ci: sign android apk with keystore

.gitignore

@@ -3,4 +3,5 @@
 /.env
 /tools
 .mktools/
-/.gitea-release
+/.gitea-release
+/.keystore

Jenkinsfile

@@ -45,6 +45,9 @@ standardMakePipeline([
         'extras;google;google_play_services'
     ''',
     'credentials': [
+        file(credentialsId: 'android-keystore', variable: 'ANDROID_KEYSTORE_FILE'),
+        string(credentialsId: 'android-keystore-pass', variable: 'ANDROID_KEYSTORE_PASS'),
+        string(credentialsId: 'android-keystore-key-pass', variable: 'ANDROID_KEYSTORE_KEY_PASS'),
         usernamePassword(credentialsId: 'kipp-credentials', usernameVariable: 'MKT_GITEA_RELEASE_USERNAME', passwordVariable: 'MKT_GITEA_RELEASE_PASSWORD')
     ]
 ])

Makefile

@@ -11,6 +11,14 @@ MKT_GITEA_RELEASE_ORG := arcad
 
 GOTEST_ARGS ?= -short
 
+ANDROID_KEYSTORE_FILE ?= .keystore
+ANDROID_KEYSTORE_KEY_ALIAS ?= arcast
+export ANDROID_KEYSTORE_PASS ?= NotSoSecret
+export ANDROID_KEYSTORE_KEY_PASS ?= NotSoSecret
+ANDROID_KEYSTORE_KEY_VALIDITY ?= 365000
+
+ANDROID_BUILD_TOOLS_VERSION ?= 34.0.0
+
 watch: tools/modd/bin/modd deps ## Watching updated files - live reload
 	( set -o allexport && source .env && set +o allexport && tools/modd/bin/modd )
 
@@ -39,10 +47,31 @@ build-android: tools/gogio/bin/gogio deps ## Build executable
 	CGO_ENABLED=1 GOOS=android CGO_CFLAGS="-I${JDK_PATH}/include -I${JDK_PATH}/include/linux -w" tools/gogio/bin/gogio -target android -buildmode archive -o android/app/libs/mobile.aar -x ./cmd/mobile
 	( cd android && ./gradlew assembleDebug )
 
-release-android: tools/gogio/bin/gogio deps ## Build executable
+
+$(ANDROID_KEYSTORE_FILE):
+	keytool -genkey -noprompt \
+        -alias $(ANDROID_KEYSTORE_KEY_ALIAS) \
+        -dname "CN=cadoles.com, OU=Dev, O=Cadoles, L=Dijon, S=Bourgogne-FrancheComté, C=FR" \
+        -keystore "$(ANDROID_KEYSTORE_FILE)" \
+		-keyalg RSA \
+		-validity $(ANDROID_KEYSTORE_KEY_VALIDITY) \
+        -storepass "$(ANDROID_KEYSTORE_PASS)" \
+		-keypass "$(ANDROID_KEYSTORE_KEY_PASS)"
+
+release-android: $(ANDROID_KEYSTORE_FILE) tools/gogio/bin/gogio deps ## Build executable
 	mkdir -p dist
 	CGO_ENABLED=1 GOOS=android CGO_CFLAGS="-I${JDK_PATH}/include -I${JDK_PATH}/include/linux -w" tools/gogio/bin/gogio -target android -buildmode archive -o android/app/libs/mobile.aar -x ./cmd/mobile
 	( cd android && ./gradlew assemble )
+	rm -f android/app/build/outputs/apk/release/app-release-unsigned-aligned.apk
+	$(ANDROID_HOME)/build-tools/$(ANDROID_BUILD_TOOLS_VERSION)/zipalign -p 4 android/app/build/outputs/apk/release/app-release-unsigned.apk android/app/build/outputs/apk/release/app-release-unsigned-aligned.apk
+	$(ANDROID_HOME)/build-tools/$(ANDROID_BUILD_TOOLS_VERSION)/apksigner \
+		sign \
+		--ks-key-alias $(ANDROID_KEYSTORE_KEY_ALIAS) \
+		--ks $(ANDROID_KEYSTORE_FILE) \
+		--ks-pass env:ANDROID_KEYSTORE_PASS \
+		--key-pass env:ANDROID_KEYSTORE_KEY_PASS \
+		--in android/app/build/outputs/apk/release/app-release-unsigned-aligned.apk \
+		--out android/app/build/outputs/apk/release/app-release.apk
 
 install-android: build-android
 	adb uninstall com.cadoles.arcast_player
@@ -85,7 +114,7 @@ gitea-release: .mktools build release-android
 	cp ./bin/desktop_arm64 .gitea-release/arcad_player_linux_arm64
 
 	cp ./bin/client .gitea-release/arcad_client_linux_amd64
-	cp ./android/app/build/outputs/apk/release/app-release-unsigned.apk .gitea-release/arcast_player.apk
+	cp ./android/app/build/outputs/apk/release/app-release.apk .gitea-release/arcast_player.apk
 
 	MKT_GITEA_RELEASE_PROJECT="arcast" \
 		MKT_GITEA_RELEASE_ORG="arcad" \