feat: add keystore properties pipeline

.gitignore

@@ -7,6 +7,11 @@ build/
 *.aab
 local.properties
 
+# Release signing — NEVER commit the key or its passwords
+keystore.properties
+*.jks
+*.keystore
+
 # Nix
 result
 result-*

app/build.gradle.kts

@@ -1,9 +1,21 @@
+import java.util.Properties
+
 plugins {
     alias(libs.plugins.android.application)
     alias(libs.plugins.kotlin.android)
     alias(libs.plugins.kotlin.compose)
 }
 
+// Release signing is loaded from keystore.properties, which exists only on a machine
+// that owns the signing key (never committed — see .gitignore). F-Droid and CI have no
+// such file and build unsigned; that unsigned output is exactly what F-Droid's
+// reproducible-build check compares against before re-applying our signature.
+val keystorePropertiesFile = rootProject.file("keystore.properties")
+val keystoreProperties =
+    Properties().apply {
+        if (keystorePropertiesFile.exists()) keystorePropertiesFile.inputStream().use { load(it) }
+    }
+
 android {
     namespace = "ca.ksamad.encore"
     compileSdk = 35
@@ -21,8 +33,24 @@ android {
         versionName = "0.1.0"
     }
 
+    signingConfigs {
+        // Present only when the developer keystore is configured; absent on F-Droid/CI.
+        if (keystorePropertiesFile.exists()) {
+            create("release") {
+                storeFile = file(keystoreProperties.getProperty("storeFile"))
+                storePassword = keystoreProperties.getProperty("storePassword")
+                keyAlias = keystoreProperties.getProperty("keyAlias")
+                keyPassword = keystoreProperties.getProperty("keyPassword")
+            }
+        }
+    }
+
     buildTypes {
         release {
+            // Sign with the release key when configured; otherwise stay unsigned so
+            // F-Droid can build/verify reproducibly and re-apply our signature.
+            signingConfig = signingConfigs.findByName("release")
+
             // R8 code shrinking + resource shrinking. Critical with
             // material-icons-extended: it bundles thousands of vector icons, and
             // R8 strips everything we don't reference (debug builds can't shrink,

keystore.properties.example

@@ -0,0 +1,11 @@
+# Copy this file to `keystore.properties` (which is gitignored) and fill in your
+# real values. This file — the .example — carries NO secrets and is safe to commit.
+#
+# `storeFile` is the path to your release keystore. Keep the keystore OUTSIDE the
+# repo (e.g. ~/.keys/encore-release.jks) and back it up offline — losing it means
+# you can never ship another signed update on your own channels.
+
+storeFile=/absolute/path/to/encore-release.jks
+storePassword=CHANGE_ME
+keyAlias=encore
+keyPassword=CHANGE_ME