From 8c4993cae28cba38710bdcc7c7321641b9d73e26 Mon Sep 17 00:00:00 2001 From: ltadeu6 Date: Mon, 25 May 2026 15:53:22 -0300 Subject: [PATCH] Add Android release signing secrets --- AGENTS.md | 11 +++++ hosts/Nixos/configuration.nix | 54 +++++++++++++++++++++ secrets/android_release_key_password.age | Bin 0 -> 410 bytes secrets/android_release_keystore.age | Bin 0 -> 4652 bytes secrets/android_release_store_password.age | 7 +++ secrets/secrets.nix | 3 ++ 6 files changed, 75 insertions(+) create mode 100644 secrets/android_release_key_password.age create mode 100644 secrets/android_release_keystore.age create mode 100644 secrets/android_release_store_password.age diff --git a/AGENTS.md b/AGENTS.md index 23396c3..303a1b5 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -554,6 +554,9 @@ Estado atual: - `secrets/openai_api_key.age` - `secrets/openclaw_gateway_token.age` - `secrets/forgejo_api_token.age` +- `secrets/android_release_keystore.age` +- `secrets/android_release_store_password.age` +- `secrets/android_release_key_password.age` - `secrets/minecraft_rcon_password.age` - `secrets/wireguard_private_key.age` @@ -572,6 +575,14 @@ Estado atual: - `/etc/profile.d/openai.sh`, `/etc/profile.d/openclaw.sh` e `/etc/profile.d/forgejo.sh` fazem o mesmo para shells de login. - O token do Home Assistant do Waybar AC NAO esta sob agenix neste repo; ele e lido diretamente de `~/.config/secrets/ha_token`. +### Android signing + +- A chave de assinatura Android para distribuicao fora da Play Store fica em `secrets/android_release_keystore.age`. +- As senhas ficam em `secrets/android_release_store_password.age` e `secrets/android_release_key_password.age`. +- O alias padrao da chave e `release`. +- O helper `android-signing-env` exporta `ANDROID_KEYSTORE_PATH`, `ANDROID_KEYSTORE_TYPE`, `ANDROID_KEY_ALIAS`, `ANDROID_KEYSTORE_PASSWORD` e `ANDROID_KEY_PASSWORD` apenas para o comando filho. +- Use `android-signing-env ./gradlew assembleRelease` ou `android-signing-env ./gradlew bundleRelease`; nao exporte essas senhas globalmente. + ## Dependencias implicitas e pontos de atencao Itens que um agente deve verificar antes de mexer: diff --git a/hosts/Nixos/configuration.nix b/hosts/Nixos/configuration.nix index f321736..e4a141a 100644 --- a/hosts/Nixos/configuration.nix +++ b/hosts/Nixos/configuration.nix @@ -9,6 +9,35 @@ let repoDir = "${homeDir}/Projetos/Sistemas/nixos-config"; codexStatusPath = "/var/lib/hass/codex_status.json"; claudeUsagePath = "/var/lib/hass/claude_usage.json"; + androidSigningEnv = pkgs.writeShellScriptBin "android-signing-env" '' + set -eu + + secret_dir=/run/agenix + for secret in \ + android_release_keystore \ + android_release_store_password \ + android_release_key_password + do + if [ ! -r "$secret_dir/$secret" ]; then + echo "Missing readable Android signing secret: $secret_dir/$secret" >&2 + exit 1 + fi + done + + export ANDROID_KEYSTORE_PATH="$secret_dir/android_release_keystore" + export ANDROID_KEYSTORE_TYPE=PKCS12 + export ANDROID_KEY_ALIAS=release + export ANDROID_KEYSTORE_PASSWORD="$(${pkgs.coreutils}/bin/cat "$secret_dir/android_release_store_password")" + export ANDROID_KEY_PASSWORD="$(${pkgs.coreutils}/bin/cat "$secret_dir/android_release_key_password")" + + if [ "$#" -eq 0 ]; then + echo "Android signing environment is ready." + echo "Run: android-signing-env ./gradlew assembleRelease" + exit 0 + fi + + exec "$@" + ''; haAirConditioner = "climate.ar"; haLaundryDryingToggle = "input_boolean.secar_roupas"; haClimateAction = action: data: { @@ -181,6 +210,30 @@ in { mode = "0400"; }; } // lib.optionalAttrs + (builtins.pathExists ../../secrets/android_release_keystore.age) { + android_release_keystore = { + file = ../../secrets/android_release_keystore.age; + owner = username; + group = "users"; + mode = "0400"; + }; + } // lib.optionalAttrs + (builtins.pathExists ../../secrets/android_release_store_password.age) { + android_release_store_password = { + file = ../../secrets/android_release_store_password.age; + owner = username; + group = "users"; + mode = "0400"; + }; + } // lib.optionalAttrs + (builtins.pathExists ../../secrets/android_release_key_password.age) { + android_release_key_password = { + file = ../../secrets/android_release_key_password.age; + owner = username; + group = "users"; + mode = "0400"; + }; + } // lib.optionalAttrs (builtins.pathExists ../../secrets/minecraft_rcon_password.age) { minecraft_rcon_password.file = ../../secrets/minecraft_rcon_password.age; @@ -1381,6 +1434,7 @@ in { nodePackages.prettier nodePackages.pnpm fishPlugins.z + androidSigningEnv ]; # environment.loginShellInit = '' diff --git a/secrets/android_release_key_password.age b/secrets/android_release_key_password.age new file mode 100644 index 0000000000000000000000000000000000000000..73871afe1f064004741d5c5cec1ed9a9ca32ef5f GIT binary patch literal 410 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E?0=K2#;_L z$WHcls!B7>FU*NBsY=V!F7>l?4)yXd4k*paDAz9uNC{4JDd)=d^)@#wFiz30%nl2z zayHe@H_q@6&+`k((=RC04{|I>&Ps7lF%Hg7%*SC{aCU}aW{9bOW>Tqhsb_#`aeiUSeMj_GAjMz4xtU*m3T8 lTldQ3tGVB$vO2pP56TqwKD@U_InuI3eDS@;#J&yH4gj*5m+k-n literal 0 HcmV?d00001 diff --git a/secrets/android_release_keystore.age b/secrets/android_release_keystore.age new file mode 100644 index 0000000000000000000000000000000000000000..9f9f3d64a075bf28c0436cfa4b9b8ff879f85a3b GIT binary