CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

play build: signing passwords only through the child environment, never argv

Browse source
This commit is contained in:
CRTkafa 2026-10-23 08:51:07 +08:00
parent 7960063e0e
commit e4ebbb825d
5 changed files with 13 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

4
cli/play/build.ts
View file

@ -8,8 +8,8 @@
// unless --version-code is given, runs `gradlew :app:bundleRelease` (Flutter: flutter build appbundle) and copies the
// AAB to <out>/<package>-<versionCode>.aab, checked by reading its manifest. Signing: the upload key from env or
// .storebound/credentials.json (ANDROID_KEYSTORE, ANDROID_KEYSTORE_PASSWORD, ANDROID_KEY_ALIAS, ANDROID_KEY_PASSWORD)
// goes to Gradle as injected signing properties (-Pandroid.injected.signing.* and the ORG_GRADLE_PROJECT_ environment; the
// passwords are masked in every printed command); without it the
// goes to Gradle as injected signing properties (store file and alias as -P arguments, the passwords only through
// ORG_GRADLE_PROJECT_* in the child environment, never argv); without it the
// project's own signingConfig signs. Local only: Play is only read (version codes).
// Before Gradle runs, the app module's build file must read -PversionCode / -PversionName in defaultConfig (a literal
// or an env var keeps the AAB at that value; android.injected.version.* does not override it for bundleRelease): a