pakstr 0.8.6 → 0.9.0

package/dist/runners/DockerGradleRunner.js

@@ -7,11 +7,9 @@ exports.DockerGradleRunner = void 0;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const crypto_1 = require("crypto");
-const releaseVerification_1 = require("../android/releaseVerification");
-const releaseSigning_1 = require("../core/releaseSigning");
 const process_1 = require("./process");
-const CONTAINER_KEYSTORE_PATH = "/run/secrets/pakstr/release.keystore";
-const CONTAINER_RELEASE_APK = "/workspace/app/build/outputs/apk/release/app-release.apk";
+const CONTAINER_RELEASE_APK_SIGNED = "/workspace/app/build/outputs/apk/release/app-release.apk";
+const CONTAINER_RELEASE_APK_UNSIGNED = "/workspace/app/build/outputs/apk/release/app-release-unsigned.apk";
 const CONTAINER_DEBUG_APK = "/workspace/app/build/outputs/apk/debug/app-debug.apk";
 class DockerGradleRunner {
     image;
@@ -24,14 +22,13 @@ class DockerGradleRunner {
     async build(request) {
         this.checkDockerAvailable();
         this.ensureDockerImage();
-        const signing = request.mode === "release" ? requireSigning(request.signing) : undefined;
-        const storage = this.createBuildStorage(request.androidRoot, signing);
+        const storage = this.createBuildStorage(request.androidRoot);
         let primaryError;
         let result;
         try {
             result =
                 request.mode === "release"
-                    ? this.buildRelease(request, signing, storage)
+                    ? this.buildRelease(request, storage)
                     : this.buildDebug(request, storage);
         }
         catch (error) {
@@ -46,7 +43,7 @@ class DockerGradleRunner {
         }
         if (primaryError) {
             if (cleanupError) {
-                console.error("Docker signing storage cleanup also failed:", safeErrorMessage(cleanupError));
+                console.error("Docker build storage cleanup also failed:", safeErrorMessage(cleanupError));
             }
             throw primaryError;
         }
@@ -66,74 +63,38 @@ class DockerGradleRunner {
             "./gradlew",
             "assembleDebug",
             "-Dorg.gradle.vfs.watch=false",
-        ], {
-            env: (0, releaseSigning_1.removeSigningVariables)(process.env),
-            streamOutput: true,
-        });
+        ], { streamOutput: true });
         const artifactPath = hostArtifactPath(request.androidRoot, "debug");
         this.copyFromVolume(storage.workspaceVolume, CONTAINER_DEBUG_APK, artifactPath);
-        return { artifactPath: requireApk(artifactPath) };
+        return { artifactPath: requireApk(artifactPath), unsigned: false };
     }
-    buildRelease(request, signing, storage) {
-        if (!storage.signingVolume) {
-            throw new Error("Docker release build requires signing storage");
-        }
-        const secrets = signingSecrets(signing);
-        const dockerEnv = (0, releaseSigning_1.createGradleSigningEnvironment)(signing, process.env, CONTAINER_KEYSTORE_PATH);
-        const environmentNames = [
-            releaseSigning_1.INTERNAL_KEYSTORE_PATH_ENV,
-            releaseSigning_1.PUBLIC_SIGNING_ENV.keystorePassword,
-            releaseSigning_1.PUBLIC_SIGNING_ENV.keyAlias,
-            releaseSigning_1.PUBLIC_SIGNING_ENV.keyPassword,
-        ];
+    buildRelease(request, storage) {
+        // Unsigned release build: no signing config is wired up because
+        // PAKSTR_ANDROID_KEYSTORE_PATH is not set in the container environment.
