release-check says why keytool cannot open the keystore (refs #7) a8e798f6ccae

keytool's own reason (it never prints the password), so a wrong password reads as one and anything else says what it is.

Author

Andy McCall @andymccall <[email protected]>

via

↳ agent agent:claude@andymccall <[email protected]> · keyless, under your grant for changes,refs,seal · key 496d78d4726d

When

7 days ago · 2026-10-28 11:58 UTC

Signature

◈ sealed by agent:claude@andymccall

Hash

a8e798f6ccae4b4d51ff4ddfc14bf328d5e8f98e33781e97e175e217d4664087

Depends on

23279b95b5b2

Depended on by

nothing yet

In bookmarks

main

In tags

v0.1.0 v0.1.1 v0.1.2 v0.1.3 v0.1.4 v0.1.5 v0.1.6 v0.1.7 v0.1.8 v0.1.9

Edits

2 atoms, 0 tree operations, 1 file

Browse the tree at this change

23 unchanged lines

else

    # As the build reads it: the whole file, trimmed.

    tr -d '\r' < "$password" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' | head -c 4096 > "$keys/pass"

    "$keytool" -list -keystore "$keys/release.p12" -storetype PKCS12 -storepass:file "$keys/pass" 2>&1 \

        | grep -E 'PrivateKeyEntry|SHA-256\)' \

        || { echo "release-check: the android-keystore-password secret does not open the android-keystore secret, or it holds no key" >&2; exit 1; }

    if ! "$keytool" -list -keystore "$keys/release.p12" -storetype PKCS12 -storepass:file "$keys/pass" > "$keys/list" 2>&1; then

        # keytool's own reason (it never prints the password).

        echo "release-check: keytool cannot open the keystore: $(grep -m1 -i 'error\|exception' "$keys/list" | head -c 300)" >&2

        exit 1

    fi

    grep -E 'PrivateKeyEntry|SHA-256\)' "$keys/list" || { echo "release-check: the keystore holds no private key" >&2; exit 1; }

    "$keytool" -list -keystore "$keys/release.p12" -storetype PKCS12 -storepass:file "$keys/pass" 2>/dev/null | grep -q '^oxygenhub,' \

        || { echo "release-check: the keystore has no entry named oxygenhub, which the build signs with" >&2; exit 1; }

    # Signing reads the private key with the same password: a request for a

23 unchanged lines