weblib/fdroid-repo-ci
2
0
Fork 0
Code Issues Pull Requests Actions Activity

Take sign-apk.sh out of the default publish path; document the never-an-app-key invariant

Browse Source 
bit settled the model on weblib-viewer#19: the builder signs an APK, and
this repo only distributes it -- the same signature has to work whether the
APK reached a device via a git release or via F-Droid, and fdroid update
never creates a signature of its own. sign-apk.sh remains for a consumer
whose build genuinely produces an unsigned artifact, but action.yml's
header comment and the README's "Using it" example no longer show it as a
default-flow step, and both now say explicitly that this repo is never
handed an app signing key -- only the repo index key.

Also records two decisions that had nowhere to live yet: the index key's
config/secret names must stay distinct from the APK key's even while both
resolve to the same keystore for now (bit intends to split them later), and
the index key must be generated as RSA 4096, overriding F-Droid's own docs,
which suggest 2048.

Fixes #9.

Co-authored-by: bit <bit@das-labor.org>
This commit is contained in:
claude
2026-09-09 12:40:03 +00:00
co-authored by bit
parent 0778a88762
commit a5e4cb6a01
2 changed files with 112 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
action.yml
+17 -6
View File
@@ -10,17 +10,28 @@
# - uses: actions/checkout@v4
# - id: ci
# uses: https://git.chaosbit.de/weblib/fdroid-repo-ci@main
# - run: bash "${{ steps.ci.outputs.path }}/sign-apk.sh" ...
# - run: bash "${{ steps.ci.outputs.path }}/fdroid-update.sh" ...
# - run: bash "${{ steps.ci.outputs.path }}/publish.sh" ...
#
# sign-apk.sh is deliberately not in that default flow: the builder signs
# the APK before it ever reaches this action (weblib-viewer#19), so this
# repo's normal job is to index and publish an already-signed artifact.
# sign-apk.sh stays available for the exceptional consumer whose build
# genuinely produces an unsigned APK -- see the README.
#
# Nothing here reads a secret or names a bucket, a keystore or a consumer
# repo -- those all stay on the caller's side of this action's output path.
# This action is also never handed an *app* signing key -- only the repo
# index key that fdroid-update.sh signs the index with (see README).
name: F-Droid repo publishing tools
description: >-
Shared, key-free tooling to align-check and sign a prebuilt APK, run
`fdroid update` over a binary repo, compute the next monotonic versionCode
for a commit's committer date, and publish the result to an S3-compatible
bucket. The caller supplies the keys, the bucket, the APK and the commit
being built; this action supplies the pinned toolchain and the scripts.
Key-free tooling to index an already-signed F-Droid binary repo (`fdroid
update`), compute the next monotonic versionCode for a commit's committer
date, and publish the result to an S3-compatible bucket. Also includes
sign-apk.sh for the exceptional consumer whose build does not already
produce a signed APK. The caller supplies the keys, the bucket, the APK
and the commit being built; this action supplies the pinned toolchain and
the scripts.
outputs:
path: