Drop the redundant release.jks gitignore entry

[mokagio]

Description

Removes a dead reference to release.jks. See AINFRA-2581

AI-generated details

release.jks is the pre–Play App Signing master key. It is enrolled and now held by Google; release builds are signed locally with the upload key and Google re-signs. Nothing in this repo reads the master key's credentials — grepping storeFile, storePassword, keyAlias and keyPassword across the Gradle files, fastlane/ and .buildkite/ returns no hits, and nothing injects them as Gradle properties either. The only trace left was this .gitignore line, which implies the build still produces or consumes a release.jks.

This is the repo half of AINFRA-2581 and does not close it. The issue's actual deliverable is removing the dormant storeFile/storePassword/keyAlias/keyPassword credential set from secrets.properties in the mobile-secrets vault. That is where the security value is; this PR carries none on its own. Please don't tick the issue's acceptance criteria off the back of it.

Intentional tradeoff worth flagging: the line being deleted is already covered by WordPress/*.jks two lines below, so this is behaviour-neutral by design — the value is removing a misleading signal, not changing what git ignores.

WordPress/debug.keystore is dormant by the same argument (the debug keystore resolves out of the checkout) but is deliberately kept: no glob covers .keystore, so that line is the only guard against a stray debug key landing in the tree.

Testing instructions

No build-visible behaviour changes. Verify the path is still ignored:

1. git checkout ainfra-2581-remove-dormant-releasejks-app-signing-key-references-from
2. git check-ignore -v --no-index WordPress/release.jks

• Still ignored, now matched by WordPress/*.jks rather than by its own line

3. git check-ignore -v --no-index WordPress/upload.jks WordPress/debug.keystore

• Both still ignored, unchanged

Optionally, to confirm the signing path is untouched:

4. ./gradlew :WordPress:signingReport

• Release variants resolve the same store path and certificate fingerprint as on trunk

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wzieba]

Thanks @mokagio !

WordPress/debug.keystore is dormant by the same argument (the debug keystore resolves out of the checkout) but is deliberately kept: no glob covers .keystore, so that line is the only guard against a stray debug key landing in the tree.

"stray debug key landing in the tree" - I don't think it can ever happen, we don't seem to use a shared key anymore. I'd vote to remove debug.keystore from the git ignore too.

Also, as you clean up keys, do you mind double checking if we use debugStoreFile? I don't seem we do, and we could clean this up as well:

WordPress-Android/WordPress/build.gradle

Lines 294 to 302 in 2f7d263

	if (gradle.ext.secretProperties.containsKey("debugStoreFile")) {
	logger.info("Debug signing properties found in secrets.properties, configuring signing for debug builds.")
	def sharedDebugStore = file(gradle.ext.secretProperties.get("debugStoreFile").replaceFirst("^~", System.getProperty("user.home")))
	if (sharedDebugStore.exists()) {
	debug {
	storeFile sharedDebugStore
	}
	}
	}

Some time ago I've cleaned up debug.keystore in #21509 but it's different from the one that "debugStoreFile" references to.

[mokagio]

Thanks @wzieba ! debug.keystore has been remove from the .gitignore because indeed that file was no longer in use. However, as far as I understand, the project still uses a shared keystore for debug builds.

First, .configure decodes the keystore outside the repo:

WordPress-Android/.configure

Lines 16 to 20 in 00d8466

	{
	"file": "android/debug.keystore",
	"destination": "~/.configure/wordpress-android/secrets/debug_a8c.keystore",
	"encrypt": true
	},

Then, the code you shared check if there is a path in secrets.property, and I can confirm there is.

Finally, because the check passes, the debug keystore is used.

Up to you and @wordpress-mobile/android-developers to tell me if that's something we want to keep (maybe without the coupling of file path and secrets.properties) or if it's no longer necessary. My understanding is that there's value in a shared debug keystore helps with reproducibility between devs and CI, but I only heard of that rationale, never verified it myself.

Needless to say, removing it makes the system simpler, so if there's no clear advantage, I'm all for it.