laantungir/Amber
1
0
Fork 0
mirror of https://github.com/greenart7c3/Amber.git synced 2026-09-14 00:35:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add instruction to verify the releases

Browse Source
This commit is contained in:
greenart7c3
2025-09-08 07:54:49 -03:00
parent 997f679d08
commit 064deadad3
4 changed files with 356 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/unsigned-release.yml
+47
View File
@@ -0,0 +1,47 @@
name: Build All APKs
on:
push:
tags:
- 'v*'
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout source
uses: actions/checkout@v4
- name: Set up JDK 21
uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: 21
- name: Cache Gradle
uses: actions/cache@v4
with:
path: |
~/.gradle/caches
~/.gradle/wrapper
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
restore-keys: |
${{ runner.os }}-gradle-
- name: Grant execute permission to Gradle wrapper
run: chmod +x ./gradlew
- name: Clean project
run: ./gradlew clean
- name: Build AAB and APKs
run: |
./gradlew bundleRelease assembleRelease --stacktrace
- name: Upload all APKs as artifacts
uses: actions/upload-artifact@v4
with:
name: All-APKs-${{ github.ref_name }}
path: app/build/outputs/apk/**/release/*.apk
retention-days: 14
Dockerfile
+92
View File
@@ -0,0 +1,92 @@
FROM eclipse-temurin:21-jdk
ARG VERSION
ARG APK_TYPE
ENV VERSION=${VERSION:-v4.0.1}
ENV APK_TYPE=${APK_TYPE:-free-arm64-v8a}
ENV GRADLE_OPTS="-Xmx2048m -Dorg.gradle.daemon=false"
ENV ANDROID_SDK_ROOT=/sdk
ENV PATH="${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin:${ANDROID_SDK_ROOT}/platform-tools:${ANDROID_SDK_ROOT}/build-tools/34.0.0:${PATH}"
# Install required packages
RUN apt-get update && apt-get install -y \
git curl unzip zip wget zipalign python3 python3-pip ca-certificates \
&& apt-get clean && rm -rf /var/lib/apt/lists/*
# Install Android SDK command-line tools
RUN mkdir -p ${ANDROID_SDK_ROOT}/cmdline-tools && \
cd ${ANDROID_SDK_ROOT}/cmdline-tools && \
wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -O sdk-tools.zip && \
unzip sdk-tools.zip && rm sdk-tools.zip && \
mv cmdline-tools latest
# Accept licenses and install build tools + platform
RUN yes | ${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager --licenses
RUN ${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager \
"platform-tools" \
"platforms;android-34" \
"build-tools;34.0.0"
# Create working directory
WORKDIR /app
# Clone Amber and checkout version tag
RUN git clone https://github.com/greenart7c3/Amber.git . && \
git checkout tags/$VERSION
# Ensure gradlew is executable
RUN chmod +x gradlew
# Build the APK using the project's Gradle Wrapper
RUN ./gradlew clean assembleRelease --no-daemon
# Create a self-signed release keystore
RUN keytool -genkeypair \
-alias amberkey \
-keyalg RSA \
-keysize 2048 \
-validity 10000 \
-keystore /app/release.keystore \
-storepass password \
-keypass password \
-dname "CN=Amber, OU=Dev, O=AmberProject, L=Internet, S=None, C=US"
# Copy unsigned APK to known location
RUN cp app/build/outputs/apk/free/release/app-${APK_TYPE}-release-unsigned.apk /app/built.apk
# Sign the APK
RUN ${ANDROID_SDK_ROOT}/build-tools/34.0.0/apksigner sign \
--ks /app/release.keystore \
--ks-key-alias amberkey \
--ks-pass pass:password \
--key-pass pass:password \
--out /app/signed.apk \
/app/built.apk
# Download official release APK
RUN mkdir -p /release_apk && \
wget -q -O /release_apk/Amber-${VERSION}.apk \
https://github.com/greenart7c3/Amber/releases/download/${VERSION}/amber-${APK_TYPE}-${VERSION}.apk
# Strip META-INF signature and LICENSE files from both APKs
RUN mkdir -p /tmp/signed /tmp/release && \
unzip -q /app/signed.apk -d /tmp/signed && \
unzip -q /release_apk/Amber-${VERSION}.apk -d /tmp/release && \
find /tmp/signed -name "*.RSA" -delete && \
find /tmp/signed -name "*.SF" -delete && \
find /tmp/signed -name "*.DSA" -delete && \
find /tmp/signed -name "*LICENSE*" -delete && \
find /tmp/release -name "*.RSA" -delete && \
find /tmp/release -name "*.SF" -delete && \
find /tmp/release -name "*.DSA" -delete && \
find /tmp/release -name "*LICENSE*" -delete && \
cd /tmp/signed && zip -qr /app/signed-stripped.apk . && \
cd /tmp/release && zip -qr /release_apk/official-stripped.apk .
