Centralize Android signing verification policies

.github/android-signer/123235.json

@@ -0,0 +1,70 @@
+{
+  "builder": {
+    "authorization": "workflow-identity",
+    "helpers": {},
+    "refs": [
+      "refs/heads/android-signer-v1"
+    ],
+    "repository": "connectbot/actions",
+    "repository_id": 1369420724,
+    "sha256": [],
+    "workflow": ".github/workflows/android-build.yml"
+  },
+  "callers": {
+    ".github/workflows/ci-tags.yml": [],
+    ".github/workflows/ci.yml": []
+  },
+  "finalizer": {
+    "authorization": "workflow-identity",
+    "helpers": {},
+    "refs": [
+      "refs/heads/android-signer-v1"
+    ],
+    "repository": "connectbot/actions",
+    "repository_id": 1369420724,
+    "sha256": [],
+    "workflow": ".github/workflows/android-finalize.yml"
+  },
+  "policy_hash": "10fd32e04fe34e39762734fc69ca043381657bbc1b05a3883d40dadb5f239bb8",
+  "profiles": {
+    "google": {
+      "hybrid_min_sdk": null,
+      "keys": {
+        "classical": "aa43746a46127842169f8176412a1f4b1b1e2f8ad9e15aba217c3822dbeb2d5f",
+        "hybrid": null,
+        "original": "aa43746a46127842169f8176412a1f4b1b1e2f8ad9e15aba217c3822dbeb2d5f",
+        "transparency": "909e650add6ddce32b2307d5aa141f8cdb1bdf455d89388b2f53f8c30fdb0c61",
+        "upload": "734c431bf9cceb91c4f275618ccb63a529bc59544d5f642db18ecfbdec98a7a0"
+      },
+      "lineage_sha256": "0c0c1ad58b77dcd3840ce7c6cd9f15ab93a4c9790c46df31ec5a777d3fdf0516",
+      "package": "org.connectbot",
+      "rotation_min_sdk": 33
+    },
+    "oss": {
+      "hybrid_min_sdk": null,
+      "keys": {
+        "classical": "aa43746a46127842169f8176412a1f4b1b1e2f8ad9e15aba217c3822dbeb2d5f",
+        "hybrid": null,
+        "original": "aa43746a46127842169f8176412a1f4b1b1e2f8ad9e15aba217c3822dbeb2d5f",
+        "transparency": "909e650add6ddce32b2307d5aa141f8cdb1bdf455d89388b2f53f8c30fdb0c61",
+        "upload": "734c431bf9cceb91c4f275618ccb63a529bc59544d5f642db18ecfbdec98a7a0"
+      },
+      "lineage_sha256": "0c0c1ad58b77dcd3840ce7c6cd9f15ab93a4c9790c46df31ec5a777d3fdf0516",
+      "package": "org.connectbot",
+      "rotation_min_sdk": 33
+    }
+  },
+  "receipt_keys": {
+    "9750b8efa9854bae4e7297c77acc16d4423dd6880fddb383154762bd55bf02ef": "MIIEGzCCAoOgAwIBAgIUQ0qildjkbZ4LHXWFAb78Cm6YEOYwDQYJKoZIhvcNAQELBQAwHTEbMBkGA1UEAwwSQ29ubmVjdEJvdCByZWNlaXB0MB4XDTI2MTAxNTIyNDAyMFoXDTM2MTAxMjIyNDAyMFowHTEbMBkGA1UEAwwSQ29ubmVjdEJvdCByZWNlaXB0MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAkPpjqm5pD7skM1G1Dsj68YYLAID82EVZWCzE8OeeFhSfv1KFjjhp/20ixYQbE+5zvDk8/qa9SXSAeNlkx4p1v5Q+Ap0AkpR2zVOzd1yNRFH1O5QbPCVhfDaarDn+YobCGQcjCmVSCPMwT7ZPSDxmMJ3peDh4l+x8/JLmgadHYBZ/F+4EAHNlChjp76QEpSuXz7u7zTVmDRf+8lik7DDTjnWNEkGy03mLXSea8PHtkMp30qyqseOLVfR/SFhIrVq539og+yJDuGcG0NuOnPsTwLqwMgQx1a1YmYyzd8/pWzxB2szs93PhxF17nAC+0yf6E7j6veo+Xya5kVKbmVeQbuI55re/CYV1JlbvP4PcbbnHvkJSWUo3UMpG1KudAyhf7tOpOnksmlJ7jlcwlmUkFfiVlawtH7QV/zfK5N8hmDMu5IfSmBGf5duQBO5R0zzIzBblnzSSlf053ImIZCaBow+tXd9qkvBGqqJ78rVMYryXakC/XnU7Eq9qp6gKQTU5AgMBAAGjUzBRMB0GA1UdDgQWBBQNpjsPxFThmA9LLJ2zC0CgHmba8TAfBgNVHSMEGDAWgBQNpjsPxFThmA9LLJ2zC0CgHmba8TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBgQBFmgXcm3yq1+RLHD+ORAaCZj2+8VXuuWaanDs4CKUetRG2XIGKy2HcS6Lam9wUoJTv1j1jDOuUiDBgEinmaWPLSVHa8OAxnK8fHn4mMdckxT5b95vLgNnMwbF+O8xCUn319mFqhSLsM0Bb9fMB5sd1XTVrewrDXAeTifWh3BJVMnQEM+Ow3RUvejhs8vCDMbA+Vd2U8qokk4v5pqHXZ3eLWZRy2zs3lRaS9okE2r6eVBrGAGNn4lHuP30z7d86UyxN894FhpoJX3GdKMx1iIgbkwPdGSPya5bcnSjQ64buaxZWPDn6LXB3nO4BacVYKmfTWWAqU3cdva8Nt2MdqlR1J5oPUOQWRMIwVR1WkWblvAsipr5tpiJNaFK8SzsGppWb9PMhPDCdjqe0h65/xhcwOrUTl+UvYpawd77syF8RLSWLIS5ro01ALEjS6BnbLVhvDt5EYEKDc1zR+fsFYtpu/IVJww1JQFE93T3RIkPnwRIFIthtZESIsgAEDOT3mVI="
+  },
+  "refs": [
+    "refs/heads/main",
+    "refs/tags/v*"
+  ],
+  "repository": "connectbot/connectbot",
+  "repository_id": 123235,
+  "revision": 1,
+  "signer_revision": "39b8c5393a0e10285905f7ceb5aea73ffa54e870",
+  "version": 2,
+  "visibility": "public"
+}

