diff --git a/.github/workflows/test-keystore.yml b/.github/workflows/test-keystore.yml index 14cdba1..78273c2 100644 --- a/.github/workflows/test-keystore.yml +++ b/.github/workflows/test-keystore.yml @@ -23,7 +23,7 @@ jobs: with: java-version: '17' # Using a stable JDK version distribution: 'temurin' - + - name: Verify Java and Keytool Installation run: | echo "Java version:" @@ -34,7 +34,7 @@ jobs: - name: Create Test Directory run: mkdir -p keystore-test - + - name: Check KEYSTORE_BASE64 Secret Length run: | if [[ -n "${{ secrets.KEYSTORE_BASE64 }}" ]]; then @@ -44,7 +44,7 @@ jobs: echo "❌ KEYSTORE_BASE64 secret is not set" exit 1 fi - + - name: Decode Keystore run: | # Decode the base64 keystore to a file @@ -56,10 +56,10 @@ jobs: echo "File size: $(wc -c < keystore-test/release.keystore) bytes" echo "File details:" ls -la keystore-test/release.keystore - + # Check file type file keystore-test/release.keystore - + # Show first few bytes as hex (for debugging) echo "First 32 bytes as hex:" hexdump -C -n 32 keystore-test/release.keystore @@ -67,7 +67,7 @@ jobs: echo "❌ Keystore file is empty or not created properly" exit 1 fi - + - name: Dump Keystore Information if: always() # Run even if previous steps failed run: | @@ -102,20 +102,20 @@ jobs: echo "❌ Keystore password is incorrect or keystore format is invalid" echo "Error output:" cat keystore-test/output.txt - + # Try common default passwords echo "Trying with empty password..." keytool -list -keystore keystore-test/release.keystore -storepass "" > keystore-test/empty.txt 2>&1 || true - + if grep -q "Keystore type:" keystore-test/empty.txt; then echo "✅ Keystore works with EMPTY password" else echo "❌ Empty password doesn't work either" fi - + echo "Trying with 'android' as password..." keytool -list -keystore keystore-test/release.keystore -storepass "android" > keystore-test/android.txt 2>&1 || true - + if grep -q "Keystore type:" keystore-test/android.txt; then echo "✅ Keystore works with 'android' as password" else @@ -124,19 +124,20 @@ jobs: fi - name: Test Key Alias - if: always() # Run even if previous steps failed + if: always() run: | echo "Testing key alias..." keytool -list -keystore keystore-test/release.keystore -storepass "${{ secrets.KEYSTORE_PASSWORD }}" -alias "${{ secrets.KEY_ALIAS }}" > keystore-test/alias.txt 2>&1 || true - if grep -q "Alias name:" keystore-test/alias.txt; then + # Check success by looking for the certificate fingerprint instead of "Alias name:" + if grep -q "PrivateKeyEntry" keystore-test/alias.txt; then echo "✅ Key alias exists in the keystore" cat keystore-test/alias.txt else echo "❌ Key alias does not exist in the keystore or other error" echo "Error output:" cat keystore-test/alias.txt - + echo "Available aliases in the keystore (if any):" keytool -list -keystore keystore-test/release.keystore -storepass "${{ secrets.KEYSTORE_PASSWORD }}" 2>/dev/null | grep -i "alias" || echo "Could not list aliases" fi @@ -148,7 +149,7 @@ jobs: for type in "JKS" "PKCS12" "JCEKS"; do echo "Testing with store type: $type" keytool -list -keystore keystore-test/release.keystore -storetype $type -storepass "${{ secrets.KEYSTORE_PASSWORD }}" > keystore-test/storetype-$type.txt 2>&1 || true - + if grep -q "Keystore type:" keystore-test/storetype-$type.txt; then echo "✅ Keystore works with type $type" cat keystore-test/storetype-$type.txt | head -5 @@ -157,6 +158,45 @@ jobs: fi done + - name: Test Signing a File + if: always() # Run even if previous steps failed + run: | + echo "Testing if keystore can actually sign files..." + + # Create a small dummy file to sign + echo "Test content for signing" > keystore-test/test-file.txt + + # Create a simple JAR file for signing + jar cf keystore-test/test.jar keystore-test/test-file.txt + + # Try to sign the JAR with the keystore + jarsigner -keystore keystore-test/release.keystore \ + -storepass "${{ secrets.KEYSTORE_PASSWORD }}" \ + -keypass "${{ secrets.KEY_PASSWORD }}" \ + -signedjar keystore-test/signed.jar \ + keystore-test/test.jar \ + "${{ secrets.KEY_ALIAS }}" \ + > keystore-test/signing.txt 2>&1 || true + + # Check if the signing was successful + if [ -f keystore-test/signed.jar ] && jarsigner -verify -keystore keystore-test/release.keystore -storepass "${{ secrets.KEYSTORE_PASSWORD }}" keystore-test/signed.jar > keystore-test/verify.txt 2>&1; then + echo "✅ Successfully signed and verified a file with the keystore" + ls -la keystore-test/signed.jar + cat keystore-test/verify.txt | grep -v password + else + echo "❌ Failed to sign a file with the keystore" + echo "Signing output:" + cat keystore-test/signing.txt | grep -v password + + # If the signed JAR exists, try to verify it anyway + if [ -f keystore-test/signed.jar ]; then + echo "Attempting to verify the signed file anyway:" + jarsigner -verify keystore-test/signed.jar > keystore-test/verify-anyway.txt 2>&1 || true + cat keystore-test/verify-anyway.txt | grep -v password + fi + fi + + - name: Create Test Keystore (Sanity Check) if: always() # Run even if previous steps failed run: |