From 2860f1de75af1d44d35292ecbf79c68f02409d19 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 8 Oct 2026 11:40:17 +0200 Subject: feat: sign Android releases with the release key assembleRelease reads the key from ~/.gradle/gradle.properties and fails without it instead of falling back to the debug key. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-android/README.md | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-android/README.md') diff --git a/packages/meshbay-android/README.md b/packages/meshbay-android/README.md index bfd82cf..5cb474e 100644 --- a/packages/meshbay-android/README.md +++ b/packages/meshbay-android/README.md @@ -32,13 +32,29 @@ holds the same service and the same visibility, for as long as it plays # needs JDK 17+ and an Android SDK (ANDROID_HOME, or sdk.dir in local.properties) ./gradlew assembleDebug # app/build/outputs/apk/debug/app-debug.apk ./gradlew testDebugUnitTest # JVM unit tests +./gradlew assembleRelease # app/build/outputs/apk/release/app-release.apk ``` +A release is signed with the release key, which never enters the repository. +`assembleRelease` reads it from `~/.gradle/gradle.properties`, and stops if +any of these is missing rather than signing with the debug key: + +```properties +meshbayReleaseStoreFile=/path/to/meshbay-release.jks +meshbayReleaseStorePassword=... +meshbayReleaseKeyAlias=meshbay +meshbayReleaseKeyPassword=... +``` + +`apksigner verify --print-certs app-release.apk` prints the certificate's +SHA-256 fingerprint, the one the download page publishes (ยง8.2). A release +does not install over a debug build, or the reverse: the keys differ. + The security contract is also pinned from the Python suite by reading this source: `packages/meshbay-hub/tests/test_android_shell.py`. Not built yet: phone-specific behaviour (back button, network handover, -keeping a download alive with the screen off), signed releases. +keeping a download alive with the screen off), updates through a store. ## Icon -- cgit v1.2.3