Publish the APK under the stable name dish.apk - #169
Merged
Conversation
releases/latest/download/dish.apk is now a permanent link to the newest sideload build, so dish-website can link the APK directly the same way it links dish-windows' dish-setup.exe. The stable copy is staged before the harden job, so SHA256SUMS, the cosign signatures and the SLSA provenance cover it. Also drops private-repository from the SLSA generator call: the repo is public now, and the flag only acknowledged the Rekor-log name leak while it was private. Play release notes for 1.1.4 (code 10104) are included for all five locales.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The release Stage step now uploads the github-flavor APK twice: the versioned
dish-<tag>.apk(unchanged) plus a stabledish.apk, sohttps://github.com/TinkerNorth/dish-android/releases/latest/download/dish.apkalways delivers the newest release. This lets dish-website offer a direct APK download that never goes stale, matching the contract dish-windows (
dish-setup.exe) and now satellite/dish-linux ship. The alias is staged before the harden job, so SHA256SUMS, cosign signatures, and SLSA provenance cover it. It never carries the-unsignedsuffix — tagged builds hard-fail without the keystore, so a publisheddish.apkis always signed.Once the website links it, the name is a public API (CHANGELOG says so): renaming it breaks the download link in the field.
Also
private-repository: falseon the SLSA generator call — the repo has been public since the distribution work, and the flag only acknowledged the Rekor name leak while private.10104.txtin all five locales, so thecheck_play_metadatagate passes when 1.1.4 is tagged.