.github/android-signer/1421097317.json

@@ -0,0 +1,68 @@
+{
+  "builder": {
+    "authorization": "workflow-identity",
+    "helpers": {},
+    "refs": [
+      "refs/heads/android-signer-v1"
+    ],
+    "repository": "connectbot/actions",
+    "repository_id": 1369420724,
+    "sha256": [],
+    "workflow": ".github/workflows/android-build.yml"
+  },
+  "callers": {
+    ".github/workflows/ci.yml": []
+  },
+  "finalizer": {
+    "authorization": "workflow-identity",
+    "helpers": {},
+    "refs": [
+      "refs/heads/android-signer-v1"
+    ],
+    "repository": "connectbot/actions",
+    "repository_id": 1369420724,
+    "sha256": [],
+    "workflow": ".github/workflows/android-finalize.yml"
+  },
+  "policy_hash": "b532a52d5b1f9536b5fd7377ed6107134f7859a71de4934d271e22d8c13daefd",
+  "profiles": {
+    "google": {
+      "hybrid_min_sdk": null,
+      "keys": {
+        "classical": "6e510f9c248e753a676574ca45dab49778ea3982dbca0e56d9374b0e8f50232e",
+        "hybrid": null,
+        "original": "773b07f877303904a904d71f010bfc3b66a6e6aea8b582c85ee4e9c8a83a7962",
+        "transparency": "cd21a0c0adfbb2f57fc5e68b1d7b710a91b313a3b9b32eddc3f4807070b16be5",
+        "upload": "47ffad04ad018d3fb8f319eb71e0b384b874325cb4605970db7646df270c9744"
+      },
+      "lineage_sha256": "80584460793f5cb4f3e97018cc5aba822835d7cd01f657473c1175c77bf2794b",
+      "package": "org.connectbot",
+      "rotation_min_sdk": 33
+    },
+    "oss": {
+      "hybrid_min_sdk": null,
+      "keys": {
+        "classical": "6e510f9c248e753a676574ca45dab49778ea3982dbca0e56d9374b0e8f50232e",
+        "hybrid": null,
+        "original": "773b07f877303904a904d71f010bfc3b66a6e6aea8b582c85ee4e9c8a83a7962",
+        "transparency": "cd21a0c0adfbb2f57fc5e68b1d7b710a91b313a3b9b32eddc3f4807070b16be5",
+        "upload": "47ffad04ad018d3fb8f319eb71e0b384b874325cb4605970db7646df270c9744"
+      },
+      "lineage_sha256": "80584460793f5cb4f3e97018cc5aba822835d7cd01f657473c1175c77bf2794b",
+      "package": "org.connectbot",
+      "rotation_min_sdk": 33
+    }
+  },
+  "receipt_keys": {
+    "c39417bc0184ad027b8f8c821c0efce0f56577a5faa112471ba351de1872bc6d": "MIIEMzCCApugAwIBAgIUZhpPHm5arIDcTxok26GHNqe5H8YwDQYJKoZIhvcNAQELBQAwKTEnMCUGA1UEAwweRGlzcG9zYWJsZSBzaWduZXIgdGVzdCByZWNlaXB0MB4XDTI2MTAxNTE3MjkyN1oXDTI2MTExNDE3MjkyN1owKTEnMCUGA1UEAwweRGlzcG9zYWJsZSBzaWduZXIgdGVzdCByZWNlaXB0MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvmt4AForgW8g43qCAXU9e2UyKjxLSagrQVA+2FFuk2Yv2ePbugn6aDBacs+TzG6HCQrgRGRBUAk6iFXfFilUeG9fmceYJKAwMlwHQrujUoO4a//5KgqXLY/DLFEQSU5suwOyTp/Ab9c3bih88Z9Ma/71obfYmLtkXfumrSsJXA0FNFgUodPtiouzlRG1hVDSPTBHWxQLHUvZ/OHBVF5y2oA1kK6Ou25gOR8+M0mh1iUKvnW+66vTyaycmo5TnAhReQyJ8eqwrAZ4KDXYBEA8MNmPG+2rfQShRn1i4b7JyrkW2doEUSQ+r4MYk8Uiwif8XpPu5VOKJr04So5V1Tj1QUdIPdlhzFzBKenenJfcjlQSexalXK0eHAQUx4DTkyPKKcExOj+thoA0ziaNUfxl0GVkGW6QNCCnODQ+T9H0d5vq36nMPDUrfxYJkxaSIBod4ZF0hCrEumgqAXtmjTHUVUnQZ/mFcsWPIdKFsvFMhefm/zt3estQQhWFy9+UM4ETAgMBAAGjUzBRMB0GA1UdDgQWBBSFTLwfFnSAetvxx/42SzmoXzk6PzAfBgNVHSMEGDAWgBSFTLwfFnSAetvxx/42SzmoXzk6PzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBgQA/XqA6pswPfaY5glfX8V2MJI8Lg6Yt5pz1nfzf9iuCVv9v+9sC+FCekghFQIAdtR458ZpKczRCLJByeQFFnjXWaVnfJaXC2mk0uVp44tgBTHp7VoAASnTKlYK/bxTZZ3aNqPTb+pQYmeATgIFU9lx0hRndTIxux6T65IKY3u40UVJmWWiEZowbZI5GOVqYYoowglvhOSNVeN2RyU3KRaWBAWXJcW9tQIRCIlem0EUNcA8AIghf3iiSmNHJJRjjrQqUtlffFI10lNa41/krRDqqOxcaSFXQJEl+ZnOLGmCIztZQPic/+Jv35wBZjvxToIDdM3dK+MplhCVkeE81xgfiCYYZqNuOEVjaMfLWlRBzNTpwr0PP/gNQo053dq67SAAaqiJVBNKRuBSOUGLCj9eI3ssEjXlzSmGkqdjRz/8XTUKVUxp7Go9yLxh7glGdcVSSg8oITC/3/e8UD7UTK5VUJiDNKuCpLWqw10xTWjmpPMZ9IQuTLVx+2GctoZW+68U="
+  },
+  "refs": [
+    "refs/heads/main"
+  ],
+  "repository": "connectbot/test-signer-1",
+  "repository_id": 1421097317,
+  "revision": 8,
+  "signer_revision": "39b8c5393a0e10285905f7ceb5aea73ffa54e870",
+  "version": 2,
+  "visibility": "public"
+}

.github/android-signer/README.md

@@ -0,0 +1,25 @@
+# Android signing policies
+
+Public verification policies for ConnectBot's Hermit signing service. Files are
+named by the immutable source repository ID, not a caller-supplied name. They
+contain public certificates and allowed identities only. Private keys and their
+filesystem locations stay in the appliance's private configuration.
+
+Trusted workflows in `connectbot/actions` read this repository (immutable ID
+1215286979) at protected `main`. They resolve a commit before fetching a policy
+file and record the policy commit and digest in final provenance. Source builds
+cannot replace this policy through workflow inputs or source checkout contents.
+
+The builder and finalizer run from protected `android-signer-v1` in
+`connectbot/actions` (immutable ID 1369420724). Caller workflow paths identify
+eligible CI entry points; empty digest lists intentionally mean identity-based
+authorization. Exact executed workflow commits remain recorded in certificates,
+receipts and provenance. Ordinary source/caller edits and reviewed builder branch
+updates do not require changes here or on the VM.
+
+Key identity, package, allowed source ref, signing algorithm/rotation policy,
+Sigstore trust, or appliance revision changes require coordinated review and
+provisioning. Export policies with the appliance's offline admin tool after key,
+certificate and lineage validation; do not hand-edit fingerprints or policy hashes.
+The test repository policy uses disposable keys. Its workflow cannot publish to
+Google Play; production Play access is scoped to repository ID 123235 and alpha.