Require original signing material for release builds

README.md

@@ -158,6 +158,14 @@ $HOME/android-toolchain/
 
 输出：`app/猫爪游乐场.apk`。
 
+发布更新时，设置 `RELEASE_BUILD=1`，并通过 `KEYSTORE` 指向原签名密钥。此模式下密钥缺失会立即报错，不会生成新密钥。密钥不提交 Git，签名密码可通过 `STOREPASS` 和 `KEYPASS` 环境变量提供。
+
+构建后用 `apksigner verify --print-certs` 比对已发布 APK 与新 APK 的签名证书，证书一致后再发布。当前 v1.0.1 的签名证书 SHA-256：
+
+```text
+40613d8504936be2db15f0d1094f3bf9f693950c726e357b7f3af04f17d53cfb
+```
+
 重新生成音效：
 
 ```bash

app/build.sh

@@ -11,10 +11,16 @@ AAPT2=${AAPT2:-aapt2}
 KEYSTORE=${KEYSTORE:-$ROOT/keystore/catplay.jks}
 STOREPASS=${STOREPASS:-catplay-local}
 KEYPASS=${KEYPASS:-catplay-local}
+export STOREPASS KEYPASS
 ALIAS=${ALIAS:-catplay}
 BUILD_DIR=${BUILD_DIR:-$ROOT/build}
 APK_OUT=${APK_OUT:-$ROOT/猫爪游乐场.apk}
 
+if [[ ${RELEASE_BUILD:-0} == 1 && ! -f "$KEYSTORE" ]]; then
+    echo "release build requires the existing signing keystore: $KEYSTORE" >&2
+    exit 1
+fi
+
 for f in "$ANDROID_JAR" "$RESOURCE_JAR" "$D8_JAR"; do
     [[ -f "$f" ]] || { echo "missing toolchain file: $f" >&2; exit 1; }
 done
@@ -24,7 +30,7 @@ if [[ ! -f "$KEYSTORE" ]]; then
     keytool -genkeypair -v \
         -keystore "$KEYSTORE" -storetype PKCS12 \
         -alias "$ALIAS" -keyalg RSA -keysize 2048 -validity 10000 \
-        -storepass "$STOREPASS" -keypass "$KEYPASS" \
+        -storepass:env STOREPASS -keypass:env KEYPASS \
         -dname "CN=PawPlay, OU=Local, O=PawPlay, L=Local, ST=Local, C=CN" >/dev/null
 fi
 
@@ -58,7 +64,7 @@ PY
 rm -f "$APK_OUT"
 apksigner sign \
     --ks "$KEYSTORE" --ks-key-alias "$ALIAS" \
-    --ks-pass "pass:$STOREPASS" --key-pass "pass:$KEYPASS" \
+    --ks-pass env:STOREPASS --key-pass env:KEYPASS \
     --out "$APK_OUT" "$BUILD_DIR/unsigned.apk"
 apksigner verify --verbose "$APK_OUT" | sed -n '1,12p'
 echo "Built: $APK_OUT"