From df0b9e37c11de6f9398d80b26590a8be2c20848d Mon Sep 17 00:00:00 2001 From: Ming Jun Date: Fri, 5 Dec 2025 18:14:02 -0800 Subject: [PATCH 1/2] fix: use single quote to prevent bash expansion --- packages/cli/src/lib/cmds/build.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/cli/src/lib/cmds/build.ts b/packages/cli/src/lib/cmds/build.ts index b4bfed0cc..e5f3b1713 100644 --- a/packages/cli/src/lib/cmds/build.ts +++ b/packages/cli/src/lib/cmds/build.ts @@ -111,9 +111,9 @@ class Build { async signApk(signingKey: SigningKeyInfo, passwords: SigningKeyPasswords): Promise { await this.androidSdkTools.apksigner( signingKey.path, - `"${passwords.keystorePassword}"`, + `'${passwords.keystorePassword}'`, signingKey.alias, - `"${passwords.keyPassword}"`, + `'${passwords.keyPassword}'`, APK_ALIGNED_FILE_NAME, // input file path APK_SIGNED_FILE_NAME, ); @@ -126,8 +126,8 @@ class Build { async signAppBundle(signingKey: SigningKeyInfo, passwords: SigningKeyPasswords): Promise { await this.jarSigner.sign( signingKey, - `"${passwords.keystorePassword}"`, - `"${passwords.keyPassword}"`, + `'${passwords.keystorePassword}~'`, + `'${passwords.keyPassword}'`, APP_BUNDLE_BUILD_OUTPUT_FILE_NAME, APP_BUNDLE_SIGNED_FILE_NAME); } From 2d780c5e66ac37b232c94f683648878d8835c5f7 Mon Sep 17 00:00:00 2001 From: Ming Jun Date: Fri, 12 Dec 2025 16:16:11 -0800 Subject: [PATCH 2/2] fix: escape single quotes --- packages/cli/src/lib/cmds/build.ts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/packages/cli/src/lib/cmds/build.ts b/packages/cli/src/lib/cmds/build.ts index e5f3b1713..26c2f0526 100644 --- a/packages/cli/src/lib/cmds/build.ts +++ b/packages/cli/src/lib/cmds/build.ts @@ -100,6 +100,10 @@ class Build { }; } + formatPassword(password: string): string { + return `'${password}'`.replace(/'/g, "'\\''"); + } + async buildApk(): Promise { await this.gradleWrapper.assembleRelease(); await this.androidSdkTools.zipalignOnlyVerification( @@ -111,9 +115,9 @@ class Build { async signApk(signingKey: SigningKeyInfo, passwords: SigningKeyPasswords): Promise { await this.androidSdkTools.apksigner( signingKey.path, - `'${passwords.keystorePassword}'`, + this.formatPassword(passwords.keystorePassword), signingKey.alias, - `'${passwords.keyPassword}'`, + this.formatPassword(passwords.keyPassword), APK_ALIGNED_FILE_NAME, // input file path APK_SIGNED_FILE_NAME, ); @@ -126,8 +130,8 @@ class Build { async signAppBundle(signingKey: SigningKeyInfo, passwords: SigningKeyPasswords): Promise { await this.jarSigner.sign( signingKey, - `'${passwords.keystorePassword}~'`, - `'${passwords.keyPassword}'`, + this.formatPassword(passwords.keystorePassword), + this.formatPassword(passwords.keyPassword), APP_BUNDLE_BUILD_OUTPUT_FILE_NAME, APP_BUNDLE_SIGNED_FILE_NAME); }