build: pin and verify release inputs

1 files changed, 18 insertions, 4 deletions

diff --git a/scripts/update-server b/scripts/update-server
index df12e3a..337ef67 100755
--- a/scripts/update-server
+++ b/scripts/update-server
@@ -4,7 +4,7 @@
 #
 # Usage:
 #   scripts/update-server            # use DEFAULT_VERSION below
-#   scripts/update-server 4.0        # use explicit version
+#   scripts/update-server 4.1        # use explicit version
 #
 # Bumping to a new release:
 #   1. Run with the new version. The script will print the observed SHA-256
@@ -15,16 +15,22 @@
 
 set -eu
 
-DEFAULT_VERSION='4.0'
+DEFAULT_VERSION='4.1'
 VERSION="${1:-$DEFAULT_VERSION}"
 
-ROOT="$(git rev-parse --show-toplevel)"
+if ! printf '%s\n' "$VERSION" \
+        | awk '/^[0-9]+([.][0-9]+)*$/ { ok = 1 } END { exit !ok }'; then
+    echo "update-server: invalid version: $VERSION" >&2
+    exit 2
+fi
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 ASSETS="$ROOT/app/src/main/assets"
 URL="https://github.com/Genymobile/scrcpy/releases/download/v$VERSION/scrcpy-server-v$VERSION"
 
 # Known-good SHA-256 sums. Keep one line per blessed version.
 EXPECTED=$(cat <<EOF
-4.0 84924bd564a1eb6089c872c7521f968058977f91f5ff02514a8c74aff3210f3a
+4.1 deacb991ed2509715160ffdc7907e47b4160eb30d1566217e9047fd5b8850cae
 EOF
 )
 
@@ -35,6 +41,14 @@ if [ -z "$want" ]; then
     echo "    $VERSION <sha256-of-the-downloaded-binary>" >&2
 fi
 
+if [ -f "$ASSETS/scrcpy-server.jar" ] \
+        && [ "$(cat "$ASSETS/scrcpy-server.version" 2>/dev/null || true)" = "$VERSION" ] \
+        && [ "$(sha256sum "$ASSETS/scrcpy-server.jar" | awk '{print $1}')" = "$want" ]; then
+    printf '%s\n' "$want" >"$ASSETS/scrcpy-server.sha256"
+    echo "update-server: already installed $ASSETS/scrcpy-server.jar v$VERSION"
+    exit 0
+fi
+
 mkdir -p "$ASSETS"
 tmp=$(mktemp)
 trap 'rm -f "$tmp"' EXIT