bvandeusen
2500914498
Update installs were failing at the system scanner step because every
release APK was signed with a different signature: build.gradle.kts
fell back to signingConfigs.getByName("debug"), and the debug
keystore is generated per-machine — so every CI runner had a fresh
random key. Android refuses to upgrade an installed app when the
signature doesn't match, hence the "App not installed" failure
after the scan.
Two-part fix:
1. build.gradle.kts now defines a real "release" signing config when
ANDROID_KEYSTORE_PATH is exported (with the matching password +
alias env vars). Without those, falls through to the debug
keystore so local `flutter run --release` still works.
2. flutter.yml decodes ANDROID_KEYSTORE_B64 (CI secret, base64 of the
real release keystore) into a tmp path before the release-APK
build step, then exports ANDROID_KEYSTORE_PATH + the three
password/alias secrets as env vars. CI now hard-errors if the
keystore secret is missing on a tagged build — we don't want
another silent debug-keystore release.
OPERATOR ACTION REQUIRED before the next tag:
1. Generate a release keystore (one-time):
keytool -genkey -v -keystore minstrel-release.keystore \
-alias minstrel -keyalg RSA -keysize 2048 -validity 10000
2. Base64 it:
base64 -w0 minstrel-release.keystore > keystore.b64
3. In Forgejo, add four repo secrets:
ANDROID_KEYSTORE_B64 = contents of keystore.b64
ANDROID_KEY_ALIAS = minstrel
ANDROID_STORE_PASSWORD = the password you set
ANDROID_KEY_PASSWORD = same password (or different alias pwd)
4. Keep minstrel-release.keystore offline and backed up — losing it
means you can never sign an upgrade for any existing install.
5. Existing installs from prior debug-keyed releases must be
uninstalled before installing the first key-signed release. This
is a one-time transition; future tagged builds will upgrade
cleanly.
72 lines
2.6 KiB
Kotlin
72 lines
2.6 KiB
Kotlin
plugins {
|
|
id("com.android.application")
|
|
id("kotlin-android")
|
|
// The Flutter Gradle Plugin must be applied after the Android and Kotlin Gradle plugins.
|
|
id("dev.flutter.flutter-gradle-plugin")
|
|
}
|
|
|
|
android {
|
|
namespace = "com.fabledsword.minstrel"
|
|
compileSdk = flutter.compileSdkVersion
|
|
ndkVersion = flutter.ndkVersion
|
|
|
|
compileOptions {
|
|
sourceCompatibility = JavaVersion.VERSION_17
|
|
targetCompatibility = JavaVersion.VERSION_17
|
|
}
|
|
|
|
kotlinOptions {
|
|
jvmTarget = JavaVersion.VERSION_17.toString()
|
|
}
|
|
|
|
defaultConfig {
|
|
// TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
|
|
applicationId = "com.fabledsword.minstrel"
|
|
// You can update the following values to match your application needs.
|
|
// For more information, see: https://flutter.dev/to/review-gradle-config.
|
|
minSdk = flutter.minSdkVersion
|
|
targetSdk = flutter.targetSdkVersion
|
|
versionCode = flutter.versionCode
|
|
versionName = flutter.versionName
|
|
}
|
|
|
|
// Real release signing config — populated only when CI exports
|
|
// ANDROID_KEYSTORE_PATH (decoded from a base64 secret) plus the
|
|
// matching password/alias env vars. Without these (local
|
|
// `flutter build apk --release` runs), the release build falls
|
|
// through to the debug keystore so local builds still work.
|
|
//
|
|
// Why this matters: Flutter's default `flutter run --release` and
|
|
// CI's earlier setup both signed with the per-machine debug
|
|
// keystore (~/.android/debug.keystore). Every CI runner generated
|
|
// its own debug key, so consecutive release APKs had different
|
|
// signatures and Android refused to upgrade an existing install.
|
|
val keystorePath: String? = System.getenv("ANDROID_KEYSTORE_PATH")
|
|
if (keystorePath != null && keystorePath.isNotEmpty()) {
|
|
signingConfigs {
|
|
create("release") {
|
|
storeFile = file(keystorePath)
|
|
storePassword = System.getenv("ANDROID_STORE_PASSWORD")
|
|
keyAlias = System.getenv("ANDROID_KEY_ALIAS")
|
|
keyPassword = System.getenv("ANDROID_KEY_PASSWORD")
|
|
}
|
|
}
|
|
}
|
|
|
|
buildTypes {
|
|
release {
|
|
signingConfig = if (keystorePath != null && keystorePath.isNotEmpty()) {
|
|
signingConfigs.getByName("release")
|
|
} else {
|
|
// Local-only fallback so `flutter run --release` works
|
|
// without the keystore. CI must export ANDROID_KEYSTORE_PATH.
|
|
signingConfigs.getByName("debug")
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
flutter {
|
|
source = "../.."
|
|
}
|