Harden Android release artifact verification

.github/workflows/android-build.yml

@@ -115,4 +115,6 @@ jobs:
           path: artifacts
 
       - name: Verify Android artifact reproducibility proofs
+        env:
+          MAPLE_REQUIRE_ANDROID_SIGNATURE_VERIFICATION: "1"
         run: nix develop .#android -c ./scripts/ci/verify-release-artifacts.sh artifacts android

.github/workflows/release.yml

@@ -423,6 +423,34 @@ jobs:
             frontend/src-tauri/target/reproducibility/web-final.sha256 \
             --clobber
 
+  verify-android-release-artifacts:
+    needs: build-android
+    runs-on: ubuntu-latest-8-cores
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        with:
+          github-token: ""
+
+      - name: Download release artifacts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          mkdir -p artifacts
+          gh release download "${RELEASE_TAG}" -D artifacts
+
+      - name: Verify Android release artifact reproducibility proofs
+        env:
+          MAPLE_REQUIRE_ANDROID_SIGNATURE_VERIFICATION: "1"
+        run: nix develop .#android -c ./scripts/ci/verify-release-artifacts.sh artifacts android
+
   update-latest-json:
     needs: build-tauri
     runs-on: ubuntu-latest
@@ -482,10 +510,10 @@ jobs:
   verify-release-artifacts:
     needs:
       - build-tauri
-      - build-android
       - build-ios
       - build-web
       - update-latest-json
+      - verify-android-release-artifacts
     runs-on: macos-26-xlarge
     permissions:
       contents: read
@@ -527,4 +555,4 @@ jobs:
           gh release download "${RELEASE_TAG}" -D artifacts
 
       - name: Verify release artifact reproducibility proofs
-        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts all
+        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts linux macos ios web latest-json

scripts/ci/verify-release-artifacts.sh

@@ -211,14 +211,19 @@ verify_android_payload_equivalence() {
 }
 
 verify_android_signatures_optional() {
-  local artifact
+  local artifact require_signatures
+
+  require_signatures="${MAPLE_REQUIRE_ANDROID_SIGNATURE_VERIFICATION:-0}"
 
   while IFS= read -r -d '' artifact; do
     case "${artifact}" in
       *.apk)
         if command -v apksigner >/dev/null 2>&1; then
           apksigner verify --verbose "${artifact}" >/dev/null
           printf 'verified-android-apk-signature  %s\n' "$(basename "${artifact}")"
+        elif [ "${require_signatures}" = "1" ]; then
+          echo "apksigner is required to verify Android APK signatures." >&2
+          return 1
         else
           printf 'skipped-android-apk-signature  missing-apksigner  %s\n' "$(basename "${artifact}")"
         fi
@@ -227,6 +232,9 @@ verify_android_signatures_optional() {
         if command -v jarsigner >/dev/null 2>&1; then
           jarsigner -verify "${artifact}" >/dev/null
           printf 'verified-android-aab-signature  %s\n' "$(basename "${artifact}")"
+        elif [ "${require_signatures}" = "1" ]; then
+          echo "jarsigner is required to verify Android AAB signatures." >&2
+          return 1
         else
           printf 'skipped-android-aab-signature  missing-jarsigner  %s\n' "$(basename "${artifact}")"
         fi