mirror of
https://github.com/bulwarkmail/native.git
synced 2026-10-31 00:06:17 +00:00
Linus Rath
6f0abb4384
Every published APK up to 0.1.62 was signed with the React Native template's debug keystore, whose key is public. Anyone could sign an "update" that Android installs over the app, with access to its SecureStore credentials and mail cache. The release build type fell back to the debug signing config whenever no release key was passed, and the workflow carried on silently when `ANDROID_KEYSTORE_BASE64` was empty. - `android/app/build.gradle` reads the release key from the `BULWARK_RELEASE_*` gradle properties or environment variables and has no fallback. Without them a release build fails in the new `checkReleaseSigning` task. It only runs for release variants, so debug builds and `expo run:android` are unchanged. A local test build can opt in with `-PallowDebugSignedRelease=true`, which is ignored whenever `CI` is set. - The release workflow fails in its first step when a signing secret is missing, checks the keystore, alias and password before the build, and refuses a debug key uploaded as the release key. - An optional `ANDROID_SIGNING_LINEAGE_BASE64` secret re-signs the APK with APK Signature Scheme v3 key rotation from the debug key to the release key, from API 28, so existing installs on Android 9+ can update and stop trusting the debug key afterwards. - Before anything is uploaded, `apksigner verify` has to show the release key as the Android 9+ signer, never the debug certificate. - `*.keystore` and `*.lineage` files are gitignored. Audit item S2 in `docs/audit-2026-09.md`.
66 lines
895 B
Plaintext
66 lines
895 B
Plaintext
# Learn more https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files
|
|
|
|
# dependencies
|
|
node_modules/
|
|
|
|
# Expo
|
|
.expo/
|
|
dist/
|
|
web-build/
|
|
expo-env.d.ts
|
|
|
|
# Native
|
|
.kotlin/
|
|
*.orig.*
|
|
*.jks
|
|
*.p8
|
|
*.p12
|
|
*.key
|
|
*.mobileprovision
|
|
*.keystore
|
|
!/android/app/debug.keystore
|
|
*.lineage
|
|
|
|
# Metro / Expo dev-server logs
|
|
.metro-health-check*
|
|
metro.log
|
|
expo.log
|
|
expo-run.log
|
|
scripts/*.log
|
|
|
|
# Scratch
|
|
tmp-*
|
|
|
|
# debug
|
|
npm-debug.*
|
|
yarn-debug.*
|
|
yarn-error.*
|
|
|
|
# macOS
|
|
.DS_Store
|
|
*.pem
|
|
|
|
# local env files
|
|
.env*.local
|
|
|
|
# typescript
|
|
*.tsbuildinfo
|
|
|
|
# generated native folders
|
|
/ios
|
|
|
|
# Android build outputs (track the project itself, not its build artifacts)
|
|
/android/.gradle/
|
|
/android/.idea/
|
|
/android/.kotlin/
|
|
/android/build/
|
|
/android/app/build/
|
|
/android/app/.cxx/
|
|
/android/local.properties
|
|
/android/captures/
|
|
/android/*.iml
|
|
/android/app/*.iml
|
|
/android/build-release.log
|
|
/android/expo*.log
|
|
/android/metro.log
|