diff options
| author | Lena <lena@omega> | 2026-07-01 00:00:00 +0000 |
|---|---|---|
| committer | Lena <lena@omega> | 2026-07-01 00:00:00 +0000 |
| commit | 0f88f2c1e5e108021ccddeee24f1216107115791 (patch) | |
| tree | 1a045221b85c1d5a83e2fd040c4260834a62300b /scripts/fetch-vendor | |
| parent | ff7acf898b48359275a5b09b82ed926a945233f8 (diff) | |
| download | scrcpy-android-0f88f2c1e5e108021ccddeee24f1216107115791.tar.gz | |
build: verify release inputs
Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.
build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.
Diffstat (limited to 'scripts/fetch-vendor')
| -rwxr-xr-x | scripts/fetch-vendor | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/scripts/fetch-vendor b/scripts/fetch-vendor index 4c73381..1e3ae59 100755 --- a/scripts/fetch-vendor +++ b/scripts/fetch-vendor @@ -35,10 +35,10 @@ fi if [ ! -d "$LIBADB_PREFIX" ]; then echo "fetch-vendor: adding $LIBADB_PREFIX @ $LIBADB_TAG ($LIBADB_SHA)" - git subtree add --prefix="$LIBADB_PREFIX" "$LIBADB_REPO" "$LIBADB_TAG" --squash + git subtree add --prefix="$LIBADB_PREFIX" "$LIBADB_REPO" "$LIBADB_SHA" --squash else echo "fetch-vendor: pulling $LIBADB_PREFIX @ $LIBADB_TAG ($LIBADB_SHA)" - git subtree pull --prefix="$LIBADB_PREFIX" "$LIBADB_REPO" "$LIBADB_TAG" --squash + git subtree pull --prefix="$LIBADB_PREFIX" "$LIBADB_REPO" "$LIBADB_SHA" --squash fi echo "fetch-vendor: ok" |