Skip to content

Make release ZIP checksum portable #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
awatchar merged 1 commit into from
Aug 20, 2026
Merged

Make release ZIP checksum portable #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion .github/workflows/release-apk.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -302,7 +302,21 @@ jobs:
pwsh -NoLogo -NoProfile -Command \
". '$extracted_root/scripts/update-minimum-device.ps1' -LibraryOnly; Read-ReleaseBundle -Root '$extracted_root' | Out-Null; \$identity = Get-ApkManifestIdentity -ApkPath '$extracted_root/minimum-foss.apk'; if (\$identity.ApplicationId -cne 'se.lublin.mumla' -or \$identity.VersionName -cne '$RELEASE_TAG') { throw 'Extracted updater APK identity verification failed.' }; \$signers = @(Get-ApkSignerDigests -ApkPath '$extracted_root/minimum-foss.apk'); if (\$signers.Count -ne 1 -or \$signers[0] -cne '$MINIMUM_APK_SIGNER_SHA256') { throw 'Extracted updater APK signer-set verification failed.' }"
echo "Provisioning bundle verification passed: exact allowlist, regular files, no symlinks, safe paths, staged and extracted content checks."
sha256sum "$OUTPUT_ZIP" > "$OUTPUT_ZIP.sha256"
# Keep the published checksum portable: the checksum entry must bind
# only the released asset name, never the runner's absolute path.
output_dir="$(dirname "$OUTPUT_ZIP")"
output_name="$(basename "$OUTPUT_ZIP")"
(
cd "$output_dir"
output_sha256="$(sha256sum "$output_name" | cut -d' ' -f1)"
printf '%s %s\n' "$output_sha256" "$output_name" > "$output_name.sha256"
expected_checksum_line="$output_sha256 $output_name"
if [[ "$(cat "$output_name.sha256")" != "$expected_checksum_line" ]]; then
echo "Provisioning ZIP checksum does not bind the exact portable asset filename." >&2
exit 1
fi
sha256sum --check "$output_name.sha256"
)
- name: Prepare reviewed release notes
env:
RELEASE_TAG: ${{ inputs.tag }}
Expand Down
3 changes: 2 additions & 1 deletion docs/GITHUB_RELEASE_WORKFLOW.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,8 @@ release also contains `minimum-provisioning-<tag>.zip`, a standalone Windows bun
APK, provisioning/updater launchers, guarded T99/T56 scripts including the cellular migration,
prebuilt temporary Wi-Fi helper, updater README and cellular-policy README. The manifest and
workflow share an exact reviewed file allowlist. The bundle uses the included APK/helper and does
not require a source checkout or Gradle on the field workstation. Its
not require a source checkout or Gradle on the field workstation. Published checksum entries bind
only their exact asset basenames, so standard checksum tools do not depend on a CI runner path. Its
protected `release` environment must provide:

- `MINIMUM_RELEASE_KEYSTORE_BASE64`
Expand Down
Loading