build: verify release inputs

Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.

1 files changed, 59 insertions, 0 deletions

diff --git a/app/src/main/assets/THIRD_PARTY_NOTICES b/app/src/main/assets/THIRD_PARTY_NOTICES
new file mode 100644
index 0000000..6dfcad2
--- /dev/null
+++ b/app/src/main/assets/THIRD_PARTY_NOTICES
@@ -0,0 +1,59 @@
+scrcpy-android third-party notices
+==================================
+
+This application includes the following open-source components. Complete
+corresponding source is available from the listed versioned source URLs.
+
+libadb-android 3.1.1
+--------------------
+Copyright 2021 Muntashir Al-Islam and contributors.
+Licensed under GPL-3.0-or-later OR Apache-2.0; this application uses the
+Apache-2.0 option. Portions retain BSD-3-Clause and MIT notices.
+Source: https://github.com/MuntashirAkon/libadb-android/tree/3.1.1
+
+SPAKE2-Java / spake2-android 2.2.1
+----------------------------------
+Copyright 2021 Muntashir Al-Islam and contributors.
+Licensed under LGPL-3.0-only. The Android artifact contains spake2-c and
+components under LGPL-3.0-or-later, LGPL-2.1-or-later, Apache-2.0, ISC, MIT,
+and public-domain terms.
+Source: https://github.com/MuntashirAkon/spake2-java/tree/2.2.1
+Native source: https://github.com/MuntashirAkon/spake2-c/tree/0d15933e5ba3e662cb01245a7ac0dc9fca3eac31
+License: https://www.gnu.org/licenses/lgpl-3.0.txt
+
+The application source and build scripts needed to replace this library with
+a modified compatible version and rebuild the application are available at:
+https://codeberg.org/0xlena/scrcpy-android
+
+Reverse engineering for debugging modifications to LGPL-covered components
+is permitted.
+
+Bouncy Castle Provider 1.84
+---------------------------
+Copyright 2000-2023 The Legion of the Bouncy Castle Inc.
+Licensed under the MIT license.
+Source: https://github.com/bcgit/bc-java/tree/r1rv84
+
+Conscrypt Android 2.5.2
+-----------------------
+Copyright 2016 The Android Open Source Project.
+Licensed under Apache-2.0. Contains modified portions of Netty and Apache
+Harmony under Apache-2.0.
+Source: https://github.com/google/conscrypt/tree/2.5.2
+Notice: https://github.com/google/conscrypt/blob/2.5.2/NOTICE
+
+AndroidX Annotation 1.9.1
+-------------------------
+Copyright The Android Open Source Project.
+Licensed under Apache-2.0.
+Source: https://android.googlesource.com/platform/frameworks/support/
+
+scrcpy server 4.0
+-----------------
+Copyright 2018 Genymobile and 2018-2026 Romain Vimont.
+Licensed under Apache-2.0.
+Source: https://github.com/Genymobile/scrcpy/tree/v4.0
+
+The Apache-2.0 terms used by this application and several components are in
+the top-level LICENSE file in the source distribution:
+https://codeberg.org/0xlena/scrcpy-android/src/branch/master/LICENSE