fix(ci): locate keytool without relying on PATH, and reject WSL

Running the script from PowerShell failed with "keytool not found" even after
adding Android Studio's jbr/bin to $env:PATH.

Two causes. On Windows, `bash` invoked from PowerShell is frequently WSL's
bash rather than Git Bash, and the two disagree about everything: WSL sees the
system drive as /mnt/c, Git Bash as /c, and a Windows PATH entry that one
resolves the other does not.

The script now finds its own tools instead of trusting PATH — checking PATH,
then JAVA_HOME (normalising a C:\ style value into the shell's own form), then
the usual Android Studio and JDK locations, under each of the /c, /mnt/c and
/cygdrive/c prefixes. Verified by resolving both keytool and gh with PATH
stripped to /usr/bin:/bin.

WSL is now refused outright rather than half-supported: it can reach a Windows
keytool.exe through interop but then passes it Linux paths it cannot open, so
the keystore would land somewhere unexpected. The error prints the Git Bash
invocation to use instead.

KEYTOOL=... can still override the search if a key lives somewhere unusual.

Author: i99dev

scripts/setup-signing.sh

@@ -17,9 +17,74 @@ ALIAS="${ALIAS:-dash}"
 # Deliberately outside the repository so the key can never be committed.
 KEYSTORE="${KEYSTORE:-$HOME/ilink-release.jks}"
 
-command -v keytool >/dev/null || { echo "keytool not found — install a JDK or add Android Studio's jbr/bin to PATH" >&2; exit 1; }
-command -v gh >/dev/null      || { echo "gh not found — install the GitHub CLI" >&2; exit 1; }
-gh auth status >/dev/null 2>&1 || { echo "gh is not authenticated — run: gh auth login" >&2; exit 1; }
+# On Windows, `bash` launched from PowerShell is often WSL rather than Git
+# Bash. WSL can *find* a Windows keytool.exe through interop but then hands it
+# Linux paths (/home/... , /tmp/...) that it cannot open, so the keystore would
+# be written somewhere unexpected or not at all. Fail early with the fix rather
+# than half-working.
+if grep -qiE 'microsoft|wsl' /proc/version 2>/dev/null; then
+  cat >&2 <<'WSL'
+This is running under WSL, where Windows keytool cannot use Linux paths.
+
+Run it in Git Bash instead — from PowerShell:
+
+  & "C:\Program Files\Git\bin\bash.exe" scripts/setup-signing.sh
+
+(or open "Git Bash" from the Start menu, cd to the repo, and run
+ bash scripts/setup-signing.sh)
+WSL
+  exit 1
+fi
+
+# Resolve tools without depending on PATH. Windows shells disagree about it:
+# Git Bash sees C:\ as /c, WSL as /mnt/c, and a `bash` launched from
+# PowerShell may be either — so a PATH that works in one is empty in the other.
+find_tool() {
+  local name="$1"; shift
+  local found
+  if found=$(command -v "$name" 2>/dev/null); then printf '%s' "$found"; return 0; fi
+  local prefix
+  for prefix in "" /c /mnt/c /cygdrive/c; do
+    local candidate
+    for candidate in "$@"; do
+      if [ -x "${prefix}${candidate}" ]; then printf '%s' "${prefix}${candidate}"; return 0; fi
+      if [ -x "${prefix}${candidate}.exe" ]; then printf '%s' "${prefix}${candidate}.exe"; return 0; fi
+    done
+  done
+  return 1
+}
+
+# JAVA_HOME may be a Windows path (C:\...) that this shell cannot use directly,
+# so normalise it into the same /c or /mnt/c form as everything else.
+java_home_bin() {
+  [ -n "${JAVA_HOME:-}" ] || return 0
+  printf '%s' "$JAVA_HOME" \
+    | sed -e 's|\\|/|g' -e 's|^\([A-Za-z]\):|/\L\1|' \
+    | sed -e 's|$|/bin/keytool|'
+}
+
+KEYTOOL=$(find_tool keytool \
+  "$(java_home_bin)" \
+  "/Program Files/Android/Android Studio/jbr/bin/keytool" \
+  "/Program Files/Android/Android Studio1/jbr/bin/keytool" \
+  "/Program Files/Java/jdk-21/bin/keytool" \
+  "/Program Files/Java/jdk-17/bin/keytool" \
+  "/Program Files/Eclipse Adoptium/jdk-17/bin/keytool" \
+  || true)
+[ -n "$KEYTOOL" ] || {
+  echo "keytool not found." >&2
+  echo "Tried PATH, JAVA_HOME, and the usual Android Studio / JDK locations." >&2
+  echo "Set it explicitly, e.g.:" >&2
+  echo "  KEYTOOL='/c/Program Files/Android/Android Studio/jbr/bin/keytool' bash scripts/setup-signing.sh" >&2
+  exit 1
+}
+
+GH=$(find_tool gh "/Program Files/GitHub CLI/gh" "/Program Files (x86)/GitHub CLI/gh" || true)
+[ -n "$GH" ] || { echo "gh not found — install the GitHub CLI" >&2; exit 1; }
+"$GH" auth status >/dev/null 2>&1 || { echo "gh is not authenticated — run: gh auth login" >&2; exit 1; }
+
+echo "keytool    : $KEYTOOL"
+echo "gh         : $GH"
 
