build: pin and verify release inputs

4 files changed, 25 insertions, 14 deletions

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 91e3725..7e8e599 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -1,11 +1,28 @@
 <?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
 
     <uses-permission android:name="android.permission.INTERNET"/>
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK"/>
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
 
+    <!-- spake2-android has no targetSdk in its manifest. The merger adds
+         obsolete implicit permissions after evaluating these removals, so
+         it misleadingly warns that no declaration is present. The rules are
+         required: scripts/build-apk fails if any permission gets through. -->
+    <uses-permission
+        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
+        tools:ignore="ScopedStorage"
+        tools:node="remove"/>
+    <uses-permission
+        android:name="android.permission.READ_EXTERNAL_STORAGE"
+        tools:ignore="ScopedStorage"
+        tools:node="remove"/>
+    <uses-permission
+        android:name="android.permission.READ_PHONE_STATE"
+        tools:node="remove"/>
+
     <application
         android:name=".App"
         android:label="@string/app_name"
diff --git a/app/src/main/assets/THIRD_PARTY_NOTICES b/app/src/main/assets/THIRD_PARTY_NOTICES
index 36cc025..03a0bd1 100644
--- a/app/src/main/assets/THIRD_PARTY_NOTICES
+++ b/app/src/main/assets/THIRD_PARTY_NOTICES
@@ -34,25 +34,19 @@ Copyright 2000-2023 The Legion of the Bouncy Castle Inc.
 Licensed under the MIT license.
 Source: https://github.com/bcgit/bc-java/tree/r1rv84
 
-Conscrypt Android 2.5.2
+Conscrypt Android 2.6.1
 -----------------------
 Copyright 2016 The Android Open Source Project.
 Licensed under Apache-2.0. Contains modified portions of Netty and Apache
 Harmony under Apache-2.0.
-Source: https://github.com/google/conscrypt/tree/2.5.2
-Notice: https://github.com/google/conscrypt/blob/2.5.2/NOTICE
+Source: https://github.com/google/conscrypt/tree/2.6.1
+Notice: https://github.com/google/conscrypt/blob/2.6.1/NOTICE
 
-AndroidX Annotation 1.9.1
--------------------------
-Copyright The Android Open Source Project.
-Licensed under Apache-2.0.
-Source: https://android.googlesource.com/platform/frameworks/support/
-
-scrcpy server 4.0
+scrcpy server 4.1
 -----------------
 Copyright 2018 Genymobile and 2018-2026 Romain Vimont.
 Licensed under Apache-2.0.
-Source: https://github.com/Genymobile/scrcpy/tree/v4.0
+Source: https://github.com/Genymobile/scrcpy/tree/v4.1
 
 The Apache-2.0 terms used by this application and several components are in
 the top-level LICENSE file in the source distribution:
diff --git a/app/src/main/assets/scrcpy-server.sha256 b/app/src/main/assets/scrcpy-server.sha256
index 376a42f..58a04f6 100644
--- a/app/src/main/assets/scrcpy-server.sha256
+++ b/app/src/main/assets/scrcpy-server.sha256
@@ -1 +1 @@
-84924bd564a1eb6089c872c7521f968058977f91f5ff02514a8c74aff3210f3a
+deacb991ed2509715160ffdc7907e47b4160eb30d1566217e9047fd5b8850cae
diff --git a/app/src/main/assets/scrcpy-server.version b/app/src/main/assets/scrcpy-server.version
index 5186d07..7d5c902 100644
--- a/app/src/main/assets/scrcpy-server.version
+++ b/app/src/main/assets/scrcpy-server.version
@@ -1 +1 @@
-4.0
+4.1