fix and update
This commit is contained in:
lendry
@@ -1,5 +1,5 @@
|
||||
#!/usr/bin/env bash
|
||||
# Создаёт release keystore для подписи APK, если его ещё нет.
|
||||
# Создаёт и проверяет release keystore для подписи APK.
|
||||
set -euo pipefail
|
||||
|
||||
SECRETS_DIR="${ANDROID_SECRETS_DIR:-/workspace/tauri_app/.secrets}"
|
||||
@@ -7,73 +7,139 @@ KEYSTORE_FILE="${ANDROID_KEYSTORE_FILE:-${SECRETS_DIR}/lendry-id-release.keystor
|
||||
KEY_ALIAS="${ANDROID_KEY_ALIAS:-lendry-id}"
|
||||
CREDENTIALS_FILE="${SECRETS_DIR}/signing-credentials.env"
|
||||
KEYSTORE_PROPS_TEMPLATE="${SECRETS_DIR}/keystore.properties.template"
|
||||
FORCE_REGENERATE="${ANDROID_KEYSTORE_FORCE_REGENERATE:-0}"
|
||||
|
||||
mkdir -p "${SECRETS_DIR}"
|
||||
chmod 700 "${SECRETS_DIR}" || true
|
||||
|
||||
if [[ -f "${KEYSTORE_FILE}" ]]; then
|
||||
echo "==> Android keystore уже существует: ${KEYSTORE_FILE}"
|
||||
if [[ ! -f "${PROPS_TEMPLATE}" && -f "${CREDENTIALS_FILE}" ]]; then
|
||||
read_credentials() {
|
||||
STORE_PASSWORD=""
|
||||
KEY_PASSWORD=""
|
||||
if [[ -f "${CREDENTIALS_FILE}" ]]; then
|
||||
# shellcheck disable=SC1090
|
||||
source "${CREDENTIALS_FILE}"
|
||||
cat > "${PROPS_TEMPLATE}" <<EOF
|
||||
storePassword=${ANDROID_KEYSTORE_PASSWORD}
|
||||
keyPassword=${ANDROID_KEY_PASSWORD}
|
||||
keyAlias=${ANDROID_KEY_ALIAS}
|
||||
storeFile=../../../.secrets/lendry-id-release.keystore
|
||||
EOF
|
||||
chmod 600 "${PROPS_TEMPLATE}" || true
|
||||
echo "==> Восстановлен keystore.properties.template из signing-credentials.env"
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if ! command -v keytool >/dev/null 2>&1; then
|
||||
echo "keytool не найден — нужен JDK для генерации keystore" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
gen_secret() {
|
||||
if command -v openssl >/dev/null 2>&1; then
|
||||
openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 24
|
||||
else
|
||||
date +%s%N | sha256sum | head -c 24
|
||||
STORE_PASSWORD="${ANDROID_KEYSTORE_PASSWORD:-}"
|
||||
KEY_PASSWORD="${ANDROID_KEY_PASSWORD:-${ANDROID_KEYSTORE_PASSWORD:-}}"
|
||||
elif [[ -f "${KEYSTORE_PROPS_TEMPLATE}" ]]; then
|
||||
STORE_PASSWORD="$(grep -E '^storePassword=' "${KEYSTORE_PROPS_TEMPLATE}" | head -n1 | cut -d= -f2- || true)"
|
||||
KEY_PASSWORD="$(grep -E '^keyPassword=' "${KEYSTORE_PROPS_TEMPLATE}" | head -n1 | cut -d= -f2- || true)"
|
||||
KEY_PASSWORD="${KEY_PASSWORD:-${STORE_PASSWORD}}"
|
||||
fi
|
||||
}
|
||||
|
||||
STORE_PASSWORD="$(gen_secret)"
|
||||
KEY_PASSWORD="$(gen_secret)"
|
||||
write_credentials_files() {
|
||||
local password="$1"
|
||||
|
||||
echo "==> Генерация release keystore для подписи APK..."
|
||||
keytool -genkeypair -v \
|
||||
-storetype PKCS12 \
|
||||
-keystore "${KEYSTORE_FILE}" \
|
||||
-alias "${KEY_ALIAS}" \
|
||||
-keyalg RSA \
|
||||
-keysize 2048 \
|
||||
-validity 10000 \
|
||||
-storepass "${STORE_PASSWORD}" \
|
||||
-keypass "${KEY_PASSWORD}" \
|
||||
-dname "CN=Lendry ID, OU=Mobile, O=Lendry, C=RU"
