From bfeb232b282b9edbc77e038645fd5576fc6a56e0 Mon Sep 17 00:00:00 2001
From: jpolo1224 <jpolo1224@gmail.com>
Date: Thu, 20 Aug 2026 13:16:42 -0400
Subject: [PATCH] Release: 0.9.3.1, and make upload signing opt-in

The ISO reader revert is confirmed working by the reporter, so this ships it.

Upload signing is now requested explicitly with -Parmsx3.uploadSigning rather
than used whenever keystore.properties happens to exist. Once that file was
created, every release build silently started signing with the upload key, and
an APK signed differently from the one already installed cannot be installed
over it -- so a sideload build becomes something testers cannot install, and
Android's error does not mention signatures.

It was being worked around by hiding keystore.properties by hand before each
build, which is the kind of step that gets forgotten exactly once and then
wastes a tester's evening. build-play-aab.sh passes the flag; nothing else
does, and asking for it without the keystore present is now an error rather
than a silent fallback.
---
 android/armsx3-ui/app/build.gradle.kts | 20 ++++++++++++++++----
 android/build-play-aab.sh              |  2 +-
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/android/armsx3-ui/app/build.gradle.kts b/android/armsx3-ui/app/build.gradle.kts
index d74a9f291..ce8a5fc31 100644
--- a/android/armsx3-ui/app/build.gradle.kts
+++ b/android/armsx3-ui/app/build.gradle.kts
@@ -34,8 +34,8 @@ android {
         // agree -- an APK that installs below its core's target is a dlopen failure at boot.
         minSdk = (project.findProperty("armsx3.minSdk") as String?)?.toInt() ?: 33
         targetSdk = 37
-        versionCode = 18
-        versionName = "0.9.3"
+        versionCode = 19
+        versionName = "0.9.3.1"
 
         // ARMSX2's UI reads these. STORAGE_ALL_FILES gates the all-files storage path in
         // onboarding; IN_APP_UPDATER gates the in-app GitHub-release updater.
@@ -166,8 +166,20 @@ android {
             //
             // The file is gitignored (*.jks, keystore.properties) and read at build time, so no
             // credential is ever in the repo or on a command line.
-            signingConfig = signingConfigs.findByName("upload")
-                ?: signingConfigs.getByName("debug")
+            // The upload key ONLY when explicitly asked for, which build-play-aab.sh does.
+            //
+            // Opt-in rather than "use it if it exists": once the keystore was created, every
+            // release build silently started using it, and a differently-signed APK cannot be
+            // installed over an existing one. That turns a sideload build into something testers
+            // cannot install, and the error Android shows says nothing about signatures. It was
+            // being worked around by hiding keystore.properties by hand before each build, which
+            // is exactly the kind of step that gets forgotten once.
+            signingConfig = if (project.hasProperty("armsx3.uploadSigning")) {
+                signingConfigs.findByName("upload")
+                    ?: throw GradleException("armsx3.uploadSigning set but keystore.properties is missing")
+            } else {
+                signingConfigs.getByName("debug")
+            }
         }
     }
 
diff --git a/android/build-play-aab.sh b/android/build-play-aab.sh
index 7b735fddc..eeb2f3897 100755
--- a/android/build-play-aab.sh
+++ b/android/build-play-aab.sh
@@ -96,7 +96,7 @@ mkdir -p "$JNI"
 "$STRIP" --strip-unneeded -o "$JNI/libarmsx3-core.so" "$CORE_SRC"
 
 echo "==> Building Play bundle (minSdk $MIN_SDK, minify off)"
-( cd "$UI" && ./gradlew --quiet :app:bundlePlayRelease "-Parmsx3.minSdk=$MIN_SDK" -Parmsx3.noMinify )
+( cd "$UI" && ./gradlew --quiet :app:bundlePlayRelease "-Parmsx3.minSdk=$MIN_SDK" -Parmsx3.noMinify -Parmsx3.uploadSigning )
 
 AAB="$UI/app/build/outputs/bundle/playRelease/app-play-release.aab"
 [ -f "$AAB" ] || { echo "FAIL: no bundle produced at $AAB" >&2; exit 1; }