patch literal 4652 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E?4j=a`W`g z4h>B*HnXrODJ@Jj&GXjJ@hmCG3^58fP4RP%D$UI_4mT=Ex8TY%D=A5;2n@{&(YGkd zs0cK)(5`SU%Sx@POiK%K*Eh?naEsIq)VDM*HNat;X^>Y`VUTA~zHgR$Np@mYrkPv5 zv0s3ZnXiXmVY-`-rAcI^SEW%%R$ww$SY$z-VXjkUPI$VrabZeDaA0O+PPw^>TXs%h zkzrM2cv(@hg>jT+YEmSZuCA_vZ>VQ#czTXYke7?IX+dB_VrEIciI={&zj;Y+Mvj4x ziIZoDZ@7PUfmbmX+t%Z!TeY9Q$%wujc~;R{N@%XmjPwq!NSWnR6neH#`Ecc*MeczT zS$o+#^KK>VY%xv!^Zm)4$J5dp%@QMitbTP}ssEc*6kqFYM;pyk2@2c?ADl9fP$)fi zWxk+LPu}lW%i5AJPpVMYo_8btulAFJA0k)A7Ci2qvt$dqf4v*W%%69sJIoS3V|j8d zXCsfJL6Tb5_6Kf0E7%-AM8D_~3KS^iD4u+Cdy9>Rw_N2V##1k+xnJG!ODf^&$M~mn zc=8`RPf%@Oj&*SRs=a$__X?HChC7ZV-nRdLJ!GE?TmR?Pfp(k^d>9+AZqn0||Fk*e zj?r#QA7#W%9&tPCrgp}H&O zyu24WwiPI?`4Fab$*r*J$P(%77oXmkE!aFkk;#r#yTEN*rQ(IZ-(Q=YHE+!R&spw# zb>{NJKlEGFC$&YK4)~L<@cfg-^~EjI!X=caiEpd_(_P`M`~Kxd>w<6Z^>00WoWj($ z;iF8zJvXQAA=&5IC8fSMJ$aV(rQt+K>Z`XrhW>_!Gyf`v>=%81H|?jr#YSG=e;2|h zoVLtd-FDe$dGSIqjrFDb*Q?20t+F#zDP3|iD_~#V^NKuAag8he+rQYYIRKFSYWBI?q`mjjmzR7eXV;!x{^_^-y@L;;dsgaPJ!-C%yzt1zcRJC5 zTaWCi>S(*=W2xfy<=x(OB4!V+7INChth=~|cUFCy_^-4lFEST7d0!F8ARqv`+n*GI?}nST&g4w(NhSIgXz z`{AU|+fpYoYW}%;OjvibS=-$B?Fk=eE_VG=#Ok}`ST6H_3rDxdi<~89NiA}g^FICa z#f7!szPq=sRyJ+Xj!6sDn*Va2$_kYe4i9d6pQ)d>S!#vwA~n zqea`_3#?w@Z6rA5$KP+>d^113;rIPsww15+2-nWJISqU&|4R?;;wu(&eYBo?`MNr} zxgp`2D;|^|iJA9xQ%s+XDd$+vQANxfT`flf+&d{~?vZ%fjAQ_)x_BhV`3dgRj z*ewe*CTwA3d)%QLzF0PNilT7e*|q8q3~y&IGMV(Z_)m4g{WR4@@p`lPr|y-Kki0VK z+x15|b@Pt1x=wsJX^-vuS<(A`ZP^ffTWwCy?;kBD3_E^#$g9O|m~{PIP_pDdvj_9u z?_B0{WQNJ&e`k$c9&NinshZ_dp`*(Qzoi~fUIIj&23cFTTyV;WY*vuK5qoU^lT zft>9R%ZnXp_e%cWRoI~8dDDtv>Jvewsj{*kOcQi>XDf1kdiKYAZp%A|hYKHSSHB3H z`0a*ao9TlCryC8}CWi1`*rMkC&%%DeyGxTcD4sV^y|UKnsrH^3-k&$EoujZLwYTd> z<*MT^g3G6USu}sD@4TEZj^edNs)_q<*Bo6{ID68Ujc1Ri&saL`vABn##tr93-*b$Q zef=$%T;l%pcz2CI*H10AL(@9qUf%ScY|^rFVY28??XymGVMfdS+^RM#+QQk{Zfvi|wGM+DAt&+4$*^kYHCr_Va~PQKZ$wxaDsYx;%X${%*Srv*&(`%=Z8 zxot<)FhF$ z+h6BLa29_#9=iF#nUJfteL6oUDkw;`aNpPCe%c)Y5OzPYr04N?dAVq z5O25X;ntnvOLv~%5_hzP)w?6#ZqnMY2N#yge^S`1s&`dtS-ObZeWm_|O+N(77cS&{ zc6MgNdLOM-C*B;1kkU365mr8BmGh=2D(7uA@i52!xm(QFM>!XCZaWirCa4y$f+AkAvVLkQU{h~hqi~|qS3pr+O zQ0#xK7*MEMUadXem^@GYVAQ;ZjeAn!_T|2o?>Lk^ zsqy9Pxs9xjnhTiZS!A!={crY|nO*ePNp*R*OZrt)wa+jqe-hdvD6U<`Ydrs(zx>V=f?<)LEjCz){GI$)J62_up~%LauHCl}?3#Pz z_7B@A$ICY-S8g`ibs>+@M3A{H@wdrAjX)-r&r%aiH_UIm)AsLReUJ0**;SlzoIa0c ze_uUCAWUl8Zk>sLKE9Z~!k=r#mq)w3(r)e3JJJ0tt0aEz+13BoS8U68(Df!`sce)} zr}zDJ)x6WWd89v`o3B>ZBz`?rrMma0T+>A+xw*E17pHZ5?yP;86e#e%?)#Km?B5ji z+9DoYlC~(}T`@N-IkCEm=Y_UQ+_6ul=2qqt#FaHAre2kQ!LlOb;bBGl?Y_xxZ>=~t z=Rw&%_Qe%yPKygPl)E$UPFXA))xX9e&r7yBe#Z9WbB{l8*=2dGFjlHMRdx5N!XVe$ zy*Yd8qpnDm*4}#c#iCRyT9R+)*?Nut#cz`Bj`N<`*?nSDu6Vo#Q|yHapRH?+_*UBX zeA%J3YWlD3E8FK=IQrf)-Ldk@Mzz^DSmxV5_{CS1TF>PXmweKme^T&*n!3rK0(t|~ zV?5I2PmA?0dOy!