1 files changed, 30 insertions, 4 deletions

diff --git a/packages/meshbay-android/app/build.gradle.kts b/packages/meshbay-android/app/build.gradle.kts
index 3f29ac0..7f7ba3c 100644
--- a/packages/meshbay-android/app/build.gradle.kts
+++ b/packages/meshbay-android/app/build.gradle.kts
@@ -8,6 +8,9 @@ val packageVersion = (JsonSlurper().parse(rootDir.resolve("../meshbay-client/pac
     as Map<*, *>)["version"] as String
 val versionParts = packageVersion.split(".").map { it.toInt() }
 
+val releaseSigning = listOf("meshbayReleaseStoreFile", "meshbayReleaseStorePassword",
+                            "meshbayReleaseKeyAlias", "meshbayReleaseKeyPassword")
+
 android {
     namespace = "org.meshbay.client"
     compileSdk = 37
@@ -18,13 +21,21 @@ android {
         versionName = packageVersion
         versionCode = versionParts[0] * 10000 + versionParts[1] * 100 + versionParts[2]
     }
+    // The release key never enters the repository: its path and passwords come
+    // from ~/.gradle/gradle.properties. Without them a release build stops
+    // rather than signing with the debug key (see preReleaseBuild below).
+    if (releaseSigning.all { providers.gradleProperty(it).isPresent }) {
+        signingConfigs.create("release") {
+            storeFile = file(providers.gradleProperty("meshbayReleaseStoreFile").get())
+            storePassword = providers.gradleProperty("meshbayReleaseStorePassword").get()
+            keyAlias = providers.gradleProperty("meshbayReleaseKeyAlias").get()
+            keyPassword = providers.gradleProperty("meshbayReleaseKeyPassword").get()
+        }
+    }
     buildTypes {
         getByName("release") {
             isMinifyEnabled = false
-            // A stand-in until the release key exists (Stage D12): the debug
-            // key, so a release build installs over a debug one and back
-            // without losing the account. Not a key to publish anything with.
-            signingConfig = signingConfigs.getByName("debug")
+            signingConfig = signingConfigs.findByName("release")
         }
     }
     compileOptions {
@@ -46,6 +57,11 @@ dependencies {
     // run time; where they are absent the page is offered no cast at all.
     implementation("com.google.android.gms:play-services-cast-framework:22.3.1")
     implementation("androidx.mediarouter:mediarouter:1.8.1")
+    // Notifications are fetched with nothing to install; this is only for a
+    // phone that already has a UnifiedPush distributor (ntfy, …), which then
+    // makes them instant, encrypted to the phone (RFC 8291) — no vendor push
+    // service. Apache-2.0, as is Tink, which it brings for the decryption.
+    implementation("org.unifiedpush.android:connector:3.3.5")
     testImplementation("junit:junit:4.13.2")
     // Android's org.json is a stub on the JVM; the unit tests need the real one.
     testImplementation("org.json:json:20260814")
@@ -81,6 +97,16 @@ val syncUi = tasks.register<SyncUi>("syncUi") {
     outputDir.set(layout.buildDirectory.dir("generated/ui-assets"))
 }
 
+// Checked when a release is built, not when the project is configured, so a
+// debug build and the unit tests need no key.
+tasks.configureEach {
+    if (name == "preReleaseBuild") doFirst {
+        val missing = releaseSigning.filter { !providers.gradleProperty(it).isPresent }
+        if (missing.isNotEmpty()) throw GradleException(
+            "no release key: set ${missing.joinToString()} in ~/.gradle/gradle.properties")
+    }
+}
+
 androidComponents {
     onVariants { variant ->
         variant.sources.assets?.addGeneratedSourceDirectory(syncUi, SyncUi::outputDir)