build: verify release inputs

Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.

3 files changed, 22 insertions, 9 deletions

diff --git a/test-rig/Dockerfile b/test-rig/Dockerfile
index a9ffa23..c43abb5 100644
--- a/test-rig/Dockerfile
+++ b/test-rig/Dockerfile
@@ -1,24 +1,22 @@
 # scrcpy-android test image.
 #
-# Bundles JDK 17, Android cmdline-tools, platform 35, build-tools 34+35,
-# emulator, and an x86_64 default API-35 system image (for e2e).
+# The unit target bundles JDK 17, Android cmdline-tools, platform 35, and
+# build-tools 34+35. The e2e target adds the emulator, system image, and
+# runtime libraries. JVM-only tests therefore do not download an emulator.
 # build-tools 34 is AGP 8.7's internal pin; pre-installing it keeps
 # gradle from downloading it into the SDK at test time.
 # Project is mounted at /work; runs in --rm mode.
 
-FROM debian:bookworm-slim
+FROM debian:bookworm-slim@sha256:60eac759739651111db372c07be67863818726f754804b8707c90979bda511df AS unit
 
 ARG SDK_VER=11076708
+ARG SDK_SHA256=2d2d50857e4eb553af5a6dc3ad507a17adf43d115264b1afc116f95c92e5e258
 ARG DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
         openjdk-17-jdk-headless \
         curl unzip ca-certificates \
-        libpulse0 libxkbcommon0 libgl1 libnss3 libasound2 libdbus-1-3 \
-        qemu-system-x86 qemu-utils \
-        procps \
-        ffmpeg \
  && rm -rf /var/lib/apt/lists/*
 
 ENV ANDROID_SDK_ROOT=/opt/android-sdk
@@ -27,6 +25,7 @@ ENV ANDROID_HOME=$ANDROID_SDK_ROOT
 RUN mkdir -p $ANDROID_SDK_ROOT/cmdline-tools \
  && curl -fsSL "https://dl.google.com/android/repository/commandlinetools-linux-${SDK_VER}_latest.zip" \
         -o /tmp/clt.zip \
+ && printf '%s  %s\n' "$SDK_SHA256" /tmp/clt.zip | sha256sum -c - \
  && unzip -q /tmp/clt.zip -d $ANDROID_SDK_ROOT/cmdline-tools \
  && mv $ANDROID_SDK_ROOT/cmdline-tools/cmdline-tools $ANDROID_SDK_ROOT/cmdline-tools/latest \
  && rm /tmp/clt.zip
@@ -43,3 +42,17 @@ ENV GRADLE_USER_HOME=/work/.tools/gradle-home
 ENV ANDROID_AVD_HOME=/work/.tools/avd
 
 WORKDIR /work
+
+FROM unit AS e2e
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+        libpulse0 libxkbcommon0 libgl1 libnss3 libasound2 libdbus-1-3 \
+        qemu-system-x86 qemu-utils procps ffmpeg \
+ && rm -rf /var/lib/apt/lists/*
+
+COPY sdk-packages-e2e.txt /tmp/sdk-packages-e2e.txt
+RUN sdkmanager $(tr '\n' ' ' < /tmp/sdk-packages-e2e.txt) >/dev/null \
+ && chmod -R a+rwX "$ANDROID_SDK_ROOT"
diff --git a/test-rig/sdk-packages-e2e.txt b/test-rig/sdk-packages-e2e.txt
new file mode 100644
index 0000000..4732f6e
--- /dev/null
+++ b/test-rig/sdk-packages-e2e.txt
@@ -0,0 +1,2 @@
+emulator
+system-images;android-35;default;x86_64
diff --git a/test-rig/sdk-packages.txt b/test-rig/sdk-packages.txt
index 8a7f0ff..48d2636 100644
--- a/test-rig/sdk-packages.txt
+++ b/test-rig/sdk-packages.txt
@@ -2,5 +2,3 @@ platform-tools
 platforms;android-35
 build-tools;34.0.0
 build-tools;35.0.0
-emulator
-system-images;android-35;default;x86_64