Releases built by OxygenFlow: the version in gradle.properties, and a release job that signs the APK with the app's key from the repository's secrets, checks it and keeps it with SHA256SUMS; 0.1.0 (refs #7) bfa2eff05d35

#!/usr/bin/env bash

# The app's release job (#7), in OxygenFlow's Android image with no network:

# a signed release APK of the version in gradle.properties, checked with

# apksigner, in dist/ beside its SHA256SUMS, for a release on oxygenhub.io.

#

# The key comes from the job's secrets, mounted as files and never in the

# environment: android-keystore (the PKCS12 keystore, base64) and

# android-keystore-password. Locally, give the same two files:

#   KEYSTORE_B64=path PASSWORD_FILE=path scripts/release.sh

set -euo pipefail

cd "$(dirname "$0")/.."

b64=${KEYSTORE_B64:-/run/secrets/android-keystore}

password=${PASSWORD_FILE:-/run/secrets/android-keystore-password}

for f in "$b64" "$password"; do

    [ -s "$f" ] || { echo "release: no $f: the job needs the android-keystore secrets" >&2; exit 1; }

done

version=$(sed -n 's/^oxygenhub\.version=//p' gradle.properties)

[ -n "$version" ] || { echo "release: no oxygenhub.version in gradle.properties" >&2; exit 1; }

# As ci.sh: the image's JDKs for Gradle's daemon, never a download.

jdks=$( (ls -d /opt/gradle-home/jdks/*/ 2>/dev/null || true) | sed 's:/$::' | paste -sd, -)

if [ -n "$jdks" ] && [ -n "${GRADLE_USER_HOME:-}" ]; then

    mkdir -p "$GRADLE_USER_HOME"

    {

        echo "org.gradle.java.installations.paths=$jdks"

        echo "org.gradle.java.installations.auto-download=false"

    } >> "$GRADLE_USER_HOME/gradle.properties"

fi

# The keystore, decoded where only this job can read it, and gone after.

keys=$(mktemp -d)

trap 'rm -rf "$keys"' EXIT

chmod 700 "$keys"

base64 -d "$b64" > "$keys/release.p12"

export OXYGENHUB_KEYSTORE="$keys/release.p12" OXYGENHUB_KEYSTORE_PASSWORD_FILE="$password"

gradle=$(command -v gradle || echo ./gradlew)

"$gradle" --offline --no-daemon :app:assembleRelease

apk=app/build/outputs/apk/release/app-release.apk

[ -f "$apk" ] || { echo "release: no $apk (was it signed? an unsigned build is app-release-unsigned.apk)" >&2; exit 1; }

sdk=${ANDROID_HOME:-${ANDROID_SDK_ROOT:-}}

apksigner=$(ls -d "$sdk"/build-tools/*/apksigner 2>/dev/null | sort -V | tail -1)

"$apksigner" verify --print-certs "$apk" | grep -E '^Signer #1 certificate (DN|SHA-256)'

# Kept as an artifact by a fixed name; SHA256SUMS gives the name it takes

# in a release, with the version (as OxygenHub's and OxygenFlow's dist do).

rm -rf dist

mkdir -p dist

cp "$apk" dist/oxygenhub-android-universal.apk

echo "$(sha256sum < dist/oxygenhub-android-universal.apk | cut -d' ' -f1)  oxygenhub-android-$version-universal.apk" > dist/SHA256SUMS

echo "release: oxygenhub-android-$version-universal.apk"

// A signed release APK when the version in gradle.properties changes (#7),

// for a release on oxygenhub.io. The keystore and its password are the

// repository's secrets, mounted as files (never in the environment).

job "release" {

    sandbox "android"

    timeout "60m"

    depends-on "test"

    scope "gradle.properties"

    mount {

        source "ephemeral://disk"

        target "/src/rust-core/target"

        size "20GiB"

        cache "rust-core-target"

        key "rust-core/Cargo.lock"

    }

    secret "android-keystore" {

        mount-path "/run/secrets/android-keystore"

    }

    secret "android-keystore-password" {

        mount-path "/run/secrets/android-keystore-password"

    }

    exec "bash" "scripts/release.sh"

    output {

        artifact "oxygenhub-android-universal.apk" {

            path "/src/dist/oxygenhub-android-universal.apk"

        }

        artifact "SHA256SUMS" {

            path "/src/dist/SHA256SUMS"

        }

    }

}

/dist/

## 0.1.0 (2026-10-27)

- **Releases built by OxygenFlow (#7):** the app's version lives in `gradle.properties` (`oxygenhub.version`; the version code follows from it), and when it changes the pipeline's `release` job builds a release APK signed with the app's own key (a PKCS12 keystore and its password, the repository's `android-keystore` and `android-keystore-password` secrets, mounted as files), checks it with apksigner and keeps it with its `SHA256SUMS` for a release on oxygenhub.io. `scripts/release.sh` does the same locally with the key's files. The key's SHA-256 certificate fingerprint is `B0:99:57:36:44:42:AF:B2:27:28:B7:EF:93:F8:23:2D:F1:41:17:DA:50:28:6D:45:93:04:0F:9C:9F:A2:2A:48`; a release-signed app replaces a debug build only after uninstalling it.

// The version, from gradle.properties (#7).

val appVersion: String = providers.gradleProperty("oxygenhub.version").get()

val appVersionCode: Int = appVersion.split(".").map { it.toInt() }.let { (a, b, c) -> a * 10000 + b * 100 + c }

// Release signing (#7): the release job decodes its keystore secret to a

// file and names it and the password's file here. Without them a release

// build is unsigned, so nothing else needs the key.

val releaseKeystore: File? = providers.environmentVariable("OXYGENHUB_KEYSTORE").orNull?.let { File(it) }?.takeIf { it.isFile }

val releasePassword: String? =

    providers.environmentVariable("OXYGENHUB_KEYSTORE_PASSWORD_FILE").orNull?.let { File(it).readText().trim() }

        versionCode = appVersionCode

        versionName = appVersion

    }

    signingConfigs {

        if (releaseKeystore != null && releasePassword != null) {

            create("release") {

                storeFile = releaseKeystore

                storeType = "PKCS12"

                storePassword = releasePassword

                keyAlias = "oxygenhub"

                keyPassword = releasePassword

            }

        }

            signingConfigs.findByName("release")?.let { signingConfig = it }

# The app's version (#7): the release job runs when this changes, and the

# version code follows from it (major * 10000 + minor * 100 + patch).

oxygenhub.version=0.1.0