ci: pin toolchains and verify release artifacts

Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.

1 files changed, 38 insertions, 24 deletions

diff --git a/ci/setup-toolchain.sh b/ci/setup-toolchain.sh
index 7aeaa42..6ed09c6 100755
--- a/ci/setup-toolchain.sh
+++ b/ci/setup-toolchain.sh
@@ -11,35 +11,47 @@ root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 dir=${TOOLCHAIN_DIR:-$HOME/toolchains}
 sdk="$dir/android-sdk"
 mkdir -p "$dir/dl"
+jdk="$dir/jdk-$JDK_RELEASE"
+cmdline="$sdk/cmdline-tools/$ANDROID_CMDLINE_TOOLS"
+goroot="$dir/go-$GO_VERSION"
+
+download() {
+	url=$1
+	file=$2
+	want=$3
+	curl -fsSL "$url" -o "$file"
+	printf '%s  %s\n' "$want" "$file" | sha256sum -c -
+}
 
 # JDK (Temurin, exact pinned release; + must be %2B in the URL).
-if [ ! -x "$dir/jdk17/bin/java" ]; then
+if [ ! -x "$jdk/bin/java" ]; then
 	echo "setup: JDK $JDK_RELEASE"
 	rel=$(printf '%s' "$JDK_RELEASE" | sed 's/+/%2B/')
-	curl -fsSL "https://api.adoptium.net/v3/binary/version/jdk-${rel}/linux/x64/jdk/hotspot/normal/eclipse" -o "$dir/dl/jdk.tar.gz"
-	mkdir -p "$dir/jdk17"
-	tar xzf "$dir/dl/jdk.tar.gz" -C "$dir/jdk17" --strip-components=1
+	download "https://api.adoptium.net/v3/binary/version/jdk-${rel}/linux/x64/jdk/hotspot/normal/eclipse" \
+		"$dir/dl/jdk-$JDK_RELEASE.tar.gz" "$JDK_SHA256"
+	mkdir -p "$jdk"
+	tar xzf "$dir/dl/jdk-$JDK_RELEASE.tar.gz" -C "$jdk" --strip-components=1
 fi
-export JAVA_HOME="$dir/jdk17"
+export JAVA_HOME="$jdk"
 export PATH="$JAVA_HOME/bin:$PATH"
 
 # Android cmdline-tools.
-if [ ! -x "$sdk/cmdline-tools/latest/bin/sdkmanager" ]; then
+if [ ! -x "$cmdline/bin/sdkmanager" ]; then
 	echo "setup: cmdline-tools $ANDROID_CMDLINE_TOOLS"
-	curl -fsSL "https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_CMDLINE_TOOLS}_latest.zip" -o "$dir/dl/clt.zip"
-	rm -rf "$dir/dl/clt"
-	python3 -m zipfile -e "$dir/dl/clt.zip" "$dir/dl/clt"
+	download "https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_CMDLINE_TOOLS}_latest.zip" \
+		"$dir/dl/clt-$ANDROID_CMDLINE_TOOLS.zip" "$ANDROID_CMDLINE_TOOLS_SHA256"
+	rm -rf "$dir/dl/clt-$ANDROID_CMDLINE_TOOLS"
+	python3 -m zipfile -e "$dir/dl/clt-$ANDROID_CMDLINE_TOOLS.zip" "$dir/dl/clt-$ANDROID_CMDLINE_TOOLS"
 	mkdir -p "$sdk/cmdline-tools"
-	rm -rf "$sdk/cmdline-tools/latest"
-	mv "$dir/dl/clt/cmdline-tools" "$sdk/cmdline-tools/latest"
-	chmod +x "$sdk/cmdline-tools/latest/bin/"*
+	rm -rf "$cmdline"
+	mv "$dir/dl/clt-$ANDROID_CMDLINE_TOOLS/cmdline-tools" "$cmdline"
+	chmod +x "$cmdline/bin/"*
 fi
 
 # SDK packages.
 echo "setup: sdk packages"
-yes | "$sdk/cmdline-tools/latest/bin/sdkmanager" --licenses >/dev/null 2>&1 || true
-"$sdk/cmdline-tools/latest/bin/sdkmanager" \
-	"platform-tools" \
+yes | "$cmdline/bin/sdkmanager" --licenses >/dev/null
+"$cmdline/bin/sdkmanager" \
 	"platforms;android-${ANDROID_PLATFORM}" \
 	"build-tools;${ANDROID_BUILD_TOOLS}" \
 	"ndk;${ANDROID_NDK}" >/dev/null
@@ -47,28 +59,30 @@ yes | "$sdk/cmdline-tools/latest/bin/sdkmanager" --licenses >/dev/null 2>&1 || t
 # Gradle.
 if [ ! -x "$dir/gradle-${GRADLE_VERSION}/bin/gradle" ]; then
 	echo "setup: Gradle $GRADLE_VERSION"
-	curl -fsSL "https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip" -o "$dir/dl/gradle.zip"
-	python3 -m zipfile -e "$dir/dl/gradle.zip" "$dir"
+	download "https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip" \
+		"$dir/dl/gradle-$GRADLE_VERSION.zip" "$GRADLE_SHA256"
+	python3 -m zipfile -e "$dir/dl/gradle-$GRADLE_VERSION.zip" "$dir"
 	chmod +x "$dir/gradle-${GRADLE_VERSION}/bin/gradle"
 fi
 
 # Go (pinned; builds rsh).
-if [ ! -x "$dir/go/bin/go" ]; then
+if [ ! -x "$goroot/bin/go" ]; then
 	echo "setup: Go $GO_VERSION"
-	curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" -o "$dir/dl/go.tar.gz"
-	rm -rf "$dir/go"
-	tar xzf "$dir/dl/go.tar.gz" -C "$dir"
+	download "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" \
+		"$dir/dl/go-$GO_VERSION.tar.gz" "$GO_SHA256"
+	mkdir -p "$goroot"
+	tar xzf "$dir/dl/go-$GO_VERSION.tar.gz" -C "$goroot" --strip-components=1
 fi
 
 # Emit the env to source before building.
 cat > "$dir/env.sh" <<EOF
-export JAVA_HOME="$dir/jdk17"
-export GOROOT="$dir/go"
+export JAVA_HOME="$jdk"
+export GOROOT="$goroot"
 export ANDROID_HOME="$sdk"
 export ANDROID_SDK_ROOT="$sdk"
 export ANDROID_NDK_HOME="$sdk/ndk/${ANDROID_NDK}"
 export GRADLE_HOME="$dir/gradle-${GRADLE_VERSION}"
-export PATH="\$JAVA_HOME/bin:$dir/go/bin:\$GRADLE_HOME/bin:$sdk/cmdline-tools/latest/bin:$sdk/platform-tools:\$PATH"
+export PATH="\$JAVA_HOME/bin:\$GOROOT/bin:\$GRADLE_HOME/bin:$cmdline/bin:$sdk/build-tools/${ANDROID_BUILD_TOOLS}:\$PATH"
 EOF
 
 echo "setup: done; source $dir/env.sh"