From 3bed374180fae3055623523ed06a37ab4084a845 Mon Sep 17 00:00:00 2001 From: Hossain Khan Date: Sat, 28 Jun 2025 09:00:43 -0400 Subject: [PATCH 1/2] [MINOR] Fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Great news! The debug output now provides much more clarity about what's happening with your keystore. Let's analyze the results: ### What's Working: 1. ✅ **Keystore is successfully decoded** (2740 bytes) 2. ✅ **Keystore password is correct** (works with your secret) 3. ✅ **Keystore works with both JKS and PKCS12 formats** 4. ✅ **Your keystore contains 1 entry** as expected 5. ✅ **The configured alias exists in the keystore** (confirmed with special check) ### The Confusion: The only contradiction seems to be between these two messages: ``` ✅ Alias '***' exists in keystore ``` and ``` ❌ Key alias does not exist in the keystore or other error ``` Looking at the detailed output, we can see this in the "Error output" section: ``` ***, Jun 28, 2025, PrivateKeyEntry, Certificate fingerprint (SHA-256): 20:9B:92:F5:BB:01:44:23:72:51:A1:0F:C3:EB:B5:3A:11:17:E3:DF:EB:40:69:97:BF:D6:B0:7F:6F:B1:F2:48 ``` This actually shows that the key was found and returned! It's not indicating an error at all. The "error" message is triggered because it's looking for the text "Alias name:" which isn't in the output format. This is a false negative. ### What to do: 1. **Your keystore and key alias are working properly** - Don't change anything with them. 2. **Update the Test Key Alias step** in your workflow: ```yaml - name: Test Key Alias if: always() run: | echo "Testing key alias..." keytool -list -keystore keystore-test/release.keystore -storepass "${{ secrets.KEYSTORE_PASSWORD }}" -alias "${{ secrets.KEY_ALIAS }}" > keystore-test/alias.txt 2>&1 || true # Check success by looking for the certificate fingerprint instead of "Alias name:" if grep -q "PrivateKeyEntry" keystore-test/alias.txt; then echo "✅ Key alias exists in the keystore" cat keystore-test/alias.txt else echo "❌ Key alias does not exist in the keystore or other error" echo "Error output:" cat keystore-test/alias.txt echo "Available aliases in the keystore (if any):" keytool -list -keystore keystore-test/release.keystore -storepass "${{ secrets.KEYSTORE_PASSWORD }}" 2>/dev/null | grep -i "alias" || echo "Could not list aliases" fi ``` For your F-Droid build workflow, everything should work fine now. The keystore file, password, and alias are all verified to be correct. The test is showing a false negative simply due to how it's parsing the output from keytool. --- .github/workflows/test-keystore.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test-keystore.yml b/.github/workflows/test-keystore.yml index 14cdba1..0f1e7ff 100644 --- a/.github/workflows/test-keystore.yml +++ b/.github/workflows/test-keystore.yml @@ -124,12 +124,13 @@ jobs: fi - name: Test Key Alias - if: always() # Run even if previous steps failed + if: always() run: | echo "Testing key alias..." keytool -list -keystore keystore-test/release.keystore -storepass "${{ secrets.KEYSTORE_PASSWORD }}" -alias "${{ secrets.KEY_ALIAS }}" > keystore-test/alias.txt 2>&1 || true - if grep -q "Alias name:" keystore-test/alias.txt; then + # Check success by looking for the certificate fingerprint instead of "Alias name:" + if grep -q "PrivateKeyEntry" keystore-test/alias.txt; then echo "✅ Key alias exists in the keystore" cat keystore-test/alias.txt else From d5463312e485f52a253249e2ca0930cad4679e8b Mon Sep 17 00:00:00 2001 From: Hossain Khan Date: Sat, 28 Jun 2025 09:10:11 -0400 Subject: [PATCH 2/2] [ADDED] Another step for using the key to sign file --- .github/workflows/test-keystore.yml | 63 +++++++++++++++++++++++------ 1 file changed, 51 insertions(+), 12 deletions(-) diff --git a/.github/workflows/test-keystore.yml b/.github/workflows/test-keystore.yml index 0f1e7ff..78273c2 100644 --- a/.github/workflows/test-keystore.yml +++ b/.github/workflows/test-keystore.yml @@ -23,7 +23,7 @@ jobs: with: java-version: '17' # Using a stable JDK version distribution: 'temurin' - + - name: Verify Java and Keytool Installation run: | echo "Java version:" @@ -34,7 +34,7 @@ jobs: - name: Create Test Directory run: mkdir -p keystore-test - + - name: Check KEYSTORE_BASE64 Secret Length run: | if [[ -n "${{ secrets.KEYSTORE_BASE64 }}" ]]; then @@ -44,7 +44,7 @@ jobs: echo "❌ KEYSTORE_BASE64 secret is not set" exit 1 fi - + - name: Decode Keystore run: | # Decode the base64 keystore to a file @@ -56,10 +56,10 @@ jobs: echo "File size: $(wc -c < keystore-test/release.keystore) bytes" echo "File details:" ls -la keystore-test/release.keystore - + # Check file type file keystore-test/release.keystore - + # Show first few bytes as hex (for debugging) echo "First 32 bytes as hex:" hexdump -C -n 32 keystore-test/release.keystore @@ -67,7 +67,7 @@ jobs: echo "❌ Keystore file is empty or not created properly" exit 1 fi - + - name: Dump Keystore Information if: always() # Run even if previous steps failed run: | @@ -102,20 +102,20 @@ jobs: echo "❌ Keystore password is incorrect or keystore format is invalid" echo "Error output:" cat keystore-test/output.txt - + # Try common default passwords echo "Trying with empty password..." keytool -list -keystore keystore-test/release.keystore -storepass "" > keystore-test/empty.txt 2>&1 || true - + if grep -q "Keystore type:" keystore-test/empty.txt; then echo "✅ Keystore works with EMPTY password" else echo "❌ Empty password doesn't work either" fi - + echo "Trying with 'android' as password..." keytool -list -keystore keystore-test/release.keystore -storepass "android" > keystore-test/android.txt 2>&1 || true - + if grep -q "Keystore type:" keystore-test/android.txt; then echo "✅ Keystore works with 'android' as password" else @@ -137,7 +137,7 @@ jobs: echo "❌ Key alias does not exist in the keystore or other error" echo "Error output:" cat keystore-test/alias.txt - + echo "Available aliases in the keystore (if any):" keytool -list -keystore keystore-test/release.keystore -storepass "${{ secrets.KEYSTORE_PASSWORD }}" 2>/dev/null | grep -i "alias" || echo "Could not list aliases" fi @@ -149,7 +149,7 @@ jobs: for type in "JKS" "PKCS12" "JCEKS"; do echo "Testing with store type: $type" keytool -list -keystore keystore-test/release.keystore -storetype $type -storepass "${{ secrets.KEYSTORE_PASSWORD }}" > keystore-test/storetype-$type.txt 2>&1 || true - + if grep -q "Keystore type:" keystore-test/storetype-$type.txt; then echo "✅ Keystore works with type $type" cat keystore-test/storetype-$type.txt | head -5 @@ -158,6 +158,45 @@ jobs: fi done + - name: Test Signing a File + if: always() # Run even if previous steps failed + run: | + echo "Testing if keystore can actually sign files..." + + # Create a small dummy file to sign + echo "Test content for signing" > keystore-test/test-file.txt + + # Create a simple JAR file for signing + jar cf keystore-test/test.jar keystore-test/test-file.txt + + # Try to sign the JAR with the keystore + jarsigner -keystore keystore-test/release.keystore \ + -storepass "${{ secrets.KEYSTORE_PASSWORD }}" \ + -keypass "${{ secrets.KEY_PASSWORD }}" \ + -signedjar keystore-test/signed.jar \ + keystore-test/test.jar \ + "${{ secrets.KEY_ALIAS }}" \ + > keystore-test/signing.txt 2>&1 || true + + # Check if the signing was successful + if [ -f keystore-test/signed.jar ] && jarsigner -verify -keystore keystore-test/release.keystore -storepass "${{ secrets.KEYSTORE_PASSWORD }}" keystore-test/signed.jar > keystore-test/verify.txt 2>&1; then + echo "✅ Successfully signed and verified a file with the keystore" + ls -la keystore-test/signed.jar + cat keystore-test/verify.txt | grep -v password + else + echo "❌ Failed to sign a file with the keystore" + echo "Signing output:" + cat keystore-test/signing.txt | grep -v password + + # If the signed JAR exists, try to verify it anyway + if [ -f keystore-test/signed.jar ]; then + echo "Attempting to verify the signed file anyway:" + jarsigner -verify keystore-test/signed.jar > keystore-test/verify-anyway.txt 2>&1 || true + cat keystore-test/verify-anyway.txt | grep -v password + fi + fi + + - name: Create Test Keystore (Sanity Check) if: always() # Run even if previous steps failed run: |