fix(pushapk): Actually check apk signatures

[hneiva]

Summary

pushapkscript has never verified an APK or AAB signature, for any product, in any environment. skip_check_signature was read from the wrong config dict, so the jarsigner and MANIFEST.MF checks in script.py were dead code. This predates the initial monorepo import.

Switching them on needed four more fixes, one of which would otherwise have broken production.

The bug

script.py:

if not publish_config.get("skip_check_signature", True):

skip_check_signature is declared at the product level of the config schema, but this reads it from publish_config, the per-app/channel/store dict built by get_publish_config(). That function never emits the key, so the lookup always missed and always fell back to the default.

Two bugs, not one:

1. Wrong dict. The option is unreachable.
2. Wrong default. True means skip, and the else branch claims the product is configured with the option, but that branch is what ran when the key was absent, which is every product in worker.yml.

Fixing only (1) changes nothing, since nothing sets the option. Both had to move together. No test covered either branch, which is why this survived.

What else was blocking it

jarsigner was not installed anywhere. Both the deployed image and the test image installed default-jre-headless, which ships keytool but not jarsigner; jarsigner is JDK only. Verified on debian:bookworm, where the JRE package provides just /usr/bin/keytool while default-jdk-headless provides both. Turning verification on without this would have failed every task in production.

Samsung and Huawei had no certificate_alias. The non-Google branch of _get_channel_publish_config never copied it into its result, so jarsigner._pluck_configuration raised KeyError on it.

mozillavpn dev/fake-prod has no alias at all, and init_worker.sh imports no certificate for it ("no dep signing for mozillavpn yet"). A None alias reached the jarsigner argv as a TypeError from subprocess.

The test fixtures cannot be verified. The APKs date from 2017 and use SHA1withDSA with a 1024-bit key. Modern JDKs disable both, so jarsigner reports them as unsigned and -verify -strict exits 16. Their manifests also list entries that were stripped out of the archives, which -strict rejects on its own.

Commits

• set certificate_alias for non-Google target stores One line, matching what the Google paths already did. The alias identifies the certificate the incoming artifact was signed with, which the upstream signing task decides, so it is the same whichever store the artifact goes to. Huawei support, currently in flight, needs no further change.
• fail loudly when no certificate_alias is configured ConfigValidationError naming the store and pointing at skip_check_signature, instead of a KeyError or a TypeError from inside subprocess.
• install the JDK, so jarsigner exists default-jdk-headless in both the deployed and the test image.
• sign the integration fixtures so they can be verified Generate a throwaway RSA-2048 keypair per test and re-sign each fixture under the alias its config expects, after dropping the stale META-INF so jarsigner writes a fresh manifest. The generated configs now declare SHA-256, which is what worker.yml uses in production. Also fixes test_main_with_samsung_store, which signed for nightly while the fenix release app it targets declares fenix-production.
• verify APK signatures, which never actually ran Read product_config, default to verifying. mozillavpn non-prod opts out explicitly, as the one config that genuinely cannot verify.

Testing

• 91 pass in a default-jdk-headless container, with the integration tests genuinely running jarsigner -verify -strict against freshly signed APKs.
• 84 pass and 7 skip locally without a JDK. Detection runs the binaries rather than looking them up, because macOS ships stubs on PATH that exist but exit non-zero.
• 264 repo-level init tests pass. ruff, ruff-format and yamllint are clean.
• The new test_script.py test fails against the old code with assert 0 == 2, so it is a real regression test.
• Audited every rendered worker.yml combination for a missing alias. mozillavpn dev/fake-prod is the only one, and it opts out.

Risk

This enables a check that has been dead since before the monorepo import, so production artifacts have never been through jarsigner -verify -strict on a modern JDK. Autograph signs with PKCS#7 and SHA-256, so it should hold, but the fixtures show that weak-algorithm rejection is not hypothetical.

Worth watching the first dev/fake-prod task before this reaches prod. skip_check_signature: true on a product is the escape hatch if some artifact turns out not to verify.