build: verify release inputs

Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.

1 files changed, 15 insertions, 14 deletions

diff --git a/scripts/build-apk b/scripts/build-apk
index 9fd1409..476731b 100755
--- a/scripts/build-apk
+++ b/scripts/build-apk
@@ -7,10 +7,8 @@
 #   KEY_ALIAS       alias of the signing key inside the keystore
 #   KEY_PASS        password for that key (often the same as KEYSTORE_PASS)
 #
-# Optional:
-#   ANDROID_SDK_ROOT  if set, apksigner is located via this; otherwise
-#                     the script trusts gradle's output and skips the
-#                     post-build verification step.
+# Required tooling:
+#   Android build-tools 35.0.0 apksigner under ANDROID_SDK_ROOT or on PATH.
 #
 # Usage:
 #   scripts/build-apk
@@ -49,11 +47,8 @@ if [ ! -f "$KEYSTORE_PATH" ]; then
     exit 1
 fi
 
-if [ ! -f "$JAR" ]; then
-    echo "build-apk: $JAR is missing" >&2
-    echo "  run scripts/update-server first" >&2
-    exit 1
-fi
+"$ROOT/scripts/check-wrapper"
+"$ROOT/scripts/check-server"
 
 echo "build-apk: gradle :app:assembleRelease"
 cd "$ROOT"
@@ -66,18 +61,24 @@ fi
 
 SUM=$(sha256sum "$APK" | awk '{print $1}')
 
-# Best-effort: if apksigner is reachable, confirm the signature.
 APKSIGNER=""
 if [ -n "${ANDROID_SDK_ROOT:-}" ]; then
-    APKSIGNER=$(ls "$ANDROID_SDK_ROOT"/build-tools/*/apksigner 2>/dev/null | sort | tail -n 1 || true)
+    APKSIGNER="$ANDROID_SDK_ROOT/build-tools/35.0.0/apksigner"
+    if [ ! -x "$APKSIGNER" ]; then
+        APKSIGNER=""
+    fi
 fi
 if [ -z "$APKSIGNER" ] && command -v apksigner >/dev/null 2>&1; then
     APKSIGNER=$(command -v apksigner)
 fi
-if [ -n "$APKSIGNER" ]; then
-    echo "build-apk: apksigner verify"
-    "$APKSIGNER" verify --verbose "$APK" | sed 's/^/  /'
+if [ -z "$APKSIGNER" ]; then
+    echo "build-apk: apksigner 35.0.0 is required" >&2
+    echo "  set ANDROID_SDK_ROOT or put apksigner on PATH" >&2
+    exit 1
 fi
 
+echo "build-apk: apksigner verify"
+"$APKSIGNER" verify --verbose --print-certs "$APK" | sed 's/^/  /'
+
 echo "build-apk: $APK"
 echo "build-apk: sha256 $SUM"