         this.execute("docker", [
             "run",
             "--rm",
             "-v",
             `${storage.workspaceVolume}:/workspace`,
-            "-v",
-            `${storage.signingVolume}:/run/secrets/pakstr:ro`,
-            ...environmentNames.flatMap(name => ["--env", name]),
             this.image,
             "./gradlew",
             "assembleRelease",
             "--no-daemon",
             "-Dorg.gradle.vfs.watch=false",
-        ], {
-            env: dockerEnv,
-            secrets,
-            streamOutput: true,
-        });
-        const verification = (0, releaseVerification_1.verifyReleaseApk)({
-            artifactPath: CONTAINER_RELEASE_APK,
-            expectedMetadata: request.expectedMetadata,
-            signing,
-            toolKeystorePath: CONTAINER_KEYSTORE_PATH,
-            executor: this.createVerificationExecutor(storage, signing),
-        });
-        const artifactPath = hostArtifactPath(request.androidRoot, "release");
-        this.copyFromVolume(storage.workspaceVolume, CONTAINER_RELEASE_APK, artifactPath);
-        return { artifactPath: requireApk(artifactPath), verification };
+        ], { env: scrubSigningEnv(process.env), streamOutput: true });
+        const artifactPath = hostArtifactPath(request.androidRoot, "release-unsigned");
+        this.copyFromVolume(storage.workspaceVolume, CONTAINER_RELEASE_APK_UNSIGNED, artifactPath);
+        return { artifactPath: requireApk(artifactPath), unsigned: true };
     }
-    createBuildStorage(androidRoot, signing) {
+    createBuildStorage(androidRoot) {
         const suffix = (0, crypto_1.randomUUID)();
         const storage = {
             workspaceVolume: `pakstr-workspace-${suffix}`,
-            signingVolume: signing ? `pakstr-signing-${suffix}` : undefined,
         };
         assertRegularAbsolutePath(androidRoot, "Android workspace");
-        if (signing) {
-            assertRegularAbsolutePath(signing.keystorePath, "Temporary keystore", true);
-        }
         try {
             this.execute("docker", ["volume", "create", storage.workspaceVolume]);
-            if (storage.signingVolume) {
-                this.execute("docker", ["volume", "create", storage.signingVolume]);
-            }
             this.copyDirectoryToVolume(androidRoot, storage.workspaceVolume);
-            if (signing && storage.signingVolume) {
-                this.copyFileToVolume(signing.keystorePath, storage.signingVolume, "/run/secrets/pakstr/release.keystore", signingSecrets(signing));
-            }
             return storage;
         }
         catch (error) {
@@ -141,7 +102,7 @@ class DockerGradleRunner {
                 this.removeBuildStorage(storage);
             }
             catch (cleanupError) {
-                console.error("Docker signing storage cleanup also failed:", safeErrorMessage(cleanupError));
+                console.error("Docker build storage cleanup also failed:", safeErrorMessage(cleanupError));
             }
             throw error;
         }
@@ -164,26 +125,6 @@ class DockerGradleRunner {
             this.removeContainer(container);
         }
     }
-    copyFileToVolume(source, volume, destination, secrets) {
-        const container = `pakstr-signing-copy-${(0, crypto_1.randomUUID)()}`;
-        try {
-            this.execute("docker", [
-                "create",
-                "--name",
-                container,
-                "-v",
-                `${volume}:/run/secrets/pakstr`,
-                this.image,
-                "true",
-            ]);
-            this.execute("docker", ["cp", "-a", source, `${container}:${destination}`], {
-                secrets,
-            });
-        }
-        finally {
-            this.removeContainer(container);
-        }
-    }
     copyFromVolume(volume, source, destination) {
         const container = `pakstr-output-copy-${(0, crypto_1.randomUUID)()}`;
         fs_1.default.mkdirSync(path_1.default.dirname(destination), { recursive: true });
@@ -204,43 +145,12 @@ class DockerGradleRunner {
             this.removeContainer(container);
         }
     }
-    createVerificationExecutor(storage, signing) {
-        const secrets = signingSecrets(signing);
-        return {
-            run: (tool, args, env = {}) => {
-                const volumeArgs = ["-v", `${storage.workspaceVolume}:/workspace:ro`];
-                if (tool === "keytool") {
-                    if (!storage.signingVolume) {