# Download apkdiff.py from Signal's reproducible builds branch
RUN wget -q https://raw.githubusercontent.com/signalapp/Signal-Android/refs/heads/main/reproducible-builds/apkdiff/apkdiff.py \
-O /usr/local/bin/apkdiff.py && chmod +x /usr/local/bin/apkdiff.py
# Compare the stripped APKs
CMD sh -c "python3 /usr/local/bin/apkdiff.py /release_apk/official-stripped.apk /app/signed-stripped.apk"
README.md
+33
View File
@@ -45,6 +45,39 @@ You can also send patches through Nostr using [GitStr](https://github.com/fiatja
By contributing to this repository, you agree to license your work under the MIT license. Any work contributed where you are not the original author must contain its license header with the original author(s) and source.
# Security and Verification
🔐 **All releases are cryptographically signed with GPG for your security.**
Before installing any APK from our releases, we strongly recommend verifying its authenticity to ensure it hasn't been tampered with.
**[📋 View Release Verification Guide](VERIFY_RELEASES.md)**
The verification process involves:
1. Importing our GPG public key
2. Verifying the release manifest signature
3. Checking file integrity with SHA256 hashes
**GPG Key Details:**
- **Key ID**: `44F0AAEB77F373747E3D5444885822EED3A26A6D`
- **Fingerprint**: `44F0 AAEB 77F3 7374 7E3D 5444 8858 22EE D3A2 6A6D`
- **User ID**: `greenart7c3 <greenart7c3@proton.me>`
**Quick verification:**
```bash
# Import the signing key
gpg --keyserver hkps://keys.openpgp.org --recv-keys 44F0AAEB77F373747E3D5444885822EED3A26A6D
# Verify a release (example for v1.0.0)
gpg --verify manifest-v1.0.0.txt.sig manifest-v1.0.0.txt
```
**⚠️ Security Notice**: Only download releases from this official GitHub repository. If GPG verification fails, **do not install the APK** and report it as a security issue.
# Check for reproducibility
TODO: add instructions to check for reproducibility
# Usage
Check [NIP 55](https://github.com/nostr-protocol/nips/blob/master/55.md) and [NIP 46](https://github.com/nostr-protocol/nips/blob/master/46.md) for more information.
VERIFY_RELEASES.md
+184
View File
@@ -0,0 +1,184 @@
# Verifying Amber Releases
## Overview
All Amber releases are cryptographically signed using GPG to ensure integrity and authenticity. This guide explains how to verify that the releases you download are genuine and haven't been tampered with.
## Prerequisites
You'll need to have `gpg` or `gpg2` installed on your system:
- **Ubuntu/Debian**: `sudo apt install gnupg`
- **macOS**: `brew install gnupg`
- **Windows**: Install [Gpg4win](https://www.gpg4win.org/)
## Step 1: Import the Signing Key
First, import the GPG key used to sign Amber releases:
```bash
gpg --keyserver hkps://keys.openpgp.org --recv-keys 44F0AAEB77F373747E3D5444885822EED3A26A6D
```
You should see output similar to:
```
gpg: key EE1FA70568414E2A: public key "greenart7c3 <greenart7c3@proton.me>" imported
gpg: Total number processed: 1
gpg: imported: 1
```
## Step 2: Verify the Key Fingerprint
**IMPORTANT**: Always verify the key fingerprint matches exactly:
```bash
gpg --fingerprint 44F0AAEB77F373747E3D5444885822EED3A26A6D
```
The output should show:
```
pub rsa3072 2025-09-04 [SC]
44F0 AAEB 77F3 7374 7E3D 5444 8858 22EE D3A2 6A6D
uid [unknown] greenart7c3 <greenart7c3@proton.me>
sub rsa3072 2025-09-04 [E]
```
**Verify the fingerprint**: `44F0 AAEB 77F3 7374 7E3D 5444 8858 22EE D3A2 6A6D`
If the fingerprint doesn't match exactly, **DO NOT PROCEED** - the key may be compromised.
