Persist the debug signing key across container builds

docker/gradle.sh

@@ -35,5 +35,36 @@ if [[ $mode == release ]]; then
         exec ./gradlew "$@"
     ' bash "${gradle_arguments[@]}" "$@"
 else
+    debug_keystore=$(realpath -m "${WOLFSKIN_DEBUG_KEYSTORE:-/root/.treehouse/firstmate-7bab20/2/firstmate/data/signing/debug.keystore}")
+    case "$debug_keystore" in
+        "$root"|"$root"/*)
+            printf 'Debug keystore must be outside the checkout: %s\n' "$debug_keystore" >&2
+            exit 1
+            ;;
+    esac
+    signing_directory=$(dirname "$debug_keystore")
+    mkdir -p "$signing_directory"
+    chmod 700 "$signing_directory"
+    if [[ ! -e $debug_keystore ]]; then
+        temporary_directory=$(mktemp -d "$signing_directory/.debug-keystore.XXXXXX")
+        trap 'rm -rf -- "$temporary_directory"' EXIT
+        if ! docker run --rm --platform linux/amd64 --user "$(id -u):$(id -g)" \
+            --mount "type=bind,src=$temporary_directory,dst=/run/signing" \
+            "$image" keytool -genkeypair -noprompt -keystore /run/signing/debug.keystore \
+            -storetype JKS -storepass android -keypass android -alias androiddebugkey \
+            -keyalg RSA -keysize 2048 -validity 10000 -dname "CN=Android Debug"; then
+            printf 'Failed to generate persistent debug keystore: %s\n' "$debug_keystore" >&2
+            exit 1
+        fi
+        chmod 600 "$temporary_directory/debug.keystore"
+        mv "$temporary_directory/debug.keystore" "$debug_keystore"
+    fi
+    if [[ ! -s $debug_keystore ]]; then
+        printf 'Missing or empty persistent debug keystore: %s\n' "$debug_keystore" >&2
+        exit 1
+    fi
+    chmod 600 "$debug_keystore"
+    arguments+=(--env ANDROID_USER_HOME=/tmp/.android
+        --mount "type=bind,src=$debug_keystore,dst=/tmp/.android/debug.keystore,readonly")
     docker run "${arguments[@]}" "$image" ./gradlew "${gradle_arguments[@]}" "$@"
 fi