git.iko.soy/Multigram
on main help sign in
Sign the APK with the test key unless signing secrets are set
e7f86baClaude
.github/workflows/build.yml+20−2
compare with main
unifiedsplit
@@ -90,6 +90,10 @@ jobs:
90 env:
90 env:
91 APP_ID: ${{ secrets.MULTIGRAM_APP_ID }}
91 APP_ID: ${{ secrets.MULTIGRAM_APP_ID }}
92 APP_HASH: ${{ secrets.MULTIGRAM_APP_HASH }}
92 APP_HASH: ${{ secrets.MULTIGRAM_APP_HASH }}
93+ KEYSTORE_BASE64: ${{ secrets.MULTIGRAM_KEYSTORE_BASE64 }}
94+ KEYSTORE_PASSWORD: ${{ secrets.MULTIGRAM_KEYSTORE_PASSWORD }}
95+ KEY_ALIAS: ${{ secrets.MULTIGRAM_KEY_ALIAS }}
96+ KEY_PASSWORD: ${{ secrets.MULTIGRAM_KEY_PASSWORD }}
93 run: |
97 run: |
94 vars=gradle.properties
98 vars=gradle.properties
95 echo "org.gradle.workers.max=1" >> $vars
99 echo "org.gradle.workers.max=1" >> $vars
@@ -99,11 +103,25 @@ jobs:
99 echo "org.gradle.parallel=false" >> $vars
103 echo "org.gradle.parallel=false" >> $vars
100 [ -n "$APP_ID" ] && echo "APP_ID=$APP_ID" >> $vars
104 [ -n "$APP_ID" ] && echo "APP_ID=$APP_ID" >> $vars
101 [ -n "$APP_HASH" ] && echo "APP_HASH=$APP_HASH" >> $vars
105 [ -n "$APP_HASH" ] && echo "APP_HASH=$APP_HASH" >> $vars
106+ signing=()
107+ if [ -n "$KEYSTORE_BASE64" ]; then
108+ # Your own release key, from the MULTIGRAM_KEYSTORE_* secrets; it never touches the repository.
109+ echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
110+ signing=(
111+ "-PRELEASE_KEYSTORE_FILE=$RUNNER_TEMP/release.keystore"
112+ "-PRELEASE_STORE_PASSWORD=$KEYSTORE_PASSWORD"
113+ "-PRELEASE_KEY_ALIAS=$KEY_ALIAS"
114+ "-PRELEASE_KEY_PASSWORD=${KEY_PASSWORD:-$KEYSTORE_PASSWORD}"
115+ )
116+ else
117+ # Without RELEASE_KEYSTORE_FILE the build signs with the public test key in
102− echo "RELEASE_KEYSTORE_FILE=$PWD/TMessagesProj/config/release.keystore" >> $vars
118+ # TMessagesProj/config/test.keystore: fine for testing, not for an APK you give out.
119+ echo "::warning::No MULTIGRAM_KEYSTORE_BASE64 secret: the APK is signed with the public test key."
120+ fi
103 sudo apt update
121 sudo apt update
104 sudo apt -y install ninja-build meson nasm gperf pkg-config unzip
122 sudo apt -y install ninja-build meson nasm gperf pkg-config unzip
105 rustup target add aarch64-linux-android armv7-linux-androideabi i686-linux-android x86_64-linux-android
123 rustup target add aarch64-linux-android armv7-linux-androideabi i686-linux-android x86_64-linux-android
106− ./gradlew :TMessagesProj_App:assembleAfatRelease
124+ ./gradlew "${signing[@]}" :TMessagesProj_App:assembleAfatRelease
107 - uses: actions/upload-artifact@v4
125 - uses: actions/upload-artifact@v4
108 with:
126 with:
109 name: multigram-apk
127 name: multigram-apk
README.md+6−4
@@ -23,10 +23,12 @@ Set these in **Settings > Secrets and variables > Actions**:
23
23
24- `MULTIGRAM_APP_ID` and `MULTIGRAM_APP_HASH`: your own API id and hash from
24- `MULTIGRAM_APP_ID` and `MULTIGRAM_APP_HASH`: your own API id and hash from
25 https://my.telegram.org (API development tools). Without them the APK cannot log in.
25 https://my.telegram.org (API development tools). Without them the APK cannot log in.
26−- Signing: the APK job signs with `TMessagesProj/config/release.keystore` from the tree, whose
26+- Signing (optional): `MULTIGRAM_KEYSTORE_BASE64` (your release keystore, `base64 -w0 release.keystore`),
27− passwords are public, so anyone could sign an "update" for it. That is fine for testing. For
27+ `MULTIGRAM_KEYSTORE_PASSWORD`, `MULTIGRAM_KEY_ALIAS` and `MULTIGRAM_KEY_PASSWORD` (if it differs
28− an APK you give to people, sign with your own key and keep it out of the repository (see
28+ from the store password). Without them the APK is signed with Forkgram's public test key
29+ (`TMessagesProj/config/test.keystore`), which is fine for testing but lets anyone sign an
30+ "update" for it. Keep the same key for every build you give out, or phones can't update. The
29− "Signing and updates" in `multigram/rebrand/README.md`); the workflow has no keystore secret yet.
31+ rebrand toolkit can make a key for you (see "Signing and updates" in `multigram/rebrand/README.md`).
30
32
31## How the sync works
33## How the sync works
32
34