-                        throw new Error("Signer verification requires Docker signing storage");
-                    }
-                    volumeArgs.push("-v", `${storage.signingVolume}:/run/secrets/pakstr:ro`);
-                }
-                return this.execute("docker", [
-                    "run",
-                    "--rm",
-                    ...volumeArgs,
-                    ...Object.keys(env).flatMap(name => ["--env", name]),
-                    this.image,
-                    tool,
-                    ...args,
-                ], { env: { ...(0, releaseSigning_1.removeSigningVariables)(process.env), ...env }, secrets });
-            },
-        };
-    }
     removeBuildStorage(storage) {
-        const failures = [];
-        for (const volume of [storage.signingVolume, storage.workspaceVolume]) {
-            if (!volume)
-                continue;
-            try {
-                this.execute("docker", ["volume", "rm", "--force", volume]);
-            }
-            catch {
-                failures.push(volume);
-            }
+        try {
+            this.execute("docker", ["volume", "rm", "--force", storage.workspaceVolume]);
         }
-        if (failures.length) {
-            throw new Error(`Failed to remove temporary Docker volume(s): ${failures.join(", ")}`);
+        catch {
+            throw new Error(`Failed to remove temporary Docker volume: ${storage.workspaceVolume}`);
         }
     }
     removeContainer(container) {
@@ -256,7 +166,7 @@ class DockerGradleRunner {
             this.execute("docker", ["--version"]);
         }
         catch {
-            throw new Error("Docker is not installed or not running. Please install Docker Desktop first.");
+            throw new Error("Docker is not installed or not running. Install Docker Desktop to use pakstr.");
         }
     }
     ensureDockerImage() {
@@ -271,8 +181,11 @@ class DockerGradleRunner {
     }
 }
 exports.DockerGradleRunner = DockerGradleRunner;
-function hostArtifactPath(androidRoot, mode) {
-    return path_1.default.join(androidRoot, "app", "build", "outputs", "apk", mode, `app-${mode}.apk`);
+function hostArtifactPath(androidRoot, variant) {
+    const file = variant === "debug"
+        ? "app-debug.apk"
+        : "app-release-unsigned.apk";
+    return path_1.default.join(androidRoot, "app", "build", "outputs", "apk", variant === "debug" ? "debug" : "release", file);
 }
 function requireApk(artifactPath) {
     if (!fs_1.default.existsSync(artifactPath) || !fs_1.default.lstatSync(artifactPath).isFile()) {
@@ -280,21 +193,18 @@ function requireApk(artifactPath) {
     }
     return artifactPath;
 }
-function requireSigning(signing) {
-    if (!signing) {
-        throw new Error("Release build requires an internal signing context");
-    }
-    return signing;
-}
-function signingSecrets(signing) {
-    return [
-        signing.storePassword,
-        signing.keyAlias,
-        signing.keyPassword,
-        signing.keystorePath,
-    ];
+function scrubSigningEnv(env) {
+    const sanitized = { ...env };
+    delete sanitized["PAKSTR_ANDROID_KEYSTORE_PATH"];
+    delete sanitized["PAKSTR_ANDROID_KEYSTORE_PASSWORD"];
+    delete sanitized["PAKSTR_ANDROID_KEY_ALIAS"];
+    delete sanitized["PAKSTR_ANDROID_KEY_PASSWORD"];
+    delete sanitized["PAKSTR_ANDROID_SIGNING_MODE"];
+    delete sanitized["APP_NSEC"];
+    delete sanitized["KEYSTORE_PASSWORD"];
+    return sanitized;
 }
-function assertRegularAbsolutePath(candidate, label, requireFile = false) {
+function assertRegularAbsolutePath(candidate, label) {
     if (!path_1.default.isAbsolute(candidate)) {
         throw new Error(`${label} path must be absolute`);
     }
@@ -305,7 +215,7 @@ function assertRegularAbsolutePath(candidate, label, requireFile = false) {
     if (stat.isSymbolicLink()) {
         throw new Error(`${label} path must not be a symbolic link`);
     }
-    if (requireFile ? !stat.isFile() : !stat.isDirectory()) {
+    if (!stat.isDirectory()) {
         throw new Error(`${label} path has an unexpected filesystem type`);
     }
 }

package/dist/runners/DockerSignRunner.js

@@ -0,0 +1,182 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DockerSignRunner = void 0;
+const crypto_1 = require("crypto");
+const crypto_2 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const process_1 = require("./process");
+class DockerSignRunner {
+    image;
+    execute;
+    constructor(image = process.env.PAKSTR_DOCKER_IMAGE ??
