Build unsigned; sign with apksigner to avoid the PKDS signing block

1 files changed, 48 insertions, 0 deletions

diff --git a/tools/build-release.sh b/tools/build-release.sh
new file mode 100755
index 0000000..588caa2
--- /dev/null
+++ b/tools/build-release.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Build and sign a release APK with the maintainer key.
+#
+# Signing is done with the Android SDK apksigner rather than AGP: AGP adds a
+# "Dependency metadata" (PKDS) block to the APK signing block, which F-Droid's
+# scanner rejects. The content of the APK is unchanged either way.
+#
+# Needs keystore.properties in the repo root (git-ignored), with:
+#   storeFile=... storePassword=... keyAlias=... keyPassword=...
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+PROPS=keystore.properties
+if [ ! -f "$PROPS" ]; then
+    echo "Missing $PROPS (keystore path + passwords). See README-BACKUP.txt." >&2
+    exit 1
+fi
+
+VERSION=$(sed -nE 's/.*versionName *= *"(.*)".*/\1/p' app/build.gradle.kts | head -1)
+KS=$(sed -nE 's/^storeFile=(.*)$/\1/p' "$PROPS")
+ALIAS=$(sed -nE 's/^keyAlias=(.*)$/\1/p' "$PROPS")
+export RECCOON_STORE_PASS=$(sed -nE 's/^storePassword=(.*)$/\1/p' "$PROPS")
+export RECCOON_KEY_PASS=$(sed -nE 's/^keyPassword=(.*)$/\1/p' "$PROPS")
+
+SDK="${ANDROID_HOME:-$(sed -nE 's/^sdk\.dir=(.*)$/\1/p' local.properties)}"
+APKSIGNER=$(ls -1 "$SDK"/build-tools/*/apksigner 2>/dev/null | sort -V | tail -1)
+if [ ! -x "$APKSIGNER" ]; then
+    echo "apksigner not found under $SDK/build-tools" >&2
+    exit 1
+fi
+
+echo "==> Building unsigned release ($VERSION)"
+./gradlew :app:assembleRelease
+
+UNSIGNED=app/build/outputs/apk/release/app-release-unsigned.apk
+[ -f "$UNSIGNED" ] || UNSIGNED=app/build/outputs/apk/release/app-release.apk
+OUT="releases/RECCoon-${VERSION}.apk"
+mkdir -p releases dist
+
+echo "==> Signing with $APKSIGNER"
+"$APKSIGNER" sign --ks "$KS" --ks-key-alias "$ALIAS" \
+    --ks-pass env:RECCOON_STORE_PASS --key-pass env:RECCOON_KEY_PASS \
+    --out "$OUT" "$UNSIGNED"
+cp "$OUT" dist/
+
+echo "==> Result"
+"$APKSIGNER" verify --print-certs "$OUT" | grep -E "DN:|SHA-256 digest" | head -3
+sha256sum "$OUT"