A release-check job: the release's secrets checked in seconds, with no build (refs #7) 23279b95b5b2

#!/usr/bin/env bash

# The release's secrets checked without a build (#7), by the release-check

# job in seconds and by scripts/release.sh before its own: the keystore's

# SHA-256 and the entry its password opens (compare with the keystore you

# hold: `sha256sum FILE`, `keytool -list`), and that Firebase's settings

# are whole JSON. Never prints a key, a password or the settings.

#   KEYSTORE_B64=path PASSWORD_FILE=path [FIREBASE_CONFIG=path] scripts/release-check.sh

set -euo pipefail

b64=${KEYSTORE_B64:-/run/secrets/android-keystore}

password=${PASSWORD_FILE:-/run/secrets/android-keystore-password}

firebase=${FIREBASE_CONFIG:-/run/secrets/firebase-config}

for f in "$b64" "$password"; do

    [ -s "$f" ] || { echo "release-check: no $f: the job needs the android-keystore secrets" >&2; exit 1; }

done

keys=$(mktemp -d)

trap 'rm -rf "$keys"' EXIT

chmod 700 "$keys"

base64 -d "$b64" > "$keys/release.p12" || { echo "release-check: the android-keystore secret is not base64 (base64 -w0 FILE.p12)" >&2; exit 1; }

echo "release-check: keystore sha256 $(sha256sum < "$keys/release.p12" | cut -d' ' -f1)"

keytool=$(command -v keytool || (ls /opt/gradle-home/jdks/*/bin/keytool 2>/dev/null || true) | head -1)

if [ -z "$keytool" ]; then

    echo "release-check: no keytool here, so the password is not checked" >&2

else

    # As the build reads it: the whole file, trimmed.

    tr -d '\r' < "$password" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' | head -c 4096 > "$keys/pass"

    "$keytool" -list -keystore "$keys/release.p12" -storetype PKCS12 -storepass:file "$keys/pass" 2>&1 \

        | grep -E 'PrivateKeyEntry|SHA-256\)' \

        || { echo "release-check: the android-keystore-password secret does not open the android-keystore secret, or it holds no key" >&2; exit 1; }

    "$keytool" -list -keystore "$keys/release.p12" -storetype PKCS12 -storepass:file "$keys/pass" 2>/dev/null | grep -q '^oxygenhub,' \

        || { echo "release-check: the keystore has no entry named oxygenhub, which the build signs with" >&2; exit 1; }

    # Signing reads the private key with the same password: a request for a

    # certificate uses the key, so it fails just as signing would.

    "$keytool" -certreq -alias oxygenhub -keystore "$keys/release.p12" -storetype PKCS12 \

        -storepass:file "$keys/pass" -keypass:file "$keys/pass" > /dev/null 2> "$keys/certreq.err" \

        || { echo "release-check: the key oxygenhub cannot be read with the keystore's password, as signing needs: $(head -c 300 "$keys/certreq.err")" >&2; exit 1; }

    echo "release-check: the key oxygenhub opens with the password"

    if [ "$(wc -l < "$password")" -gt 1 ]; then

        echo "release-check: the password secret has more than one line; the build reads all of it" >&2

    fi

fi

if [ -s "$firebase" ]; then

    if command -v python3 > /dev/null; then

        python3 -I -c 'import json,sys; json.load(open(sys.argv[1]))' "$firebase" 2>/dev/null \

            || { echo "release-check: the firebase-config secret is not whole JSON (is its last } missing?)" >&2; exit 1; }

    elif [ "$(tr -d '[:space:]' < "$firebase" | tail -c 1)" != "}" ]; then

        echo "release-check: the firebase-config secret does not end with } (is its last line missing?)" >&2

        exit 1

    fi

    echo "release-check: firebase-config reads as JSON"

else

    echo "release-check: no $firebase: a release takes no alerts" >&2

fi

echo "release-check: ok"

// The release's secrets checked in seconds, with no build (#7): the

// keystore's SHA-256, the key its password opens and Firebase's JSON.

// By hand only: oh run start --job release-check.

job "release-check" {

    sandbox "android"

    timeout "5m"

    on {

        manual

    }

    secret "android-keystore" {

        mount-path "/run/secrets/android-keystore"

    }

    secret "android-keystore-password" {

        mount-path "/run/secrets/android-keystore-password"

    }

    secret "firebase-config" {

        mount-path "/run/secrets/firebase-config"

    }

    exec "bash" "scripts/release-check.sh"

}

## 0.1.0 (2026-10-28)

- **The release's secrets checked in seconds (#7):** `oh run start --job release-check` runs `scripts/release-check.sh` with no build: the keystore's SHA-256 and the entry its password opens (to compare with the keystore you hold), that the key `oxygenhub` opens with that password as signing needs, and that Firebase's settings are whole JSON; never a key, a password or the settings. The release job runs the same check first.

# The secrets first, in seconds, before a build that takes a quarter of an hour.

KEYSTORE_B64="$b64" PASSWORD_FILE="$password" FIREBASE_CONFIG="$firebase" bash scripts/release-check.sh