+        "git.nostrdev.com/stuff/pakstr/android-builder:latest", execute = process_1.runProcess) {
+        this.image = image;
+        this.execute = execute;
+    }
+    async sign(request) {
+        this.checkDockerAvailable();
+        assertRegularFile(request.unsignedApkPath, "Unsigned APK");
+        // Use a Docker named volume for the unsigned APK (not a bind mount). The
+        // Gitea act runner runs jobs inside a container, so single-file bind
+        // mounts from the host path don't reliably reach the inner docker daemon;
+        // a named volume copied via a temp container works across that boundary
+        // (mirroring how DockerGradleRunner transports the workspace).
+        const apkVolume = `pakstr-sign-apk-${(0, crypto_2.randomUUID)()}`;
+        const outVolume = `pakstr-sign-out-${(0, crypto_2.randomUUID)()}`;
+        let primaryError;
+        let result;
+        try {
+            this.execute("docker", ["volume", "create", apkVolume]);
+            this.execute("docker", ["volume", "create", outVolume]);
+            this.copyFileToVolume(request.unsignedApkPath, apkVolume, "/work/unsigned.apk");
+            const password = (0, crypto_1.randomBytes)(32).toString("base64url");
+            const nsecString = nsecToString(request.nsec);
+            const env = {
+                ...process.env,
+                APP_NSEC: nsecString,
+                KEYSTORE_PASSWORD: password,
+            };
+            // Explicitly forward the two signing env vars into the container; docker
+            // run does not auto-forward the parent environment.
+            const signingEnvNames = ["APP_NSEC", "KEYSTORE_PASSWORD"];
+            const stdout = this.execute("docker", [
+                "run",
+                "--rm",
+                "--tmpfs",
+                "/signing:mode=0700,uid=0",
+                "-v",
+                `${apkVolume}:/work:ro`,
+                "-v",
+                `${outVolume}:/out`,
+                ...signingEnvNames.flatMap(name => ["--env", name]),
+                this.image,
+                "/opt/pakstr/sign.sh",
+                request.appId,
+                "/work/unsigned.apk",
+                "/out/signed.apk",
+            ], { env, secrets: [nsecString, password], streamOutput: true }).stdout;
+            const signerSha256 = parseSignerSha(stdout);
+            // Copy the signed APK out of the output volume to the host.
+            const hostSigned = path_1.default.join(os_1.default.tmpdir(), `pakstr-signed-${(0, crypto_2.randomUUID)()}.apk`);
+            this.copyFromVolume(outVolume, "/out/signed.apk", hostSigned);
+            if (!fs_1.default.existsSync(hostSigned) || !fs_1.default.lstatSync(hostSigned).isFile()) {
+                throw new Error("Sign runner did not produce a signed APK");
+            }
+            fs_1.default.mkdirSync(path_1.default.dirname(request.signedApkPath), { recursive: true });
+            fs_1.default.rmSync(request.signedApkPath, { force: true });
+            const finalPath = path_1.default.resolve(request.signedApkPath);
+            // Copy (not rename) across the tmpfs → workspace device boundary; CI
+            // runners put /tmp and the checkout on different filesystems, so
+            // fs.rename fails with EXDEV. COPYFILE_FICLONE is a harmless hint.