## Step 3: Download Release Files
For each release, you need to download:
1. The APK/AAB files you want to use
2. The manifest file (e.g., `manifest-v1.0.0.txt`)
3. The signature file (e.g., `manifest-v1.0.0.txt.sig`)
Example for version v1.0.0:
```bash
# Download the files you need
wget https://github.com/yourusername/Amber/releases/download/v1.0.0/amber-free-universal-v1.0.0.apk
wget https://github.com/yourusername/Amber/releases/download/v1.0.0/manifest-v1.0.0.txt
wget https://github.com/yourusername/Amber/releases/download/v1.0.0/manifest-v1.0.0.txt.sig
```
## Step 4: Verify the Manifest Signature
Verify that the manifest file is authentic:
```bash
gpg --verify manifest-v1.0.0.txt.sig manifest-v1.0.0.txt
```
You should see output like:
```
gpg: Signature made Wed 04 Sep 2025 12:00:00 PM UTC
gpg: using RSA key 44F0AAEB77F373747E3D5444885822EED3A26A6D
gpg: Good signature from "greenart7c3 <greenart7c3@proton.me>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 44F0 AAEB 77F3 7374 7E3D 5444 8858 22EE D3A2 6A6D
```
The **"Good signature"** message is what you're looking for. The warning about the key not being certified is normal unless you've explicitly trusted the key.
## Step 5: Verify File Integrity
Check that your downloaded files match the checksums in the manifest:
```bash
# View the manifest contents
cat manifest-v1.0.0.txt
# Check the SHA256 hash of your downloaded file
sha256sum amber-free-universal-v1.0.0.apk
```
Compare the output hash with the corresponding hash in the manifest file. They must match exactly.
### Automated Verification Script
You can use this script to automate the verification process:
```bash
#!/bin/bash
# verify-amber.sh
VERSION=${1:-"v1.0.0"}
FILE=${2:-"amber-free-universal-${VERSION}.apk"}
echo "Verifying Amber release ${VERSION}..."
# Download manifest and signature if not present
if [ ! -f "manifest-${VERSION}.txt" ]; then
wget "https://github.com/yourusername/Amber/releases/download/${VERSION}/manifest-${VERSION}.txt"
fi
if [ ! -f "manifest-${VERSION}.txt.sig" ]; then
wget "https://github.com/yourusername/Amber/releases/download/${VERSION}/manifest-${VERSION}.txt.sig"
fi
# Verify signature
echo "Verifying GPG signature..."
if gpg --verify "manifest-${VERSION}.txt.sig" "manifest-${VERSION}.txt"; then
echo "✓ GPG signature is valid"
else
echo "✗ GPG signature verification failed!"
exit 1
fi
# Verify file hash if file exists
if [ -f "$FILE" ]; then
echo "Verifying file integrity..."
EXPECTED_HASH=$(grep "$FILE" "manifest-${VERSION}.txt" | cut -d' ' -f1)
ACTUAL_HASH=$(sha256sum "$FILE" | cut -d' ' -f1)
if [ "$EXPECTED_HASH" = "$ACTUAL_HASH" ]; then
echo "✓ File integrity verified: $FILE"
else
echo "✗ File integrity check failed for: $FILE"
echo "Expected: $EXPECTED_HASH"
echo "Actual: $ACTUAL_HASH"
exit 1
fi
else
echo "File $FILE not found - please download it first"
fi
echo "✓ All verification checks passed!"
```
Make it executable and use it:
```bash
chmod +x verify-amber.sh
./verify-amber.sh v1.0.0 amber-free-universal-v1.0.0.apk
```
## Trusting the Key (Optional)
If you want to suppress the "key not certified" warning and you've verified the key fingerprint through a trusted channel, you can sign the key locally:
```bash
gpg --sign-key 44F0AAEB77F373747E3D5444885822EED3A26A6D
```
## Security Notes
- **Always verify the key fingerprint** before trusting any signatures
- **Only download releases from the official GitHub repository**
- **Verify both the GPG signature AND the file hashes**
- **Keep your GPG software up to date**
- If verification fails at any step, **do not use the file** and report it as a potential security issue
## Troubleshooting
### "gpg: Can't check signature: No public key"
You need to import the signing key first (see Step 1).
### "gpg: BAD signature"
The file has been tampered with or corrupted. **Do not use it**.
### Hash mismatch
The downloaded file doesn't match the expected checksum. Re-download the file or try a different mirror.
For more help, please open an issue on the GitHub repository.