1 files changed, 46 insertions, 1 deletions

diff --git a/app/build.gradle b/app/build.gradle
index d0913be..476f3d8 100644
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -2,6 +2,8 @@ plugins {
     id 'com.android.application'
 }
 
+import java.security.MessageDigest
+
 android {
     namespace 'invalid.lena.scrcpy'
     compileSdk 35
@@ -95,6 +97,7 @@ android {
             'META-INF/androidx/**',
             'META-INF/kotlin-stdlib*',
             'org/bouncycastle/pqc/crypto/picnic/**',
+            'org/bouncycastle/pqc/legacy/picnic/**',
             'org/bouncycastle/x509/CertPathReviewerMessages*.properties',
             'kotlin/**',
         ]
@@ -105,6 +108,10 @@ android {
         // classpath; let them return defaults instead of throwing.
         unitTests.returnDefaultValues = true
     }
+
+    sourceSets {
+        main.assets.srcDir '../vendor/libadb-android/LICENSES'
+    }
 }
 
 dependencies {
@@ -113,7 +120,7 @@ dependencies {
     // need it on the compile classpath too for Adb.java's ASN.1
     // cert-builder. :adb keeps it 'implementation'-scoped upstream so
     // we declare it explicitly here rather than patch the vendor tree.
-    implementation 'org.bouncycastle:bcprov-jdk15to18:1.81'
+    implementation 'org.bouncycastle:bcprov-jdk15to18:1.84'
 
     // Bundled Conscrypt. libadb-android's TLS pairing exports keying
     // material via Conscrypt. Without a bundled copy it reflects into the
@@ -128,3 +135,41 @@ dependencies {
     testImplementation 'junit:junit:4.13.2'
     testImplementation 'org.json:json:20240303'
 }
+
+def serverJar = file('src/main/assets/scrcpy-server.jar')
+def serverSum = file('src/main/assets/scrcpy-server.sha256')
+def serverVersion = file('src/main/assets/scrcpy-server.version')
+def expectedServerSum = providers.gradleProperty('scrcpyServerSha256')
+        .orElse(providers.provider { serverSum.text.trim() })
+
+tasks.register('verifyScrcpyServer') {
+    inputs.files(serverJar, serverSum, serverVersion)
+    inputs.property('expectedChecksum', expectedServerSum)
+    doLast {
+        if (!serverJar.isFile() || !serverSum.isFile() || !serverVersion.isFile()) {
+            throw new GradleException('scrcpy server assets are incomplete; run scripts/update-server')
+        }
+        def expected = expectedServerSum.get()
+        def version = serverVersion.text.trim()
+        if (!(expected ==~ /[0-9a-f]{64}/) || version.isEmpty()) {
+            throw new GradleException('scrcpy server checksum or version is invalid')
+        }
+        def digest = MessageDigest.getInstance('SHA-256')
+        serverJar.withInputStream { input ->
+            byte[] buffer = new byte[64 * 1024]
+            for (int n; (n = input.read(buffer)) >= 0; ) {
+                if (n > 0) digest.update(buffer, 0, n)
+            }
+        }
+        def actual = digest.digest().encodeHex().toString()
+        if (actual != expected) {
+            throw new GradleException("scrcpy server checksum mismatch: expected ${expected}, got ${actual}")
+        }
+    }
+}
+
+tasks.configureEach { task ->
+    if (task.name.startsWith('merge') && task.name.endsWith('Assets')) {
+        task.dependsOn tasks.named('verifyScrcpyServer')
+    }
+}