>TZO1yedWvT@}`D@3p2l;X>&`Tb5ZxCtFq73y7C3hjt0EZ`}}S? zw(!4PX+G!eqxFWHb=?X%V(;+QEf=2X8Y(Mqo0C5^JHYR5e)j&WyY_Y8vc8sm?)E{( z&zi-Dw!TX**D-v#FoI{#tLe`owyn3n)47d%Ud3Dk+h?Z#l!a_!(m&Jw^o#VYTarj^LL+uMR%A74J5S3A|p);+LB zU-)?R-opNe6+oH!>_juC?Y7j8f8MiyQai=hPPrP8k>aSd zqAz^+ud_!5>NiFo(GfdavVHTx&H9ZO8$Ook7ngJ#3R>`c?x9#GbGw!wuf#2%>V7&> zUCr?R&AcLOyHD8`^Ya6Q=at;_EI;y&rT6yYr>Ea>-nRB`Rabjr_vh0d$-^G&kNs0i zU$EBq>b+b1*5bRR&%4|HJCrEC{(8?@(N* z9-dQnRryyM9@&={eQpKATcO3;QU4a6-RtkZ_D8hoHx?$LZBbY?@o@2zz>@j$>xu(6CZE#EWIVR1K7rTrrQPxl zGqr%axUwZ>{p*4z`<`FceQMpr$#a}fD$M?(YPdakM)!s0(&TMFqmLJu7gcFbS6fo% z5?X%bNyGbfs-G9=8R#_kt8(6!m!Gk3=Z1By+Ou|Tl$sgPB$~}%l<(bLvClYq`-TXS z7vD{e`@IZ5B>&+`>hV|YJD2}jl=0gvc;EAhw$(;&?u0)3>hWarncn_Q$7EkS-(ll* z_2}A>f8py5?&ROWzU%b!{-^$pyq*>iq%88izxg$T)4lzdu9{r@b=xgo>-tfFlo`ev zQR;t~tC@UeetkN%B9iHm%6`5>FNA|N{u)U}Of9-=>DD!EN8@=J1`h3X<%I&W_DqLP zFDd%@ra53^>}J+$ylbwSJMK`mDR|s2b=F6+wCeqgKlw9EkKE&HJ*Q?TCU!LD2g3>$ z7hbnRPZ>NT&C}CMXYBZVf8YF^t4(tEmEt)L)ri-=bB(M>ET~Y?ubnJ*M`!D+9}@TG zS{ge0Zg?nR%vRQCv2z-)%4SK1XM6K*`-`O9QOrA|%wf)a;BT-x$J1=V{lOFVJxNkL zvwvPh0gvL(^m`9}l)e#VTmI$Jfk#1?etdklI`?~jMX1NEDGRt}xb0jBVvtM0)yT6|1N;-1G+UiSK33JzRCfDGSRTf9io#)iaS>5LHa#ih{$drn`M}yug zHCHfr?p6_NsgHdkb~Myj->_?E!B>-Fv5xOn(nXRcN}Dy6CK=E1NVG9$$rtKthzquQ z?zg4(z=g)+GuDgk?|Z}JXlu+HvvS4p%X^pB95?@b#5}7=zhjBVQl~Hcf2y{28D7$p wo^HdEyY#!tBDTIWyX>nfRl+~@|5gt1+kD!HL#J@9@Gs%l2i4|xT(dk60D4RBssI20 literal 0 HcmV?d00001 diff --git a/secrets/android_release_store_password.age b/secrets/android_release_store_password.age new file mode 100644 index 0000000..42760e7 --- /dev/null +++ b/secrets/android_release_store_password.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 PLsDCw gBKNuM+9I8jE0FR2MQBQIqkLvwb3zq0LKf0bwB8yIXk +spy1+Ok6fFoEGsVrnPHrWeNL49cpyBc+RxDjfmk3r6E +-> ssh-ed25519 PLsDCw b982WTJWcZfyQ0yu1NFYzOsE761V3AbciXYN4TngL3U +b3hXtIY24EPP4mcCGn4BPtsHk46YLGQr7ZOheghyS6w +--- viMGGTPm8ItU7jb1OK7045U0o1BM2SbDwVJ7qXVp9E4 +b.q`io9~+78-! @LEWf§Ywx(`z8pK~3 OtKX{cWЉY}4Pdzdf!,죫W \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 6f93c25..245f60b 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -10,6 +10,9 @@ in { "secrets/openai_api_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/openclaw_gateway_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/forgejo_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; + "secrets/android_release_keystore.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; + "secrets/android_release_store_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; + "secrets/android_release_key_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ]; "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];