[dzid26]

Summary

The build job decodes the CI_DEBUG_KEYSTORE_BASE64 repository variable (from #139) with base64 -d. A value pasted on Windows ends in CRLF, and base64 -d rejects the carriage return with base64: invalid input. That failed the build job before it produced an APK (seen on the #133/#138 re-runs). This PR strips all whitespace before decoding, which also accepts line-wrapped encoder output such as certutil's.

One line in .github/workflows/android.yml, plus a comment.

Type

• Bug fix
• Feature
• Protocol / crypto change
• Docs / CI / tooling
• Refactor (no behavior change)

Testing

• Reproduced the failure locally: the old pipeline fails on the value with a trailing \r\n.
• The new pipeline decodes a plain value, a CRLF-terminated value, and a 64-column CRLF-wrapped value to a byte-identical keystore.
• actionlint is clean on android.yml.
• No app code changes, so the screenshot job doesn't run.

Checklist

• Protocol changes ship test vectors; expected.txt regenerated, not hand-edited (n/a)
• No VINs, keys, or decrypted payloads in logs (the variable holds a throwaway debug key and was never a secret)
• Docs/master-plan updated where relevant (n/a)
• New source files carry SPDX-License-Identifier: AGPL-3.0-only (no new files)

🤖 Generated with Claude Code

https://claude.ai/code/session_0129RzhbEE2cboMcYyZMuxqX

---

Generated by Claude Code