Merge pull request 'feat(fdroid-publish): add silvermaps signer pin' (#7) from feat/silvermaps-fdroid into main

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -18,7 +18,7 @@ lock), then read the published index back.
 ```yaml
 - uses: https://git.silverlabs.uk/SilverLABS/ci-actions/fdroid-publish@v1
   with:
-    app: silverchat            # silverchat | silvervpn | silverstore | silvermail | silverbeats
+    app: silverchat            # silverchat | silvervpn | silverstore | silvermail | silverbeats | silvercontacts | silvercalendar | silvermaps
     apk: path/to/app-release.apk
     channel: beta              # default
     version-code: ${{ github.run_number }}   # optional; read from the APK if omitted

catalogue-publish/publish-to-catalogue.sh

@@ -150,12 +150,13 @@ fi
 
 [ -n "${CATALOGUE_PUBLISH_KEY:-}" ] || die "CATALOGUE_PUBLISH_KEY is not set"
 
-# Pass the bearer header through a curl config read from a process
+# Pass the bearer header through a curl config on stdin (-K -), so the key never
-# substitution, so the key never lands in argv or the shell trace.
+# lands in argv or the shell trace. (Not process substitution: native Windows
+# curl under Git Bash cannot open /dev/fd paths.)
 BODY_FILE="$(mktemp)"
 trap 'rm -f "$BODY_FILE"' EXIT
-HTTP_CODE="$(curl -sS -o "$BODY_FILE" -w '%{http_code}' -X POST \
+HTTP_CODE="$(printf 'header = "Authorization: Bearer %s"\n' "$CATALOGUE_PUBLISH_KEY" |
-  -K <(printf 'header = "Authorization: Bearer %s"\n' "$CATALOGUE_PUBLISH_KEY") \
+  curl -sS -o "$BODY_FILE" -w '%{http_code}' -X POST -K - \
   "${FIELDS[@]}" "$URL")" || die "request to $URL failed"
 
 BODY="$(cat "$BODY_FILE")"

catalogue-publish/test.sh

@@ -20,4 +20,24 @@ OUT="$(GITHUB_ACTION_PATH="$HERE" INPUT_APP=silvermail INPUT_FILE="$TMP/App-1.0.
 for n in Platform=Windows Format=Nupkg VersionCode=1000000 AppSlug=silvermail; do
   printf '%s' "$OUT" | grep -qF -- "$n" && ok "dry-run has $n" || bad "dry-run missing $n"; done
 printf '%s' "$OUT" | grep -qF -- "$SECRET" && bad "key leaked" || ok "key not printed"
+
+# -K must not use process substitution (breaks native curl under Git Bash).
+grep -nE -- '-K[[:space:]]+<\(' "$HERE/publish-to-catalogue.sh" >/dev/null && bad "uses -K <(...)" || ok "no process substitution for -K"
+
+# Fake curl: header must arrive on stdin, never in argv.
+mkdir "$TMP/bin"
+cat > "$TMP/bin/curl" <<'F'
+#!/usr/bin/env bash
+out=""; k=""
+while [ $# -gt 0 ]; do case "$1" in -o) out="$2"; shift 2;; -K) k="$2"; shift 2;; *) printf '%s
+' "$1" >> "$FAKE_ARGS"; shift;; esac; done
+printf '%s' "$k" > "$FAKE_K"
+cat > "$FAKE_STDIN"
+echo '{}' > "$out"; printf 201
+F
+export FAKE_ARGS="$TMP/args" FAKE_K="$TMP/k" FAKE_STDIN="$TMP/stdin"; : > "$FAKE_ARGS"
+PATH="$TMP/bin:$PATH" CATALOGUE_PUBLISH_KEY="$SECRET" bash "$HERE/publish-to-catalogue.sh"   --slug a --platform windows --arch x64 --format nupkg --version 1.0.0 --version-code 1 --channel beta "$TMP/App-1.0.0.nupkg" >/dev/null 2>&1   && ok "fake-curl publish exit 0" || bad "fake-curl publish failed"
+[ "$(cat "$TMP/k")" = "-" ] && ok "-K -" || bad "-K arg is '$(cat "$TMP/k")'"
+grep -qF "Authorization: Bearer $SECRET" "$TMP/stdin" && ok "header on stdin" || bad "header not on stdin"
+grep -qF "$SECRET" "$TMP/args" && bad "key in argv" || ok "key not in argv"
 exit $FAILS

fdroid-publish/action.yml

@@ -7,7 +7,7 @@ description: >
   reads the index back afterwards.
 inputs:
   app:
-    description: silverchat | silvervpn | silverstore | silvermail | silverbeats
+    description: silverchat | silvervpn | silverstore | silvermail | silverbeats | silvercontacts | silvercalendar | silvermaps
     required: true
   apk:
     description: Path to the signed APK

fdroid-publish/publish.sh

@@ -32,7 +32,10 @@ case "$app" in
   silverstore) pkg=uk.silverlabs.silverstore; cert=f3d835bbd3717f151400b4e0e95212289d585f568690fb05634881f26ec251e4 ;;
   silvermail)  pkg=uk.silverlabs.silvermail;  cert=ccb60c6adc9b015cef88ad9a18a6194178c52754097a3f1d61029b1f6ef32ba2 ;;
   silverbeats) pkg=uk.silverlabs.silverbeats; cert=bed6d769851c415a868863b845807ab41da0d7da0ad82f87797830f487210d60 ;;
-  *) fail "app must be silverchat, silvervpn, silverstore, silvermail or silverbeats (got '$app')" ;;
+  silvercontacts) pkg=uk.silverlabs.silvercontacts; cert=b2818de4d11779d2035cf7fe04a0d716c880f74358a4d3a2c057a851e6c68747 ;;
+  silvercalendar) pkg=uk.silverlabs.silvercalendar; cert=d354792e4b532ee4ff2a21a2807fe048144b12bf3951f7c307bb53dce0ead873 ;;
+  silvermaps)  pkg=uk.silverlabs.silvermaps;  cert=a8d93835c996e24c5150b7f2a59facf5acca4ef95d8c5d0979e0cc376b9e62d7 ;;
+  *) fail "app must be silverchat, silvervpn, silverstore, silvermail, silverbeats, silvercontacts, silvercalendar or silvermaps (got '$app')" ;;
 esac
 case "$channel" in
   beta)   root=/srv/fdroid-test; url=https://apps.silverlined.uk/fdroid-test/repo ;;