From 2aa6920fb1568249d2466fa1b13760d1a51c0e8f Mon Sep 17 00:00:00 2001 From: Lena Date: Wed, 1 Jul 2026 00:00:00 +0000 Subject: ci: pin toolchains and verify release artifacts Checksum-pin every downloaded toolchain archive. Before publishing, verify the APK was built from HEAD, the tag matches versionName, apksigner passes, and the tree is clean; publish a sha256 sidecar and treat published assets as immutable. Compare full unsigned APKs in verify-repro and run the Android unit tests in CI. --- ci/setup-toolchain.sh | 62 +++++++++++++++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 24 deletions(-) (limited to 'ci/setup-toolchain.sh') diff --git a/ci/setup-toolchain.sh b/ci/setup-toolchain.sh index 7aeaa42..6ed09c6 100755 --- a/ci/setup-toolchain.sh +++ b/ci/setup-toolchain.sh @@ -11,35 +11,47 @@ root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd) dir=${TOOLCHAIN_DIR:-$HOME/toolchains} sdk="$dir/android-sdk" mkdir -p "$dir/dl" +jdk="$dir/jdk-$JDK_RELEASE" +cmdline="$sdk/cmdline-tools/$ANDROID_CMDLINE_TOOLS" +goroot="$dir/go-$GO_VERSION" + +download() { + url=$1 + file=$2 + want=$3 + curl -fsSL "$url" -o "$file" + printf '%s %s\n' "$want" "$file" | sha256sum -c - +} # JDK (Temurin, exact pinned release; + must be %2B in the URL). -if [ ! -x "$dir/jdk17/bin/java" ]; then +if [ ! -x "$jdk/bin/java" ]; then echo "setup: JDK $JDK_RELEASE" rel=$(printf '%s' "$JDK_RELEASE" | sed 's/+/%2B/') - curl -fsSL "https://api.adoptium.net/v3/binary/version/jdk-${rel}/linux/x64/jdk/hotspot/normal/eclipse" -o "$dir/dl/jdk.tar.gz" - mkdir -p "$dir/jdk17" - tar xzf "$dir/dl/jdk.tar.gz" -C "$dir/jdk17" --strip-components=1 + download "https://api.adoptium.net/v3/binary/version/jdk-${rel}/linux/x64/jdk/hotspot/normal/eclipse" \ + "$dir/dl/jdk-$JDK_RELEASE.tar.gz" "$JDK_SHA256" + mkdir -p "$jdk" + tar xzf "$dir/dl/jdk-$JDK_RELEASE.tar.gz" -C "$jdk" --strip-components=1 fi -export JAVA_HOME="$dir/jdk17" +export JAVA_HOME="$jdk" export PATH="$JAVA_HOME/bin:$PATH" # Android cmdline-tools. -if [ ! -x "$sdk/cmdline-tools/latest/bin/sdkmanager" ]; then +if [ ! -x "$cmdline/bin/sdkmanager" ]; then echo "setup: cmdline-tools $ANDROID_CMDLINE_TOOLS" - curl -fsSL "https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_CMDLINE_TOOLS}_latest.zip" -o "$dir/dl/clt.zip" - rm -rf "$dir/dl/clt" - python3 -m zipfile -e "$dir/dl/clt.zip" "$dir/dl/clt" + download "https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_CMDLINE_TOOLS}_latest.zip" \ + "$dir/dl/clt-$ANDROID_CMDLINE_TOOLS.zip" "$ANDROID_CMDLINE_TOOLS_SHA256" + rm -rf "$dir/dl/clt-$ANDROID_CMDLINE_TOOLS" + python3 -m zipfile -e "$dir/dl/clt-$ANDROID_CMDLINE_TOOLS.zip" "$dir/dl/clt-$ANDROID_CMDLINE_TOOLS" mkdir -p "$sdk/cmdline-tools" - rm -rf "$sdk/cmdline-tools/latest" - mv "$dir/dl/clt/cmdline-tools" "$sdk/cmdline-tools/latest" - chmod +x "$sdk/cmdline-tools/latest/bin/"* + rm -rf "$cmdline" + mv "$dir/dl/clt-$ANDROID_CMDLINE_TOOLS/cmdline-tools" "$cmdline" + chmod +x "$cmdline/bin/"* fi # SDK packages. echo "setup: sdk packages" -yes | "$sdk/cmdline-tools/latest/bin/sdkmanager" --licenses >/dev/null 2>&1 || true -"$sdk/cmdline-tools/latest/bin/sdkmanager" \ - "platform-tools" \ +yes | "$cmdline/bin/sdkmanager" --licenses >/dev/null +"$cmdline/bin/sdkmanager" \ "platforms;android-${ANDROID_PLATFORM}" \ "build-tools;${ANDROID_BUILD_TOOLS}" \ "ndk;${ANDROID_NDK}" >/dev/null @@ -47,28 +59,30 @@ yes | "$sdk/cmdline-tools/latest/bin/sdkmanager" --licenses >/dev/null 2>&1 || t # Gradle. if [ ! -x "$dir/gradle-${GRADLE_VERSION}/bin/gradle" ]; then echo "setup: Gradle $GRADLE_VERSION" - curl -fsSL "https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip" -o "$dir/dl/gradle.zip" - python3 -m zipfile -e "$dir/dl/gradle.zip" "$dir" + download "https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip" \ + "$dir/dl/gradle-$GRADLE_VERSION.zip" "$GRADLE_SHA256" + python3 -m zipfile -e "$dir/dl/gradle-$GRADLE_VERSION.zip" "$dir" chmod +x "$dir/gradle-${GRADLE_VERSION}/bin/gradle" fi # Go (pinned; builds rsh). -if [ ! -x "$dir/go/bin/go" ]; then +if [ ! -x "$goroot/bin/go" ]; then echo "setup: Go $GO_VERSION" - curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" -o "$dir/dl/go.tar.gz" - rm -rf "$dir/go" - tar xzf "$dir/dl/go.tar.gz" -C "$dir" + download "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" \ + "$dir/dl/go-$GO_VERSION.tar.gz" "$GO_SHA256" + mkdir -p "$goroot" + tar xzf "$dir/dl/go-$GO_VERSION.tar.gz" -C "$goroot" --strip-components=1 fi # Emit the env to source before building. cat > "$dir/env.sh" <