Skip to content

Fix base64 decode error for keystore signing #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
GeneralKaos666 merged 1 commit into from
Jul 18, 2026
Merged

Fix base64 decode error for keystore signing #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
KA: ${{ secrets.KEYSTORE_KEY_ALIAS }}
KP: ${{ secrets.KEYSTORE_KEY_PASSWORD }}
run: |
printf '%s' "$KEYSTORE_B64" | base64 -d > "$RUNNER_TEMP/ghost-rain.jks"
echo "$KEYSTORE_B64" | base64 --decode --ignore-garbage > "$RUNNER_TEMP/ghost-rain.jks"

@qodo-code-review qodo-code-review Bot Jul 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Permissive base64 decode 🐞 Bug ☼ Reliability

The workflow decodes KEYSTORE_B64 with base64 --ignore-garbage, which silently discards any
non-base64 characters instead of failing fast on malformed input. This can turn a paste-corrupted
secret into a different .jks file and defer the failure to Gradle signing with harder-to-diagnose
errors.
Agent Prompt 
## Issue description
The workflow currently uses `base64 --decode --ignore-garbage` to decode the keystore secret. This weakens validation by silently discarding non-base64 characters, which can produce a corrupted keystore file and move the error to a later signing step.

## Issue Context
This decoded file is then referenced via `keystore.properties` and consumed by the Android Gradle signing configuration, so failing fast at decode time is valuable for diagnosability.

## Fix Focus Areas
- .github/workflows/build.yml[20-34]

## Suggested fix
Replace the permissive decode with a strict decode while only normalizing expected whitespace (e.g., remove `\r`/newlines) and keep decode errors fatal.

Example:
```bash
printf '%s' "$KEYSTORE_B64" | tr -d '\r\n' | base64 --decode > "$RUNNER_TEMP/ghost-rain.jks"
```
(Optionally, add a small validation step to ensure the sanitized string contains only base64 characters before decoding.)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

cat > keystore.properties <<EOF
storeFile=$RUNNER_TEMP/ghost-rain.jks
storePassword=$SP
Expand Down