+            fs_1.default.copyFileSync(hostSigned, finalPath, fs_1.default.constants.COPYFILE_FICLONE);
+            fs_1.default.rmSync(hostSigned, { force: true });
+            result = { signedApkPath: finalPath, signerSha256 };
+        }
+        catch (error) {
+            primaryError = error;
+        }
+        finally {
+            for (const v of [outVolume, apkVolume]) {
+                try {
+                    this.execute("docker", ["volume", "rm", "--force", v]);
+                }
+                catch {
+                    /* best-effort cleanup */
+                }
+            }
+        }
+        if (primaryError)
+            throw primaryError;
+        if (!result)
+            throw new Error("Sign runner completed without a result");
+        return result;
+    }
+    copyFileToVolume(source, volume, destination) {
+        const container = `pakstr-sign-copy-${(0, crypto_2.randomUUID)()}`;
+        try {
+            this.execute("docker", [
+                "create",
+                "--name",
+                container,
+                "-v",
+                `${volume}:/work`,
+                this.image,
+                "true",
+            ]);
+            this.execute("docker", ["cp", source, `${container}:${destination}`]);
+        }
+        finally {
+            this.removeContainer(container);
+        }
+    }
+    copyFromVolume(volume, source, destination) {
+        // Mount the volume at the same directory the source path lives under so
+        // the in-container path matches what the producing container wrote.
+        const mountDir = path_1.default.posix.dirname(source);
+        const container = `pakstr-sign-out-${(0, crypto_2.randomUUID)()}`;
+        fs_1.default.mkdirSync(path_1.default.dirname(destination), { recursive: true });
+        fs_1.default.rmSync(destination, { force: true });
+        try {
+            this.execute("docker", [
+                "create",
+                "--name",
+                container,
+                "-v",
+                `${volume}:${mountDir}:ro`,
+                this.image,
+                "true",
+            ]);
+            this.execute("docker", ["cp", `${container}:${source}`, destination]);
+        }
+        finally {
+            this.removeContainer(container);
+        }
+    }
+    removeContainer(container) {
+        try {
+            this.execute("docker", ["rm", "--force", container]);
+        }
+        catch {
+            /* a failed create leaves no container */
+        }
+    }
+    checkDockerAvailable() {
+        try {
+            this.execute("docker", ["--version"]);
+        }
+        catch {
+            throw new Error("Docker is not installed or not running. Install Docker Desktop to use pakstr.");
+        }
+    }
+}
+exports.DockerSignRunner = DockerSignRunner;
+function parseSignerSha(stdout) {
+    const match = stdout.match(/PAKSTR_SIGN_OK sha256=([0-9a-fA-F]+)/);
+    if (!match || !match[1]) {
+        throw new Error("Sign runner did not confirm the signer certificate");
+    }
+    return match[1].toLowerCase();
+}
+/** Re-encode the secret bytes as a bech32 nsec string for the container env. */
+function nsecToString(secret) {
+    // Lazy import to avoid a circular type dependency at module load.
+    const { encodeNsec } = require("../core/nostr");
+    return encodeNsec(secret);
+}
+function assertRegularFile(candidate, label) {
+    if (!path_1.default.isAbsolute(candidate)) {
+        throw new Error(`${label} path must be absolute: ${candidate}`);
+    }
+    if (!fs_1.default.existsSync(candidate)) {
+        throw new Error(`${label} not found: ${candidate}`);
+    }
+    const stat = fs_1.default.lstatSync(candidate);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error(`${label} must be a regular file: ${candidate}`);
+    }
+}

package/dist/runners/LocalGradleRunner.js

@@ -5,11 +5,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalGradleRunner = void 0;
 const fs_1 = __importDefault(require("fs"));
-const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
-const releaseVerification_1 = require("../android/releaseVerification");
-const releaseSigning_1 = require("../core/releaseSigning");
 const process_1 = require("./process");
+/**
+ * Local Gradle runner for users who already have a JDK + Android SDK + Gradle
+ * installed. The default and only specified builder is `docker`; this remains
+ * as a convenience for local development.