|
||||
|
||||
chmod 600 "${KEYSTORE_FILE}" || true
|
||||
|
||||
cat > "${CREDENTIALS_FILE}" <<EOF
|
||||
cat > "${CREDENTIALS_FILE}" <<EOF
|
||||
# Сгенерировано $(date -u +"%Y-%m-%dT%H:%M:%SZ") — храните в безопасном месте.
|
||||
ANDROID_KEYSTORE_FILE=${KEYSTORE_FILE}
|
||||
ANDROID_KEY_ALIAS=${KEY_ALIAS}
|
||||
ANDROID_KEYSTORE_PASSWORD=${STORE_PASSWORD}
|
||||
ANDROID_KEY_PASSWORD=${KEY_PASSWORD}
|
||||
ANDROID_KEYSTORE_PASSWORD=${password}
|
||||
ANDROID_KEY_PASSWORD=${password}
|
||||
EOF
|
||||
chmod 600 "${CREDENTIALS_FILE}" || true
|
||||
chmod 600 "${CREDENTIALS_FILE}" || true
|
||||
|
||||
cat > "${KEYSTORE_PROPS_TEMPLATE}" <<EOF
|
||||
storePassword=${STORE_PASSWORD}
|
||||
keyPassword=${KEY_PASSWORD}
|
||||
cat > "${KEYSTORE_PROPS_TEMPLATE}" <<EOF
|
||||
storePassword=${password}
|
||||
keyPassword=${password}
|
||||
keyAlias=${KEY_ALIAS}
|
||||
storeFile=../../../.secrets/lendry-id-release.keystore
|
||||
storeFile=${KEYSTORE_FILE}
|
||||
EOF
|
||||
chmod 600 "${KEYSTORE_PROPS_TEMPLATE}" || true
|
||||
chmod 600 "${KEYSTORE_PROPS_TEMPLATE}" || true
|
||||
}
|
||||
|
||||
echo "==> Keystore создан: ${KEYSTORE_FILE}"
|
||||
echo "==> Пароли сохранены: ${CREDENTIALS_FILE}"
|
||||
validate_keystore() {
|
||||
local store_password="$1"
|
||||
local key_password="$2"
|
||||
|
||||
[[ -n "${store_password}" ]] || return 1
|
||||
[[ -f "${KEYSTORE_FILE}" ]] || return 1
|
||||
|
||||
keytool -list \
|
||||
-keystore "${KEYSTORE_FILE}" \
|
||||
-storepass "${store_password}" \
|
||||
-alias "${KEY_ALIAS}" >/dev/null 2>&1 || return 1
|
||||
|
||||
# Для JKS/PKCS12 у Gradle storePassword и keyPassword должны совпадать.
|
||||
if [[ "${key_password}" != "${store_password}" ]]; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
backup_broken_keystore() {
|
||||
local backup_dir="${SECRETS_DIR}/backup-$(date +%Y%m%d-%H%M%S)"
|
||||
mkdir -p "${backup_dir}"
|
||||
for file in "${KEYSTORE_FILE}" "${CREDENTIALS_FILE}" "${KEYSTORE_PROPS_TEMPLATE}"; do
|
||||
if [[ -f "${file}" ]]; then
|
||||
cp "${file}" "${backup_dir}/"
|
||||
fi
|
||||
done
|
||||
echo "==> Старые файлы подписи сохранены в ${backup_dir}"
|
||||
}
|
||||
|
||||
gen_secret() {
|
||||
if command -v openssl >/dev/null 2>&1; then
|
||||
openssl rand -hex 16
|
||||
else
|
||||
date +%s%N | sha256sum | awk '{print substr($1,1,32)}'
|
||||
fi
|
||||
}
|
||||
|
||||
create_keystore() {
|
||||
local password="$1"
|
||||
|
||||
if ! command -v keytool >/dev/null 2>&1; then
|
||||
echo "keytool не найден — нужен JDK для генерации keystore" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
rm -f "${KEYSTORE_FILE}"
|
||||
|
||||
echo "==> Генерация release keystore для подписи APK..."
|
||||
# JKS + один пароль — максимально совместимо с Android Gradle signing.
|
||||
keytool -genkeypair -v \
|
||||
-storetype JKS \
|
||||
-keystore "${KEYSTORE_FILE}" \
|
||||
-alias "${KEY_ALIAS}" \
|
||||
-keyalg RSA \
|
||||
-keysize 2048 \
|
||||
-validity 10000 \
|
||||
-storepass "${password}" \
|
||||
-keypass "${password}" \
|
||||
-dname "CN=Lendry ID, OU=Mobile, O=Lendry, C=RU"
|
||||
|
||||
chmod 600 "${KEYSTORE_FILE}" || true
|
||||
write_credentials_files "${password}"
|
||||
|
||||
echo "==> Keystore создан: ${KEYSTORE_FILE}"
|
||||
echo "==> Пароли сохранены: ${CREDENTIALS_FILE}"
|
||||
}
|
||||
|
||||
if [[ "${FORCE_REGENERATE}" == "1" && -f "${KEYSTORE_FILE}" ]]; then
|
||||
backup_broken_keystore
|
||||
rm -f "${KEYSTORE_FILE}" "${CREDENTIALS_FILE}" "${KEYSTORE_PROPS_TEMPLATE}"
|
||||
fi
|
||||
|
||||
if [[ -f "${KEYSTORE_FILE}" ]]; then
|
||||
read_credentials
|
||||
if validate_keystore "${STORE_PASSWORD}" "${KEY_PASSWORD}"; then
|
||||
write_credentials_files "${STORE_PASSWORD}"
|
||||
echo "==> Android keystore проверен: ${KEYSTORE_FILE}"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "==> Keystore повреждён или пароли не совпадают — пересоздаём release keystore" >&2
|
||||
backup_broken_keystore
|
||||
rm -f "${KEYSTORE_FILE}" "${CREDENTIALS_FILE}" "${KEYSTORE_PROPS_TEMPLATE}"
|
||||
fi
|
||||
|
||||
create_keystore "$(gen_secret)"
|
||||
|
||||
if ! validate_keystore "$(grep -E '^storePassword=' "${KEYSTORE_PROPS_TEMPLATE}" | cut -d= -f2-)" "$(grep -E '^keyPassword=' "${KEYSTORE_PROPS_TEMPLATE}" | cut -d= -f2-)"; then
|
||||
echo "Не удалось проверить только что созданный keystore" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "==> Keystore успешно создан и проверен"
|
||||
|
||||
Reference in New Issue
Block a user