Skip to content

Fix INSTALL_FAILED_UPDATE_INCOMPATIBLE, add auto-signing, versioning, releases, and fork documentation #205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
winnerspiros merged 7 commits into from
Apr 19, 2026
Merged

Fix INSTALL_FAILED_UPDATE_INCOMPATIBLE, add auto-signing, versioning, releases, and fork documentation #205

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
282a1f6
fix: remove ephemeral debug keystore signing, require consistent keys…
Copilot Apr 19, 2026
dcbf502
fix: address runtime crash risks found during review
Copilot Apr 19, 2026
90f0fb8
fix: prevent file I/O on audio thread, add safety guard in display mo…
Copilot Apr 19, 2026
76cae0e
feat: add version input and auto-create GitHub Release from workflow_…
Copilot Apr 19, 2026
f9f74a1
feat: add versioning, auto-release, and clean APK naming to release w…
Copilot Apr 19, 2026
908946d
docs: comprehensive README documenting all fork differences from upst…
Copilot Apr 19, 2026
ee34a92
docs: add osu-framework and veldrid fork sections to README
Copilot Apr 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
111 changes: 111 additions & 0 deletions .github/workflows/generate-keystore.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,111 @@
name: Generate Android Signing Keystore

on:
workflow_dispatch:
inputs:
key_password:
description: "Password for the keystore and key (min 6 characters)"
required: true
type: string
key_alias:
description: "Key alias name"
required: false
default: "osu-release"
type: string
validity_days:
description: "Certificate validity in days"
required: false
default: "10000"
type: string

jobs:
generate:
name: Generate Keystore
runs-on: ubuntu-latest
permissions: {}
steps:
# Mask the password so it is never printed in logs.
- name: Mask password
run: echo "::add-mask::${{ inputs.key_password }}"

- name: Validate inputs
run: |
if [ ${#KEY_PASSWORD} -lt 6 ]; then
echo "::error::Password must be at least 6 characters."
exit 1
fi
env:
KEY_PASSWORD: ${{ inputs.key_password }}

- name: Generate keystore
run: |
keytool -genkeypair -v \
-keystore osu-release.keystore \
-storepass "$KEY_PASSWORD" \
-keypass "$KEY_PASSWORD" \
-alias "$KEY_ALIAS" \
-keyalg RSA -keysize 2048 \
-validity "$VALIDITY_DAYS" \
-dname "CN=osu! Android Release,O=osu,C=US"

echo "Keystore generated successfully ✓"
keytool -list -v -keystore osu-release.keystore -storepass "$KEY_PASSWORD" | head -20
env:
KEY_PASSWORD: ${{ inputs.key_password }}
KEY_ALIAS: ${{ inputs.key_alias }}
VALIDITY_DAYS: ${{ inputs.validity_days }}

- name: Encode keystore as base64
id: encode
run: |
B64=$(base64 -w 0 osu-release.keystore)
echo "$B64" > keystore-base64.txt
echo "encoded=true" >> "$GITHUB_OUTPUT"

- name: Upload keystore artifact
uses: actions/upload-artifact@v7
with:
name: osu-signing-keystore
path: osu-release.keystore
retention-days: 1

- name: Upload base64 artifact
uses: actions/upload-artifact@v7
with:
name: osu-signing-keystore-base64
path: keystore-base64.txt
retention-days: 1

- name: Output setup instructions
run: |
echo ""
echo "==================================================================="
echo " KEYSTORE GENERATED — SAVE THESE SECRETS NOW"
echo "==================================================================="
echo ""
echo " Go to: Settings → Secrets and variables → Actions → New repository secret"
echo ""
echo " Add these four secrets:"
echo ""
echo " 1. ANDROID_KEYSTORE_BASE64"
echo " → Value: contents of the 'keystore-base64.txt' file from the"
echo " 'osu-signing-keystore-base64' artifact (download it above)"
echo ""
echo " 2. ANDROID_SIGNING_KEY_ALIAS"
echo " → Value: ${{ inputs.key_alias }}"
echo ""
echo " 3. ANDROID_SIGNING_KEY_PASSWORD"
echo " → Value: the password you entered when triggering this workflow"
echo ""
echo " 4. ANDROID_SIGNING_STORE_PASSWORD"
echo " → Value: the password you entered when triggering this workflow"
echo ""
echo " IMPORTANT:"
echo " • Keep a backup of the keystore file! If you lose it, you will"
echo " never be able to update your installed APK — you would have to"
echo " uninstall and reinstall (losing all local data)."
echo " • After saving the secrets, DELETE this workflow run to remove"
echo " the keystore artifact (Settings → Actions → this run → Delete)."
echo ""
echo " After saving the secrets, run the 'Build Android APK' workflow."
Comment on lines +58 to +110

