From 97122d315b6c8adc0db1607fcba98adc5ee8e70c Mon Sep 17 00:00:00 2001 From: Gio Lodi Date: Tue, 25 Aug 2026 17:23:20 +1000 Subject: [PATCH 1/2] Move the upload keystore out of the checkout MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Applies the convention from the out-of-repo Android keystores RFC: https://appsinfrap2.wordpress.com/2026/08/21/rfc-convention-for-out-of-repo-android-keystores/ The upload keystore was the last genuine secret still decrypted into the working tree. It now lands in the same out-of-repo secrets directory that already holds `secrets.properties`, so nothing sensitive sits inside the checkout for an editor, a backup, or an agent to pick up. Naming the directory `decryptedSecretsDir` is deliberate: it is the name the RFC's snippet uses for the `a8c-secrets` equivalent, so adopting `a8c-secrets` later only changes what the variable points at, not the signing config that reads it. Gating on the keystore file rather than on `uploadStoreFile` lets the path stop being a secret value — a filename the build script owns is not something `secrets.properties` needs to carry. `uploadStoreFile` and `debugStoreFile` are now unused and can be dropped from `mobile-secrets` separately. `.gitignore` keeps its `WordPress/*.jks` entries on purpose. Checkouts that ran `configure_apply` before this change still have a stale `WordPress/upload.jks` on disk, and un-ignoring it would make a real signing key committable. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Code Opus 5 --- .configure | 4 ++-- WordPress/build.gradle | 20 ++++++++++---------- settings.gradle | 3 ++- 3 files changed, 14 insertions(+), 13 deletions(-) diff --git a/.configure b/.configure index 88cf56cf5997..2d8aadffccfe 100644 --- a/.configure +++ b/.configure @@ -15,7 +15,7 @@ }, { "file": "android/debug.keystore", - "destination": "~/.configure/wordpress-android/secrets/debug_a8c.keystore", + "destination": "~/.configure/wordpress-android/secrets/debug.keystore", "encrypt": true }, { @@ -25,7 +25,7 @@ }, { "file": "android/automattic_upload.jks", - "destination": "WordPress/upload.jks", + "destination": "~/.configure/wordpress-android/secrets/upload.keystore", "encrypt": true }, { diff --git a/WordPress/build.gradle b/WordPress/build.gradle index 417b05ec667f..1ab62fd68b1d 100644 --- a/WordPress/build.gradle +++ b/WordPress/build.gradle @@ -280,10 +280,12 @@ android { } signingConfigs { - if (["uploadStoreFile", "uploadStorePassword", "uploadKeyAlias", "uploadKeyPassword"].count { !gradle.ext.secretProperties.containsKey(it) } == 0) { - logger.info("App signing properties found in secrets.properties, configuring signing for release builds.") + def uploadKeystore = new File(gradle.ext.decryptedSecretsDir, "upload.keystore") + def uploadCredentials = ["uploadStorePassword", "uploadKeyAlias", "uploadKeyPassword"] + if (uploadKeystore.exists() && uploadCredentials.every { gradle.ext.secretProperties.containsKey(it) }) { + logger.info("Upload keystore found, configuring signing for release builds.") release { - storeFile = rootProject.file(gradle.ext.secretProperties.get("uploadStoreFile")) + storeFile = uploadKeystore storePassword = gradle.ext.secretProperties.get("uploadStorePassword") keyAlias = gradle.ext.secretProperties.get("uploadKeyAlias") keyPassword = gradle.ext.secretProperties.get("uploadKeyPassword") @@ -291,13 +293,11 @@ android { android.buildTypes.release.signingConfig = android.signingConfigs.release } - if (gradle.ext.secretProperties.containsKey("debugStoreFile")) { - logger.info("Debug signing properties found in secrets.properties, configuring signing for debug builds.") - def sharedDebugStore = file(gradle.ext.secretProperties.get("debugStoreFile").replaceFirst("^~", System.getProperty("user.home"))) - if (sharedDebugStore.exists()) { - debug { - storeFile sharedDebugStore - } + def debugKeystore = new File(gradle.ext.decryptedSecretsDir, "debug.keystore") + if (debugKeystore.exists()) { + logger.info("Shared debug keystore found, configuring signing for debug builds.") + debug { + storeFile debugKeystore } } } diff --git a/settings.gradle b/settings.gradle index 527136368f0c..ef549373a030 100644 --- a/settings.gradle +++ b/settings.gradle @@ -20,7 +20,8 @@ plugins { gradle.ext { isCi = System.getenv('CI')?.toBoolean() ?: false - secretPath = "${System.getProperty("user.home")}/.configure/wordpress-android/secrets/secrets.properties" + decryptedSecretsDir = file("${System.getProperty("user.home")}/.configure/wordpress-android/secrets") + secretPath = new File(decryptedSecretsDir, "secrets.properties").path secretProperties = loadSecrets( logger, file("${rootDir}/defaults.properties"), From 0f8554abf50f02e3b5f1d2ea7f5b0bcdd8a01398 Mon Sep 17 00:00:00 2001 From: Gio Lodi Date: Thu, 27 Aug 2026 10:39:30 +1000 Subject: [PATCH 2/2] Keep `.jks` as the upload keystore extension Renaming it to `.keystore` alongside the move out of the checkout was gratuitous: the file this PR relocates is already `automattic_upload.jks` in `mobile-secrets`, so keeping the extension makes the move the only change under review. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 --- .configure | 2 +- WordPress/build.gradle | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.configure b/.configure index 2d8aadffccfe..18d6c18827f9 100644 --- a/.configure +++ b/.configure @@ -25,7 +25,7 @@ }, { "file": "android/automattic_upload.jks", - "destination": "~/.configure/wordpress-android/secrets/upload.keystore", + "destination": "~/.configure/wordpress-android/secrets/upload.jks", "encrypt": true }, { diff --git a/WordPress/build.gradle b/WordPress/build.gradle index 1ab62fd68b1d..3ac8a6c85d2c 100644 --- a/WordPress/build.gradle +++ b/WordPress/build.gradle @@ -280,7 +280,7 @@ android { } signingConfigs { - def uploadKeystore = new File(gradle.ext.decryptedSecretsDir, "upload.keystore") + def uploadKeystore = new File(gradle.ext.decryptedSecretsDir, "upload.jks") def uploadCredentials = ["uploadStorePassword", "uploadKeyAlias", "uploadKeyPassword"] if (uploadKeystore.exists() && uploadCredentials.every { gradle.ext.secretProperties.containsKey(it) }) { logger.info("Upload keystore found, configuring signing for release builds.")