build: pin and verify release inputs

1 files changed, 34 insertions, 0 deletions

diff --git a/scripts/build-server b/scripts/build-server
new file mode 100755
index 0000000..ddd814f
--- /dev/null
+++ b/scripts/build-server
@@ -0,0 +1,34 @@
+#!/bin/sh
+# Build the pinned scrcpy server source.
+
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+SCRCPY="$ROOT/vendor/scrcpy"
+VERSION_FILE="$ROOT/app/src/main/assets/scrcpy-server.version"
+BUILD_FILE="$SCRCPY/server/build.gradle"
+OUTPUT="$SCRCPY/server/build/outputs/apk/release/server-release-unsigned.apk"
+
+if [ ! -s "$BUILD_FILE" ]; then
+    echo "build-server: vendor/scrcpy is not initialized" >&2
+    exit 1
+fi
+if [ ! -s "$VERSION_FILE" ]; then
+    echo "build-server: missing $VERSION_FILE" >&2
+    exit 1
+fi
+
+expected=$(cat "$VERSION_FILE")
+declared=$(sed -n 's/.*versionName[ =]*"\([^"]*\)".*/\1/p' "$BUILD_FILE")
+if [ -z "$declared" ] || [ "$declared" != "$expected" ]; then
+    echo "build-server: source version '$declared', asset version '$expected'" >&2
+    exit 1
+fi
+
+echo "build-server: scrcpy $expected" >&2
+"$SCRCPY/gradlew" -p "$SCRCPY" --no-daemon :server:assembleRelease >&2
+if [ ! -s "$OUTPUT" ]; then
+    echo "build-server: Gradle did not produce $OUTPUT" >&2
+    exit 1
+fi
+printf '%s\n' "$OUTPUT"