From 1508bf559a1c234c1c02a61b5e21c0671d9e177e Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 17 Apr 2026 19:40:27 +0000
Subject: [PATCH] Fix Android APK signature corruption and install failures

- Update release.yml to use Debug configuration for unsigned builds.
  This ensures APKs are signed with a debug key for installability on forks.
- Refine FixRuntimePackAssetTypes in osu.Android.props to reclassify
  all non-managed assets as 'native'. This prevents .NET 10 trimmer
  corruption of .so and other native files.
- Improve signing security by moving secrets to environment variables in
  the release workflow and quoting command-line parameters.
- This resolves the INSTALL_PARSE_FAILED_NO_CERTIFICATES error on
  modern Android devices (API 36).
---
 .github/workflows/release.yml | 36 +++++++++++++++++++++--------------
 osu.Android.props             |  8 +++++---
 2 files changed, 27 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 81c2e6ccc71d..2d966c51483d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -88,37 +88,45 @@ jobs:
 
       - name: Build Android APK (signed)
         if: steps.keystore.outputs.has_keystore == 'true'
+        env:
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_SIGNING_KEY_ALIAS }}
+          ANDROID_KEY_PASS: ${{ secrets.ANDROID_SIGNING_KEY_PASSWORD }}
+          ANDROID_STORE_PASS: ${{ secrets.ANDROID_SIGNING_STORE_PASSWORD }}
         run: >
           dotnet publish -c Release
           osu.Android/osu.Android.csproj
           -f net10.0-android
-          -p:Version=${{ steps.version.outputs.version }}
-          -p:ApplicationDisplayVersion=${{ steps.version.outputs.version }}
-          -p:ApplicationVersion=${{ github.run_number }}
+          -p:Version="${{ steps.version.outputs.version }}"
+          -p:ApplicationDisplayVersion="${{ steps.version.outputs.version }}"
+          -p:ApplicationVersion="${{ github.run_number }}"
           -p:AndroidKeyStore=true
-          -p:AndroidSigningKeyStore=${{ github.workspace }}/osu.Android/osu.keystore
-          -p:AndroidSigningKeyAlias=${{ secrets.ANDROID_SIGNING_KEY_ALIAS }}
-          -p:AndroidSigningKeyPass=${{ secrets.ANDROID_SIGNING_KEY_PASSWORD }}
-          -p:AndroidSigningStorePass=${{ secrets.ANDROID_SIGNING_STORE_PASSWORD }}
+          -p:AndroidSigningKeyStore="${{ github.workspace }}/osu.Android/osu.keystore"
+          -p:AndroidSigningKeyAlias="$ANDROID_KEY_ALIAS"
+          -p:AndroidSigningKeyPass="$ANDROID_KEY_PASS"
+          -p:AndroidSigningStorePass="$ANDROID_STORE_PASS"
 
       - name: Build Android APK (unsigned)
         if: steps.keystore.outputs.has_keystore != 'true'
         run: >
-          dotnet publish -c Release
+          dotnet publish -c Debug
           osu.Android/osu.Android.csproj
           -f net10.0-android
-          -p:Version=${{ steps.version.outputs.version }}
-          -p:ApplicationDisplayVersion=${{ steps.version.outputs.version }}
-          -p:ApplicationVersion=${{ github.run_number }}
-          -p:AndroidKeyStore=false
+          -p:Version="${{ steps.version.outputs.version }}"
+          -p:ApplicationDisplayVersion="${{ steps.version.outputs.version }}"
+          -p:ApplicationVersion="${{ github.run_number }}"
 
       - name: Find APK
         id: find_apk
         run: |
-          PUBLISH_DIR="osu.Android/bin/Release/net10.0-android/publish"
+          if [ "${{ steps.keystore.outputs.has_keystore }}" == "true" ]; then
+            CONFIG="Release"
+          else
+            CONFIG="Debug"
+          fi
+          PUBLISH_DIR="osu.Android/bin/$CONFIG/net10.0-android/publish"
           APK=$(find "$PUBLISH_DIR" -maxdepth 1 -name "*.apk" 2>/dev/null | head -1)
           if [ -z "$APK" ]; then
-            APK=$(find osu.Android/bin/Release -name "*.apk" | head -1)
+            APK=$(find "osu.Android/bin/$CONFIG" -name "*.apk" | head -1)
           fi
           echo "apk_path=$APK" >> "$GITHUB_OUTPUT"
 
diff --git a/osu.Android.props b/osu.Android.props
index 7d5474ea97d2..d30be41db2f9 100644
--- a/osu.Android.props
+++ b/osu.Android.props
@@ -56,13 +56,15 @@
   </PropertyGroup>
 
   <!-- Fix for .NET 10 Android AOT misclassifying non-managed assets in runtime pack.
-       This is critical for Android 16 (API 36) which has stricter manifest/parsing rules. -->
+       This is critical for Android 16 (API 36) which has stricter manifest/parsing rules.
+       We hook into multiple stages to ensure all native assets (including BASS and native bridge)
+       are correctly identified before the optimization/signing phases. -->
   <Target Name="FixRuntimePackAssetTypes" AfterTargets="ResolveRuntimePackAssets;ComputeFilesToPublish;ComputeResolvedFilesToPublishList">
     <ItemGroup>
-      <RuntimePackAsset Update="@(RuntimePackAsset)" Condition="'%(Extension)' != '.dll'">
+      <RuntimePackAsset Update="@(RuntimePackAsset)" Condition="'%(Extension)' != '.dll' AND '%(Extension)' != '.pdb'">
         <AssetType>native</AssetType>
       </RuntimePackAsset>
-      <ResolvedFileToPublish Update="@(ResolvedFileToPublish)" Condition="'%(Extension)' != '.dll'">
+      <ResolvedFileToPublish Update="@(ResolvedFileToPublish)" Condition="'%(Extension)' != '.dll' AND '%(Extension)' != '.pdb'">
         <AssetType>native</AssetType>
       </ResolvedFileToPublish>
     </ItemGroup>