pac
     as Map<*, *>)["version"] as String
 val versionParts = packageVersion.split(".").map { it.toInt() }
 
+val releaseSigning = listOf("meshbayReleaseStoreFile", "meshbayReleaseStorePassword",
+                            "meshbayReleaseKeyAlias", "meshbayReleaseKeyPassword")
+
 android {
     namespace = "org.meshbay.client"
     compileSdk = 37
@@ -18,13 +21,21 @@ android {
         versionName = packageVersion
         versionCode = versionParts[0] * 10000 + versionParts[1] * 100 + versionParts[2]
     }
+    // The release key never enters the repository: its path and passwords come
+    // from ~/.gradle/gradle.properties. Without them a release build stops
+    // rather than signing with the debug key (see preReleaseBuild below).
+    if (releaseSigning.all { providers.gradleProperty(it).isPresent }) {
+        signingConfigs.create("release") {
+            storeFile = file(providers.gradleProperty("meshbayReleaseStoreFile").get())
+            storePassword = providers.gradleProperty("meshbayReleaseStorePassword").get()
+            keyAlias = providers.gradleProperty("meshbayReleaseKeyAlias").get()
+            keyPassword = providers.gradleProperty("meshbayReleaseKeyPassword").get()
+        }
+    }
     buildTypes {
         getByName("release") {
             isMinifyEnabled = false
-            // A stand-in until the release key exists (Stage D12): the debug
-            // key, so a release build installs over a debug one and back
-            // without losing the account. Not a key to publish anything with.
-            signingConfig = signingConfigs.getByName("debug")
+            signingConfig = signingConfigs.findByName("release")
         }
     }
     compileOptions {
@@ -81,6 +92,16 @@ val syncUi = tasks.register<SyncUi>("syncUi") {
     outputDir.set(layout.buildDirectory.dir("generated/ui-assets"))
 }
 
+// Checked when a release is built, not when the project is configured, so a
+// debug build and the unit tests need no key.
+tasks.configureEach {
+    if (name == "preReleaseBuild") doFirst {
+        val missing = releaseSigning.filter { !providers.gradleProperty(it).isPresent }
+        if (missing.isNotEmpty()) throw GradleException(
+            "no release key: set ${missing.joinToString()} in ~/.gradle/gradle.properties")
+    }
+}
+
 androidComponents {
     onVariants { variant ->
         variant.sources.assets?.addGeneratedSourceDirectory(syncUi, SyncUi::outputDir)