+ */
 class LocalGradleRunner {
     async build(request) {
         const { androidRoot, mode } = request;
@@ -22,143 +24,38 @@ class LocalGradleRunner {
         if (mode === "debug") {
             (0, process_1.runProcess)(gradlewPath, ["assembleDebug"], {
                 cwd: androidRoot,
-                env: (0, releaseSigning_1.removeSigningVariables)(process.env),
                 streamOutput: true,
             });
-            return {
-                artifactPath: requireApk(androidRoot, "debug"),
-            };
+            return { artifactPath: requireApk(androidRoot, "debug"), unsigned: false };
         }
-        const signing = requireSigning(request.signing);
-        const secrets = signingSecrets(signing);
-        const gradleEnv = (0, releaseSigning_1.createGradleSigningEnvironment)(signing);
-        (0, process_1.runProcess)(gradlewPath, [
-            "assembleRelease",
-            "--no-daemon",
-        ], {
+        // Unsigned release: ensure no signing env leaks into Gradle.
+        const env = scrubSigningEnv(process.env);
+        (0, process_1.runProcess)(gradlewPath, ["assembleRelease", "--no-daemon"], {
             cwd: androidRoot,
-            env: gradleEnv,
-            secrets,
+            env,
             streamOutput: true,
         });
-        const artifactPath = requireApk(androidRoot, "release");
-        let verification;
-        try {
-            const executor = createLocalVerificationExecutor(signing);
-            verification =
-                (0, releaseVerification_1.verifyReleaseApk)({
-                    artifactPath,
-                    expectedMetadata: request.expectedMetadata,
-                    signing,
-                    executor,
-                });
-        }
-        catch (error) {
-            if (isMissingLocalVerificationTool(error)) {
-                console.warn("⚠️ Local release verification skipped: Android verification tools are unavailable.");
-                console.warn("ℹ️ Full release verification will still run in Docker/CI.");
-                verification = undefined;
-            }
-            else {
-                throw error;
-            }
-        }
-        return {
-            artifactPath,
-            verification,
-        };
+        const artifactPath = requireApk(androidRoot, "release-unsigned");
+        return { artifactPath, unsigned: true };
     }
 }
 exports.LocalGradleRunner = LocalGradleRunner;
-function isMissingLocalVerificationTool(error) {
-    if (!(error instanceof Error)) {
-        return false;
-    }
-    const messages = [
-        "verification tool",
-        "cmdline-tools",
-        "build-tools directory",
-        "Required Android verification tool",
-    ];
-    return messages.some(message => error.message.includes(message));
-}
-function createLocalVerificationExecutor(signing) {
-    const androidHome = process.env.ANDROID_HOME ??
-        process.env.ANDROID_SDK_ROOT ??
