mirror of
https://github.com/Droid-Deck/DroidDeck.git
synced 2026-11-11 02:51:10 +00:00
57 lines
2.2 KiB
Bash
Executable File
57 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
REPO=Droid-Deck/DroidDeck
|
|
ENVIRONMENTS=(signing-main release)
|
|
ALIAS=droiddeck
|
|
OUT=${DROIDDECK_KEY_DIR:-$HOME/droiddeck-release-key}
|
|
here=$(cd "$(dirname "$0")" && pwd)
|
|
repo=$(cd "$here/../.." && pwd)
|
|
|
|
die() { echo "error: $*" >&2; exit 1; }
|
|
command -v keytool >/dev/null || die "keytool not found (Termux: pkg install openjdk-17)"
|
|
command -v gh >/dev/null || die "gh not found"
|
|
gh auth status >/dev/null 2>&1 || die "gh is not logged in (gh auth login)"
|
|
[ -e "$OUT/droiddeck-release.p12" ] && die "a key already exists in $OUT - there must only ever be one"
|
|
case "$OUT" in "$repo"|"$repo"/*) die "the key must not be made inside the repo" ;; esac
|
|
for env in "${ENVIRONMENTS[@]}"; do
|
|
gh api "repos/$REPO/environments/$env" >/dev/null 2>&1 || die "GitHub environment '$env' does not exist yet"
|
|
done
|
|
|
|
umask 077
|
|
mkdir -p "$OUT"
|
|
KS="$OUT/droiddeck-release.p12"
|
|
KS_PW=$(head -c 60 /dev/urandom | base64 -w0 | tr -d '/+=')
|
|
KS_PW=${KS_PW:0:48}
|
|
[ ${#KS_PW} -ge 40 ] || die "could not make a password"
|
|
export KS_PW
|
|
printf '%s\n' "$KS_PW" > "$OUT/password.txt"
|
|
|
|
keytool -genkeypair -keystore "$KS" -storetype PKCS12 -alias "$ALIAS" \
|
|
-keyalg RSA -keysize 4096 -validity 10950 -dname "CN=DroidDeck, O=The412Banner" \
|
|
-storepass:env KS_PW -keypass:env KS_PW >/dev/null 2>&1 || die "keytool could not make the key"
|
|
listing=$(keytool -list -v -keystore "$KS" -storepass:env KS_PW -alias "$ALIAS")
|
|
SHA=$(awk '/SHA256:/ { print $2 }' <<<"$listing" | head -n1 | tr -d ':' | tr 'A-F' 'a-f')
|
|
[[ $SHA =~ ^[0-9a-f]{64}$ ]] || die "could not read the key's certificate digest"
|
|
|
|
for env in "${ENVIRONMENTS[@]}"; do
|
|
base64 -w0 < "$KS" | gh secret set RELEASE_KEYSTORE_B64 --env "$env" -R "$REPO" >/dev/null
|
|
printf '%s' "$KS_PW" | gh secret set RELEASE_STORE_PASSWORD --env "$env" -R "$REPO" >/dev/null
|
|
echo "secrets set for environment: $env"
|
|
done
|
|
unset KS_PW
|
|
|
|
printf '%s\n' "$SHA" > "$repo/keystore/release-signer.sha256"
|
|
cat <<EOF
|
|
|
|
DroidDeck's signing key is made and in GitHub.
|
|
|
|
Key: $KS
|
|
Password: $OUT/password.txt
|
|
Digest: $SHA (public - written to keystore/release-signer.sha256)
|
|
|
|
Now:
|
|
1. Back up the folder $OUT (both files) to at least two safe places.
|
|
2. Commit keystore/release-signer.sha256 (only that file).
|
|
EOF
|