mirror of https://github.com/ospab/ostp.git
ospab
32c36afc3b
Published APKs could never be updated over - users hit "App not installed" or "unable to parse the package" and had to uninstall first. The cause was not the version code (verified: local.properties carries flutter.versionCode=23 and gha.ps1 bumps pubspec's build number every release, so it increments correctly). It was the signing key: app/build.gradle.kts still had the stock Flutter template TODO and pointed the release build type at signingConfigs["debug"]. Android identifies an app by applicationId + signing key and refuses to update across a key change, and the debug keystore is generated per machine - on ephemeral CI runners that means every single published build was signed with a different random key. Release builds now take their key from android/key.properties or the OSTP_KEYSTORE_* environment variables, falling back to debug (with a loud warning) only so local `flutter build apk --release` keeps working. CI materialises the keystore from repository secrets, refuses to build at all if the secret is absent, and re-verifies the finished APK is not debug-signed rather than ever shipping an un-updatable build again. NOTE: existing installs are signed with a now-unreproducible random key, so users must uninstall once more for THIS release. Every update after it works. |
||
|---|---|---|
| .. | ||
| app | ||
| gradle/wrapper | ||
| .gitignore | ||
| build.gradle.kts | ||
| gradle.properties | ||
| settings.gradle.kts | ||