fix: three deploy failures from run #1424

- deploy.yml: use python3 -m venv for the Play Store verification step so
  google-auth can be installed on Ubuntu 24.04 (PEP 668 blocks system-wide pip)
- setup_dagger_remote.sh: avoid adding a second trailing newline to values
  that already end with one (e.g. SSH private keys), which can corrupt PEM
  file parsing
- ci/main.go Deployer: mount SSH key at a raw path and strip CRLF line
  endings before use — "error in libcrypto" in Alpine's LibreSSL-backed
  openssh is caused by Windows-style CR bytes in the key file

Closes #366

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/deploy.yml

@@ -162,8 +162,9 @@ jobs:
 
       - name: Verify Play Store deployment
         run: |
-          pip install google-auth requests --quiet 2>&1 | grep -v "already satisfied" || true
-          python3 scripts/verify_playstore_deploy.py
+          python3 -m venv /tmp/playstore-venv
+          /tmp/playstore-venv/bin/pip install google-auth requests --quiet
+          /tmp/playstore-venv/bin/python3 scripts/verify_playstore_deploy.py
 
 
   deploy-apk:

ci/main.go

@@ -338,7 +338,12 @@ func (m *Ci) Deployer(sshKey *dagger.Secret, knownHosts *dagger.Secret) *dagger.
 	return dag.Container().
 		From("alpine:3.21").
 		WithExec([]string{"apk", "--no-cache", "add", "rsync", "openssh-client", "python3", "tar"}).
-		WithMountedSecret("/root/.ssh/id_ed25519", sshKey, dagger.ContainerWithMountedSecretOpts{Mode: 0600}).
+		// Mount at a raw path so we can normalise before use: strip any CRLF line
+		// endings that appear when the key is stored or exported on Windows, which
+		// cause "error in libcrypto" in Alpine's LibreSSL-backed openssh.
+		WithMountedSecret("/root/.ssh/id_ed25519.raw", sshKey, dagger.ContainerWithMountedSecretOpts{Mode: 0600}).
+		WithExec([]string{"sh", "-c",
+			"tr -d '\\r' < /root/.ssh/id_ed25519.raw > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519"}).
 		WithMountedSecret("/root/.ssh/known_hosts", knownHosts, dagger.ContainerWithMountedSecretOpts{Mode: 0644}).
 		WithEnvVariable("RSYNC_RSH", "ssh -i /root/.ssh/id_ed25519")
 }

scripts/setup_dagger_remote.sh

@@ -23,10 +23,13 @@ export_secret() {
     local value
     value=$(jq -r --arg k "$name" '.[$k] // empty' "$SECRETS_JSON")
     if [ -n "${GITHUB_ENV:-}" ]; then
-        # Use heredoc syntax for multiline-safe export
+        # Use heredoc syntax for multiline-safe export.
+        # Avoid adding a second trailing newline for values that already end with one
+        # (e.g. SSH private keys), which can corrupt PEM parsing.
         {
             printf '%s<<__EOF__\n' "$name"
-            printf '%s\n' "$value"
+            printf '%s' "$value"
+            [ "${value%$'\n'}" = "$value" ] && printf '\n'
             printf '__EOF__\n'
         } >> "$GITHUB_ENV"
     fi