 echo "Repository : $REPO"
 echo "Keystore   : $KEYSTORE"
@@ -42,7 +107,7 @@ else
   # One password for both is normal for a release keystore and keeps Gradle simple.
   KEY_PW="$STORE_PW"
 
-  keytool -genkeypair -v \
+  "$KEYTOOL" -genkeypair -v \
     -keystore "$KEYSTORE" \
     -alias "$ALIAS" \
     -keyalg RSA -keysize 4096 -validity 10000 \
@@ -54,7 +119,7 @@ else
 fi
 export STORE_PW KEY_PW
 
-SIGNER=$(keytool -list -v -keystore "$KEYSTORE" -alias "$ALIAS" \
+SIGNER=$("$KEYTOOL" -list -v -keystore "$KEYSTORE" -alias "$ALIAS" \
   -storepass:env STORE_PW 2>/dev/null \
   | awk '/SHA256:/ {gsub(":", ""); print tolower($2); exit}')
 printf '%s' "$SIGNER" | grep -Eq '^[0-9a-f]{64}$' || {
@@ -68,14 +133,14 @@ trap 'rm -f "$B64"' EXIT
 
 echo
 echo "Uploading secrets to the '$REPO' prod environment..."
-gh secret set DASH_RELEASE_KEYSTORE_B64 --env prod --repo "$REPO" < "$B64"
-printf '%s' "$STORE_PW" | gh secret set DASH_KEYSTORE_PASSWORD   --env prod --repo "$REPO"
-printf '%s' "$KEY_PW"   | gh secret set DASH_KEY_PASSWORD        --env prod --repo "$REPO"
-printf '%s' "$ALIAS"    | gh secret set DASH_KEY_ALIAS           --env prod --repo "$REPO"
-printf '%s' "$SIGNER"   | gh secret set DASH_EXPECTED_SIGNER_SHA --env prod --repo "$REPO"
+"$GH" secret set DASH_RELEASE_KEYSTORE_B64 --env prod --repo "$REPO" < "$B64"
+printf '%s' "$STORE_PW" | "$GH" secret set DASH_KEYSTORE_PASSWORD   --env prod --repo "$REPO"
+printf '%s' "$KEY_PW" | "$GH" secret set DASH_KEY_PASSWORD        --env prod --repo "$REPO"
+printf '%s' "$ALIAS" | "$GH" secret set DASH_KEY_ALIAS           --env prod --repo "$REPO"
+printf '%s' "$SIGNER" | "$GH" secret set DASH_EXPECTED_SIGNER_SHA --env prod --repo "$REPO"
 
 echo
 echo "Done. Secrets now set (names only):"
-gh secret list --env prod --repo "$REPO"
+"$GH" secret list --env prod --repo "$REPO"
 echo
 echo "Back up $KEYSTORE somewhere encrypted and off this machine before releasing."