berkay/bagdrill
1
0
Fork 0
Code Issues Pull requests Projects Releases 5 Packages Wiki Activity Actions

Sign release builds with BagDrill's own upload key #16

Merged
berkay merged 1 commit from release-signing into main 2026-11-10 13:54:50 +03:00
Conversation 0 Commits 1 Files changed 2 +54 -4
berkay commented 2026-11-10 13:34:32 +03:00
Owner
Copy link

Requested by Berkay · project thread

From Astra's review: release builds were signed with the debug key.

What

  • android/app/build.gradle.kts loads android/key.properties (gitignored, like the .jks) and signs release with the BagDrill upload key (alias upload, RSA 4096, valid to 2054).
  • No fallback to the debug key. Without key.properties, assembleRelease / bundleRelease stop with "Release signing key missing…".
  • README: where the keystore and key.properties go.

The keystore and key.properties are in the project's private files, not in this repo.

Checks

  • ./gradlew :app:signingReport: release variant uses bagdrill-upload.jks, SHA-256 28:1B:FD:5E:…:F6:97:F0.
  • ./gradlew assembleRelease --dry-run without the key fails with the message above; with it, it passes.
  • No APK built.

Note

Installs of 0.2.x are debug-signed; the first APK signed with this key cannot update them: uninstall first (history on the phone is lost).

🤖 Generated with Claude Code

https://claude.ai/code/session_015s4aKn6Q7AftVbZ2Mi5d1v

<!-- claude-projects-attribution --> _Requested by **Berkay** · [project thread](https://claude.ai/code/project/chan_01T5Cs4GeJAnhjXKSJKvCDa2?thread=cmsg_01T5Cs4GeJAnhjXKSJKvCDa27aDoFiirb6FRcT1pYH9rw7)_ From Astra's review: release builds were signed with the debug key. ## What - `android/app/build.gradle.kts` loads `android/key.properties` (gitignored, like the `.jks`) and signs `release` with the BagDrill upload key (alias `upload`, RSA 4096, valid to 2054). - No fallback to the debug key. Without `key.properties`, `assembleRelease` / `bundleRelease` stop with "Release signing key missing…". - README: where the keystore and `key.properties` go. The keystore and `key.properties` are in the project's private files, not in this repo. ## Checks - `./gradlew :app:signingReport`: release variant uses `bagdrill-upload.jks`, SHA-256 `28:1B:FD:5E:…:F6:97:F0`. - `./gradlew assembleRelease --dry-run` without the key fails with the message above; with it, it passes. - No APK built. ## Note Installs of 0.2.x are debug-signed; the first APK signed with this key cannot update them: uninstall first (history on the phone is lost). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015s4aKn6Q7AftVbZ2Mi5d1v
Release builds read android/key.properties (kept out of git) and are
signed with the BagDrill upload keystore. They no longer fall back to the
debug key: without key.properties a release build stops with a clear
error. README explains where the two files go.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015s4aKn6Q7AftVbZ2Mi5d1v
berkay merged commit 344082643f into main 2026-11-10 13:54:50 +03:00
berkay deleted branch release-signing 2026-11-10 13:54:50 +03:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
berkay/bagdrill!16
No description provided.