Copilot AI Apr 19, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow uploads the signing keystore and its base64 encoding as artifacts. That makes the private signing key retrievable by anyone who can access workflow artifacts, which defeats the purpose of APK signing and enables malicious update signing if leaked. Prefer generating/storing the keystore outside GitHub Actions and adding it directly to repository secrets, or ensure this workflow only runs in a tightly restricted/private repo where artifact access is controlled.

Suggested change
- name: Encode keystore as base64
id: encode
run: |
B64=$(base64 -w 0 osu-release.keystore)
echo "$B64" > keystore-base64.txt
echo "encoded=true" >> "$GITHUB_OUTPUT"
- name: Upload keystore artifact
uses: actions/upload-artifact@v7
with:
name: osu-signing-keystore
path: osu-release.keystore
retention-days: 1
- name: Upload base64 artifact
uses: actions/upload-artifact@v7
with:
name: osu-signing-keystore-base64
path: keystore-base64.txt
retention-days: 1
- name: Output setup instructions
run: |
echo ""
echo "==================================================================="
echo " KEYSTORE GENERATED — SAVE THESE SECRETS NOW"
echo "==================================================================="
echo ""
echo " Go to: Settings → Secrets and variables → Actions → New repository secret"
echo ""
echo " Add these four secrets:"
echo ""
echo " 1. ANDROID_KEYSTORE_BASE64"
echo " → Value: contents of the 'keystore-base64.txt' file from the"
echo " 'osu-signing-keystore-base64' artifact (download it above)"
echo ""
echo " 2. ANDROID_SIGNING_KEY_ALIAS"
echo " → Value: ${{ inputs.key_alias }}"
echo ""
echo " 3. ANDROID_SIGNING_KEY_PASSWORD"
echo " → Value: the password you entered when triggering this workflow"
echo ""
echo " 4. ANDROID_SIGNING_STORE_PASSWORD"
echo " → Value: the password you entered when triggering this workflow"
echo ""
echo " IMPORTANT:"
echo " • Keep a backup of the keystore file! If you lose it, you will"
echo " never be able to update your installed APK — you would have to"
echo " uninstall and reinstall (losing all local data)."
echo " • After saving the secrets, DELETE this workflow run to remove"
echo " the keystore artifact (Settings → Actions → this run → Delete)."
echo ""
echo " After saving the secrets, run the 'Build Android APK' workflow."
- name: Remove generated keystore from runner
if: always()
run: |
rm -f osu-release.keystore keystore-base64.txt
- name: Output setup instructions
run: |
echo ""
echo "==================================================================="
echo " KEYSTORE GENERATED ON RUNNER — NOT EXPORTED"
echo "==================================================================="
echo ""
echo " This workflow no longer uploads the signing keystore or a base64"
echo " copy as artifacts, because doing so would expose the private"
echo " signing key to anyone who can access workflow artifacts."
echo ""
echo " To set up Android signing safely:"
echo ""
echo " 1. Generate the release keystore locally or in another controlled"
echo " environment outside GitHub Actions."
echo " 2. Base64-encode it locally."
echo " 3. Add these repository secrets manually:"
echo ""
echo " • ANDROID_KEYSTORE_BASE64"
echo " • ANDROID_SIGNING_KEY_ALIAS"
echo " • ANDROID_SIGNING_KEY_PASSWORD"
echo " • ANDROID_SIGNING_STORE_PASSWORD"
echo ""
echo " The key alias configured for this run was: ${{ inputs.key_alias }}"
echo ""
echo " After the secrets are configured, run the 'Build Android APK'"
echo " workflow."

Copilot uses AI. Check for mistakes.
echo "==================================================================="
Loading
Loading