meshcore-client

Author SHA1 Message Date

Author	SHA1	Message	Date
Strycher	49f8ca15c8	fix(#346 ): extract signing cert SHA-256 by shape, not label First live signing run (#345) failed at APK cert verification. The APK signed correctly, but the label parse (grep "Signer #1 certificate SHA-256 digest" \| awk) returned empty on the runner's apksigner, whose output labels that line differently than the local build-tools. Empty != expected produced a false mismatch. The release correctly did NOT publish (fail-safe held). Now extracts by shape: the cert SHA-256 is the only 64-hex string in the output (SHA-1 is 40, MD5 is 32), so grep -ioE '[0-9a-f]{64}' is label-independent. Verified against a real signed APK (e7da8cd5…). Echoes the raw apksigner + keytool output for diagnosability, and hardens the AAB parse the same way (it was skipped last run, so its runner format is still unconfirmed — the echo will show it). Part of epic #312. Agent: SapphireCompass (session 8d755b5e)	4 days ago
Strycher	e1e10c4cf0	chore(#345 ): overlay CI + release pipeline onto rc.3 for all-platform backfill Branched off v1.1.2-rc.3 (`630886e`). Overlays dev's CI/release workflows, the four-file notes gate + rc.3 notes, and the combined rc.2/rc.3 CHANGELOG. App code (pubspec 1.1.2-rc.3+60, lib/, android/) is untouched — this is genuinely rc.3, only the release infrastructure is added. Retires the inherited upstream Workers deploy (deploy.yml, wrangler.toml). Tagging this triggers release-signed.yml: gate -> build android/windows/ linux -> sign -> verify APK+AAB cert -> publish. First live keystore signing; pauses at the release-signing environment gate for approval. Play already has the +60 AAB; this fills Windows/Linux/GitHub-APK/web. Acceptance test for #342 / epic #312. Agent: SapphireCompass (session 8d755b5e)	4 days ago

Strycher

fix(#346 ): extract signing cert SHA-256 by shape, not label

First live signing run (#345) failed at APK cert verification. The APK
signed correctly, but the label parse (grep "Signer #1 certificate
SHA-256 digest" | awk) returned empty on the runner's apksigner, whose
output labels that line differently than the local build-tools. Empty
!= expected produced a false mismatch. The release correctly did NOT
publish (fail-safe held).

Now extracts by shape: the cert SHA-256 is the only 64-hex string in
the output (SHA-1 is 40, MD5 is 32), so grep -ioE '[0-9a-f]{64}' is
label-independent. Verified against a real signed APK (e7da8cd5…).

Echoes the raw apksigner + keytool output for diagnosability, and
hardens the AAB parse the same way (it was skipped last run, so its
runner format is still unconfirmed — the echo will show it).

Part of epic #312. Agent: SapphireCompass (session 8d755b5e)

Strycher

e1e10c4cf0

chore(#345 ): overlay CI + release pipeline onto rc.3 for all-platform backfill

Branched off v1.1.2-rc.3 (630886e). Overlays dev's CI/release workflows,
the four-file notes gate + rc.3 notes, and the combined rc.2/rc.3
CHANGELOG. App code (pubspec 1.1.2-rc.3+60, lib/, android/) is untouched
— this is genuinely rc.3, only the release infrastructure is added.

Retires the inherited upstream Workers deploy (deploy.yml, wrangler.toml).

Tagging this triggers release-signed.yml: gate -> build android/windows/
linux -> sign -> verify APK+AAB cert -> publish. First live keystore
signing; pauses at the release-signing environment gate for approval.

Play already has the +60 AAB; this fills Windows/Linux/GitHub-APK/web.

Acceptance test for #342 / epic #312. Agent: SapphireCompass (session 8d755b5e)

2 Commits (49f8ca15c85ad8445dfdabe8c917d285910e0a19)