chore: use bash script to download signing key

.tools/download_key.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+set -eu
+
+dest=$1
+url=$2
+user=$3
+pass=$4
+
+if [ "$dest" == "" ]; then
+    echo "Please specify destination file"
+    exit 1
+fi
+
+if [ "$url" == "" ]; then
+    echo "Please specify signing key URL"
+    exit 1
+fi
+
+if [ "$user" == "" ]; then
+    echo "Please specify auth user"
+    exit 1
+fi
+
+if [ "$pass" == "" ]; then
+    echo "Please specify auth password"
+    exit 1
+fi
+
+if [ -f "$dest" ]; then
+    echo "Skipping signing key download as $dest already exists"
+    exit 0
+fi
+
+# Download silently to prevent URL/user/pass being exposed
+curl -s -u "$user:$pass" --output "$dest" $url 

app/build.gradle.kts

@@ -1,14 +1,11 @@
 @file:Suppress("UnstableApiUsage")
 
-import de.undercouch.gradle.tasks.download.DownloadAction
-
 plugins {
   id("com.android.application")
   id("kotlin-android")
   id("kotlin-kapt")
   id("kotlin-parcelize")
   id("com.google.android.gms.oss-licenses-plugin")
-  id("de.undercouch.download") version "5.3.0"
 }
 
 android {
@@ -167,19 +164,12 @@ fun downloadSigningKey() {
   val pass = getEnvOrProp(AUTH_PASS) ?: return
 
   logger.info("Downloading signing key...")
-  DownloadAction(project).apply {
-    src(url)
-    dest(signingKey)
-    username(user)
-    password(pass)
-    overwrite(false)
-    
-    // Must be set to true
-    quiet(true)
-  }.execute()
-    
-    // wait for the download to finish
-    .get()
+  val result = exec {
+    workingDir(rootProject.projectDir)
+    commandLine("bash", "./.tools/download_key.sh", signingKey.absolutePath, url, user, pass)
+  }
+
+  result.assertNormalExitValue()
 }
 
 fun getEnvOrProp(key: String): String? {