Wire keystore signing config; trim publish.md

- Read keystore.properties at Gradle config time; wire signingConfig into
  the release build type (degrades gracefully when the file is absent)

.gitignore

@@ -25,6 +25,8 @@ local.properties
 
 /SchwertUndMagieOnPebbleWatchApp/build
 
+/dist
+
 # Release signing — never commit keystores or their credentials.
 # See docs/publish.md.
 *.jks

SchwertUndMagieOnPebbleCompanionApp/app/build.gradle.kts

@@ -4,6 +4,11 @@ plugins {
     alias(libs.plugins.android.application)
 }
 
+val keystoreProps = Properties().apply {
+    rootProject.file("keystore.properties").takeIf { it.exists() }
+        ?.reader()?.use { load(it) }
+}
+
 android {
     namespace = "de.ladkau.schwertundmagieonpebblecompanionapp"
     compileSdk {
@@ -35,8 +40,18 @@ android {
         }
     }
 
+    signingConfigs {
+        create("release") {
+            keystoreProps["storeFile"]?.let { storeFile = rootProject.file(it as String) }
+            storePassword = keystoreProps["storePassword"] as String?
+            keyAlias      = keystoreProps["keyAlias"]     as String?
+            keyPassword   = keystoreProps["keyPassword"]  as String?
+        }
+    }
+
     buildTypes {
         release {
+            signingConfig = signingConfigs.getByName("release")
             isMinifyEnabled = false
             proguardFiles(
                 getDefaultProguardFile("proguard-android-optimize.txt"),

docs/publish.md

@@ -4,53 +4,6 @@ Steps to generate signing credentials and publish both apps. See
 `docs/architecture.md` for what each app does and `CLAUDE.md` for build
 commands.
 
-## 0. Legal considerations — read before publishing either app
-
-**The companion app no longer bundles Commodore ROM files.** The
-`kernal`, `basic`, `chargen`, and `1541` ROMs are still under copyright
-(commercial rights are held by Cloanto, who license them as part of "C64
-Forever"), so shipping them pre-installed would be copyright infringement,
-independent of Google Play's own policy on emulators.
-
-The `extractViceRoms` Gradle task that used to copy these ROMs out of
-`res/vice-3.8.tar.gz` into `app/src/main/assets/` (and the auto-copy-on-first-
-launch logic in `MainActivity`) has been removed. Instead, on first launch
-`MainActivity.initEmulator()` checks `getExternalFilesDir(null)` for
-`kernal`/`basic`/`chargen`/`1541` and, if any are missing, shows a blocking
-dialog (`showRomImportDialog`) that lets the user pick their own ROM dump via
-the system file picker (the same Storage Access Framework flow already used
-for `.d64` disk imports). Picked files are matched to a canonical ROM name by
-filename substring (`romNameForFile`), so both VICE's versioned names (e.g.
-`kernal-901227-03.bin`) and plain renamed files work.
-
-`res/extract_roms.sh` still exists for pulling the ROMs out of the bundled
-tarball into `res/roms/` (gitignored) for local testing/sideloading — it is
-no longer wired into the Gradle build and nothing under it ships in the APK.
-
-The dialog also offers a **"Download ROMs"** button (`downloadRoms` /
-`extractRomsFromTarGz` in `MainActivity.kt`), which fetches VICE's own
-official source release —
-`https://github.com/VICE-Team/svn-mirror/releases/download/3.8.0/vice-3.8.tar.gz`
-(byte-identical to `res/vice-3.8.tar.gz`, verified by SHA-256) — and extracts
-the same four ROMs client-side. **This is a weaker legal position than the
-import flow, not a replacement for it:** the app is still facilitating
-acquisition of the ROMs over the network, rather than requiring the user to
-already possess a legally-obtained dump. It avoids *bundling* the ROMs in the
-APK (the Play Store policy trigger called out below), but if you want the
-strictest "bring your own ROM" posture for a public Play Store listing,
-consider removing this button before submission and keeping only the import
-path.
-
-The actual game disk images (`versions/*.d64`, the commercial "Schwert und
-Magie" releases) are **not** bundled either — `CLAUDE.md` describes copying
-them onto the device manually via USB/adb. Keep it that way; never add a
-"download the game" path to either app.
-
-The Rebble community store (watch app distribution) is far less strictly
-enforced, but the same legal exposure exists regardless of where the watch
-app is hosted, since the watch app only talks to the companion app — the ROM
-bundling was entirely a companion-app concern, now resolved.
-
 ## 1. .gitignore
 
 Keystore files and credential properties must never be committed. Already
@@ -222,8 +175,6 @@ release build.
 
 ## 4. Pre-publish checklist
 
-- [x] Resolved ROM bundling (§0) — companion app no longer ships/auto-installs
-      copyrighted Commodore ROMs; it prompts the user to import their own dump
 - [ ] Release keystore generated, passwords saved in a password manager, both
       gitignored (§1, §2.1)
 - [ ] `keystore.properties` exists locally and is **not** tracked by git