Capture raw apksigner output cross-platform

[awatchar]

Root cause

The first parser fix correctly tolerated ANSI/ErrorRecord prefixes, but the release rerun proved PowerShell's native-command stream adapter can discard the extensionless Linux launcher's stdout before parsing. Failed run: https://github.com/awatchar/minimum/actions/runs/31728926851. It failed safely before Release publication; there are no assets.

Fix

• invoke extensionless Unix apksigner directly through System.Diagnostics.Process and apksigner.bat through cmd /d /s /v:off /c
• concurrently drain raw stdout/stderr, enforce a 30-second timeout, preserve exit-code and exact single-signer validation, and never log raw output
• reject quote/newline/NUL path characters plus percent expansion for the cmd path
• make release CI feed the actual signed release APK through Get-ApkSignerDigests
• add adversarial path tests; retain the real locally signed APK integration test

Local verification

• Windows PowerShell 5.1 updater/state-machine tests: 32/32 passed, including real APK/apksigner.bat
• PowerShell AST: passed
• cellular policy checks: passed
• git diff --check: passed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
minimum	Ignored		Aug 13, 2026 6:19pm