-        path_1.default.join(os_1.default.homedir(), "Library", "Android", "sdk");
-    const secrets = signingSecrets(signing);
-    return {
-        run(tool, args, env = {}) {
-            const command = resolveTool(tool, androidHome);
-            return (0, process_1.runProcess)(command, args, {
-                env: {
-                    ...process.env,
-                    ...env,
-                },
-                secrets,
-            });
-        },
-    };
-}
-function resolveTool(tool, androidHome) {
-    if (tool === "keytool") {
-        return "keytool";
-    }
-    if (tool === "apkanalyzer") {
-        const cmdlineTools = path_1.default.join(androidHome, "cmdline-tools");
-        if (!fs_1.default.existsSync(cmdlineTools)) {
-            throw new Error(`Android cmdline-tools directory not found: ${cmdlineTools}`);
-        }
-        const versions = fs_1.default.readdirSync(cmdlineTools)
-            .sort((a, b) => b.localeCompare(a, undefined, {
-            numeric: true,
-        }));
-        const analyzer = versions
-            .map(version => path_1.default.join(cmdlineTools, version, "bin", "apkanalyzer"))
-            .find(candidate => fs_1.default.existsSync(candidate));
-        if (!analyzer) {
-            throw new Error(`Required Android verification tool not found under ${cmdlineTools}`);
-        }
-        return analyzer;
-    }
-    const buildToolsDir = path_1.default.join(androidHome, "build-tools");
-    if (!fs_1.default.existsSync(buildToolsDir)) {
-        throw new Error(`Android build-tools directory not found: ${buildToolsDir}`);
-    }
-    const versions = fs_1.default.readdirSync(buildToolsDir)
-        .sort((a, b) => b.localeCompare(a, undefined, {
-        numeric: true,
-    }));
-    const executable = tool === "aapt"
-        ? "aapt"
-        : "apksigner";
-    const resolved = versions
-        .map(version => path_1.default.join(buildToolsDir, version, executable))
-        .find(candidate => fs_1.default.existsSync(candidate));
-    if (!resolved) {
-        throw new Error(`Required Android verification tool ${executable} not found under ${buildToolsDir}`);
-    }
-    return resolved;
-}
-function requireApk(androidRoot, mode) {
-    const artifactPath = path_1.default.join(androidRoot, "app", "build", "outputs", "apk", mode, `app-${mode}.apk`);
-    if (!fs_1.default.existsSync(artifactPath) ||
-        !fs_1.default.lstatSync(artifactPath).isFile()) {
+function requireApk(androidRoot, variant) {
+    const file = variant === "debug" ? "app-debug.apk" : "app-release-unsigned.apk";
+    const artifactPath = path_1.default.join(androidRoot, "app", "build", "outputs", "apk", variant === "debug" ? "debug" : "release", file);
+    if (!fs_1.default.existsSync(artifactPath) || !fs_1.default.lstatSync(artifactPath).isFile()) {
         throw new Error(`APK not found after Gradle build: ${artifactPath}`);
     }
     return artifactPath;
 }
-function requireSigning(signing) {
-    if (!signing) {
-        throw new Error("Release build requires an internal signing context");
-    }
-    return signing;
-}
-function signingSecrets(signing) {
-    return [
-        signing.storePassword,
-        signing.keyAlias,
-        signing.keyPassword,
-        signing.keystorePath,
-    ];
+function scrubSigningEnv(env) {
+    const sanitized = { ...env };
+    delete sanitized["PAKSTR_ANDROID_KEYSTORE_PATH"];
+    delete sanitized["PAKSTR_ANDROID_KEYSTORE_PASSWORD"];
+    delete sanitized["PAKSTR_ANDROID_KEY_ALIAS"];
+    delete sanitized["PAKSTR_ANDROID_KEY_PASSWORD"];
+    delete sanitized["PAKSTR_ANDROID_SIGNING_MODE"];
+    delete sanitized["APP_NSEC"];
+    delete sanitized["KEYSTORE_PASSWORD"];
+    return sanitized;
 }

package/dist/runners/createRunner.js

@@ -3,13 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRunner = createRunner;
 const LocalGradleRunner_1 = require("./LocalGradleRunner");
 const DockerGradleRunner_1 = require("./DockerGradleRunner");
-function createRunner(config) {
-    switch (config.builder) {
+function createRunner(builder) {
+    switch (builder) {
         case "docker":
-            return new DockerGradleRunner_1.DockerGradleRunner(config.dockerImage);
+            return new DockerGradleRunner_1.DockerGradleRunner();
         case "local":
             return new LocalGradleRunner_1.LocalGradleRunner();
         default:
-            throw new Error(`Unknown runner type: ${config.builder}`);
+            throw new Error(`Unknown builder: "${builder}". Only "docker" (and "local") are supported.`);
     }
 }