Pinned Docker build, signing and versioning #4

New issue

Closed

opened 2026-10-22 12:38:39 +02:00 by justinzeus · 0 comments

justinzeus commented

2026-10-22 12:38:39 +02:00

Owner

Shape: fork grilling with Justin, 2026-10-22 (firstmate report data/wolfskin-fork-grilling/report.md), go given 2026-10-22.

Goal

make apk builds signed release APKs on tank inside a pinned Android SDK + JDK image (no host SDK), with the Gradle cache in a named volume, and native codec extensions pinned from GitHub Packages (settings.gradle.kts:18-25, WholphinExtensionsUsername/password Gradle properties).

Constraints

A separate release keystore (not wolfskin-android's) and a GitHub read:packages token are escrowed under /opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin/ and read at build time; never committed. Losing the key forces a reinstall on the TV, so escrow comes before the first release.
Versioning: each Wolfskin release is named by its git describe (e.g. v1.0.9-7-gabc1234), which the updater (util/Version.kt:41-68,80) already orders, and gets a p-prefixed tag (e.g. pwolfskin-2026_10_23) so versionCode (count of v*/p* tags, app/build.gradle.kts:45-55,78-79) always increases.
Upstream workflows untouched.

Acceptance

make apk from a clean checkout produces signed APKs; apksigner verify --print-certs shows the escrowed key; MPV and ffmpeg extensions are present (not stubs).

Shape: fork grilling with Justin, 2026-10-22 (firstmate report `data/wolfskin-fork-grilling/report.md`), go given 2026-10-22. ## Goal `make apk` builds signed release APKs on tank inside a pinned Android SDK + JDK image (no host SDK), with the Gradle cache in a named volume, and native codec extensions pinned from GitHub Packages (`settings.gradle.kts:18-25`, `WholphinExtensionsUsername`/password Gradle properties). ## Constraints - A separate release keystore (not wolfskin-android's) and a GitHub `read:packages` token are escrowed under `/opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin/` and read at build time; never committed. Losing the key forces a reinstall on the TV, so escrow comes before the first release. - Versioning: each Wolfskin release is named by its `git describe` (e.g. `v1.0.9-7-gabc1234`), which the updater (`util/Version.kt:41-68,80`) already orders, and gets a `p`-prefixed tag (e.g. `pwolfskin-2026_10_23`) so `versionCode` (count of `v*`/`p*` tags, `app/build.gradle.kts:45-55,78-79`) always increases. - Upstream workflows untouched. ## Acceptance `make apk` from a clean checkout produces signed APKs; `apksigner verify --print-certs` shows the escrowed key; MPV and ffmpeg extensions are present (not stubs).