diff --git a/.github/workflows/android-build.yml b/.github/workflows/android-build.yml index 2609e7700..6367a8a4a 100644 --- a/.github/workflows/android-build.yml +++ b/.github/workflows/android-build.yml @@ -115,4 +115,6 @@ jobs: path: artifacts - name: Verify Android artifact reproducibility proofs + env: + MAPLE_REQUIRE_ANDROID_SIGNATURE_VERIFICATION: "1" run: nix develop .#android -c ./scripts/ci/verify-release-artifacts.sh artifacts android diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7f1ac21a2..d8dcdf73a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -423,6 +423,34 @@ jobs: frontend/src-tauri/target/reproducibility/web-final.sha256 \ --clobber + verify-android-release-artifacts: + needs: build-android + runs-on: ubuntu-latest-8-cores + permissions: + contents: read + steps: + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 + with: + persist-credentials: false + + - name: Install Nix + uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22 + with: + github-token: "" + + - name: Download release artifacts + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + RELEASE_TAG: ${{ github.event.release.tag_name }} + run: | + mkdir -p artifacts + gh release download "${RELEASE_TAG}" -D artifacts + + - name: Verify Android release artifact reproducibility proofs + env: + MAPLE_REQUIRE_ANDROID_SIGNATURE_VERIFICATION: "1" + run: nix develop .#android -c ./scripts/ci/verify-release-artifacts.sh artifacts android + update-latest-json: needs: build-tauri runs-on: ubuntu-latest @@ -482,10 +510,10 @@ jobs: verify-release-artifacts: needs: - build-tauri - - build-android - build-ios - build-web - update-latest-json + - verify-android-release-artifacts runs-on: macos-26-xlarge permissions: contents: read @@ -527,4 +555,4 @@ jobs: gh release download "${RELEASE_TAG}" -D artifacts - name: Verify release artifact reproducibility proofs - run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts all + run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts linux macos ios web latest-json diff --git a/scripts/ci/verify-release-artifacts.sh b/scripts/ci/verify-release-artifacts.sh index 958c79ac2..871c90766 100755 --- a/scripts/ci/verify-release-artifacts.sh +++ b/scripts/ci/verify-release-artifacts.sh @@ -211,7 +211,9 @@ verify_android_payload_equivalence() { } verify_android_signatures_optional() { - local artifact + local artifact require_signatures + + require_signatures="${MAPLE_REQUIRE_ANDROID_SIGNATURE_VERIFICATION:-0}" while IFS= read -r -d '' artifact; do case "${artifact}" in @@ -219,6 +221,9 @@ verify_android_signatures_optional() { if command -v apksigner >/dev/null 2>&1; then apksigner verify --verbose "${artifact}" >/dev/null printf 'verified-android-apk-signature %s\n' "$(basename "${artifact}")" + elif [ "${require_signatures}" = "1" ]; then + echo "apksigner is required to verify Android APK signatures." >&2 + return 1 else printf 'skipped-android-apk-signature missing-apksigner %s\n' "$(basename "${artifact}")" fi @@ -227,6 +232,9 @@ verify_android_signatures_optional() { if command -v jarsigner >/dev/null 2>&1; then jarsigner -verify "${artifact}" >/dev/null printf 'verified-android-aab-signature %s\n' "$(basename "${artifact}")" + elif [ "${require_signatures}" = "1" ]; then + echo "jarsigner is required to verify Android AAB signatures." >&2 + return 1 else printf 'skipped-android-aab-signature missing-jarsigner %s\n' "$(basename "${artifact}")" fi