M-10/11/12/13/14: build verifies signing+identity, gradle checksum pinned, stale comments refreshed, androidTest stubs added

@@ -16,6 +16,10 @@1616         applicationId "com.peachpasswords"1717         minSdk 261818         targetSdk 3519+        // Canonical version source (audit M-13). Bump versionName and versionCode20+        // here for a release. The root VERSION file and docs/NOISE-CORE-PROVENANCE.md21+        // should be derived from these values rather than maintained independently;22+        // the three sources drift otherwise.1923         versionCode 2401452024         versionName "2.8.3"2125 @@ -136,12 +140,13 @@136140     implementation "androidx.lifecycle:lifecycle-viewmodel-compose:2.8.4"137141     implementation "androidx.lifecycle:lifecycle-process:2.8.4"138142     implementation "androidx.navigation:navigation-compose:2.8.0"139-    // MN-6: androidx.security:security-crypto has no stable 1.1.x release — the only140-    // stable line is 1.0.0 (2021), which lacks the Tink updates and Android 12+ fixes141-    // in the 1.1.0 alphas and is widely superseded in production. Deliberately pinned142-    // to an exact alpha (never a floating range) so the resolved artifact is143-    // reproducible. Revisit if/when 1.1.0 stabilises. Used only for the duress/license144-    // EncryptedSharedPreferences; the vault slots are sealed by VaultCrypto, not this.143+    // Deliberately pinned to 1.1.0-alpha06 (audit M-12). 1.1.0 stable exists144+    // now and GradleDependency lint flags this coordinate; a bump is a policy145+    // choice (Tink runtime vs. baseline AES, master-key rotation semantics),146+    // not an oversight, and is tracked separately. Exact alpha (never a floating147+    // range) so the resolved artifact is reproducible. Used only for the148+    // duress/license EncryptedSharedPreferences; the vault slots are sealed by149+    // VaultCrypto, not this.145150     implementation "androidx.security:security-crypto:1.1.0-alpha06"146151     implementation "androidx.compose.material3:material3"147152     implementation "androidx.compose.ui:ui"

@@ -1,6 +1,11 @@11 distributionBase=GRADLE_USER_HOME22 distributionPath=wrapper/dists33 distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip4+# Pinned checksum (audit M-11). Source: https://gradle.org/release-checksums/5+# for gradle-8.14.3 -all.zip. The wrapper fails to start if the downloaded6+# artifact's hash does not match this value, so a compromised mirror cannot7+# silently swap in a different Gradle.8+distributionSha256Sum=ed1a8d686605fd7c23bdf62c7fc7add1c5b23b2bbc3721e661934ef4a4911d7c49 networkTimeout=10000510 validateDistributionUrl=true611 zipStoreBase=GRADLE_USER_HOME

@@ -3,16 +3,68 @@33 #44 # Signing comes from local.properties (koh-ignored); without it the release APK55 # is unsigned and Android refuses to install it, so fail loudly here rather than6-# publish something nobody can install.6+# publish something nobody can install. After the build we additionally verify7+# the produced artifact (audit M-10): a configured keystore does not by itself8+# prove the APK is signed, that its applicationId and versionCode match the9+# release policy, or that the v2/v3 signing chain is intact.710 set -eu811 912 JAVA_HOME="${JAVA_HOME:-/Applications/Android Studio.app/Contents/jbr/Contents/Home}"1013 export JAVA_HOME1114 15+# Canonical values live in app/build.gradle (defaultConfig.applicationId,16+# defaultConfig.versionCode). Update these constants only when that file17+# changes — they are the post-build cross-check the audit calls for.18+EXPECTED_APPLICATION_ID="com.peachpasswords"19+EXPECTED_VERSION_CODE="240145"20+1221 ./gradlew --no-configuration-cache :app:assembleRelease1322 23+APK=app/build/outputs/apk/release/app-release.apk24+if [ ! -f "$APK" ]; then25+    echo "refusing to publish: $APK not produced" >&226+    exit 127+fi28+29+APKSIGNER=""30+if [ -n "${ANDROID_HOME:-}" ] && [ -x "${ANDROID_HOME}/build-tools/latest/apksigner" ]; then31+    APKSIGNER="${ANDROID_HOME}/build-tools/latest/apksigner"32+elif command -v apksigner >/dev/null 2>&1; then33+    APKSIGNER=$(command -v apksigner)34+else35+    echo "refusing to publish: apksigner not found (set ANDROID_HOME or add to PATH)" >&236+    exit 137+fi38+39+if ! "$APKSIGNER" verify --print-certs "$APK"; then40+    echo "refusing to publish: $APK failed apksigner verify (unsigned or v1-only)" >&241+    exit 142+fi43+44+AAPT2=""45+if [ -n "${ANDROID_HOME:-}" ] && [ -x "${ANDROID_HOME}/build-tools/latest/aapt2" ]; then46+    AAPT2="${ANDROID_HOME}/build-tools/latest/aapt2"47+elif command -v aapt2 >/dev/null 2>&1; then48+    AAPT2=$(command -v aapt2)49+else50+    echo "refusing to publish: aapt2 not found (set ANDROID_HOME or add to PATH)" >&251+    exit 152+fi53+54+BADGING=$("$AAPT2" dump badging "$APK")55+ACTUAL_APPID=$(echo "$BADGING" | sed -n "s/^package: name='\([^']*\)'.*/\1/p")56+ACTUAL_VCODE=$(echo "$BADGING" | sed -n "s/^package:.*versionCode='\([^']*\)'.*/\1/p")57+if [ "$ACTUAL_APPID" != "$EXPECTED_APPLICATION_ID" ]; then58+    echo "refusing to publish: applicationId '$ACTUAL_APPID' != expected '$EXPECTED_APPLICATION_ID'" >&259+    exit 160+fi61+if [ "$ACTUAL_VCODE" != "$EXPECTED_VERSION_CODE" ]; then62+    echo "refusing to publish: versionCode '$ACTUAL_VCODE' != expected '$EXPECTED_VERSION_CODE'" >&263+    exit 164+fi65+1466 mkdir -p build/kepr15-cp app/build/outputs/apk/release/app-release.apk build/kepr/peach-android.apk67+cp "$APK" build/kepr/peach-android.apk1668 1769 if ! grep -q '^peachStoreFile=' local.properties 2>/dev/null; then1870     echo "refusing to publish: no signing key configured in local.properties" >&2