diff options
Diffstat (limited to 'scripts/build-apk')
| -rwxr-xr-x | scripts/build-apk | 87 |
1 files changed, 71 insertions, 16 deletions
diff --git a/scripts/build-apk b/scripts/build-apk index 476731b..3040ee0 100755 --- a/scripts/build-apk +++ b/scripts/build-apk @@ -8,7 +8,7 @@ # KEY_PASS password for that key (often the same as KEYSTORE_PASS) # # Required tooling: -# Android build-tools 35.0.0 apksigner under ANDROID_SDK_ROOT or on PATH. +# Android build-tools 35.0.0 under ANDROID_SDK_ROOT or on PATH. # # Usage: # scripts/build-apk @@ -25,11 +25,10 @@ set -eu ROOT="$(cd "$(dirname "$0")/.." && pwd)" APK="$ROOT/app/build/outputs/apk/release/app-release.apk" -JAR="$ROOT/app/src/main/assets/scrcpy-server.jar" require() { name="$1" - eval "val=\${$name:-}" + val="$2" if [ -z "$val" ]; then echo "build-apk: \$$name is not set" >&2 echo " see the header of $0 for the required environment" >&2 @@ -37,10 +36,10 @@ require() { fi } -require KEYSTORE_PATH -require KEYSTORE_PASS -require KEY_ALIAS -require KEY_PASS +require KEYSTORE_PATH "${KEYSTORE_PATH:-}" +require KEYSTORE_PASS "${KEYSTORE_PASS:-}" +require KEY_ALIAS "${KEY_ALIAS:-}" +require KEY_PASS "${KEY_PASS:-}" if [ ! -f "$KEYSTORE_PATH" ]; then echo "build-apk: keystore not found at $KEYSTORE_PATH" >&2 @@ -62,23 +61,79 @@ fi SUM=$(sha256sum "$APK" | awk '{print $1}') APKSIGNER="" -if [ -n "${ANDROID_SDK_ROOT:-}" ]; then - APKSIGNER="$ANDROID_SDK_ROOT/build-tools/35.0.0/apksigner" - if [ ! -x "$APKSIGNER" ]; then - APKSIGNER="" - fi +AAPT2="" +ZIPALIGN="" +SDK_ROOT="${ANDROID_SDK_ROOT:-${ANDROID_HOME:-}}" +if [ -n "$SDK_ROOT" ]; then + APKSIGNER="$SDK_ROOT/build-tools/35.0.0/apksigner" + AAPT2="$SDK_ROOT/build-tools/35.0.0/aapt2" + ZIPALIGN="$SDK_ROOT/build-tools/35.0.0/zipalign" + [ -x "$APKSIGNER" ] || APKSIGNER="" + [ -x "$AAPT2" ] || AAPT2="" + [ -x "$ZIPALIGN" ] || ZIPALIGN="" fi if [ -z "$APKSIGNER" ] && command -v apksigner >/dev/null 2>&1; then APKSIGNER=$(command -v apksigner) fi -if [ -z "$APKSIGNER" ]; then - echo "build-apk: apksigner 35.0.0 is required" >&2 - echo " set ANDROID_SDK_ROOT or put apksigner on PATH" >&2 +if [ -z "$AAPT2" ] && command -v aapt2 >/dev/null 2>&1; then + AAPT2=$(command -v aapt2) +fi +if [ -z "$ZIPALIGN" ] && command -v zipalign >/dev/null 2>&1; then + ZIPALIGN=$(command -v zipalign) +fi +if [ -z "$APKSIGNER" ] || [ -z "$AAPT2" ] || [ -z "$ZIPALIGN" ]; then + echo "build-apk: build-tools 35.0.0 are required" >&2 + echo " set ANDROID_SDK_ROOT or put apksigner, aapt2, and zipalign on PATH" >&2 exit 1 fi +# Capture rather than pipe: POSIX sh has no pipefail, so +# `apksigner verify | sed` reports sed's status and a rejected APK would +# sail past set -e and be announced below as if it were signed. echo "build-apk: apksigner verify" -"$APKSIGNER" verify --verbose --print-certs "$APK" | sed 's/^/ /' +if ! verify_out=$("$APKSIGNER" verify --verbose --print-certs "$APK" 2>&1); then + printf '%s\n' "$verify_out" >&2 + echo "build-apk: apksigner rejected $APK" >&2 + exit 1 +fi +printf '%s\n' "$verify_out" | sed 's/^/ /' + +"$ZIPALIGN" -c -P 16 4 "$APK" + +expected_permissions=$(cat <<EOF +package: invalid.lena.scrcpy +uses-permission: name='android.permission.INTERNET' +uses-permission: name='android.permission.FOREGROUND_SERVICE' +uses-permission: name='android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK' +uses-permission: name='android.permission.POST_NOTIFICATIONS' +EOF +) +actual_permissions=$("$AAPT2" dump permissions "$APK") +if [ "$actual_permissions" != "$expected_permissions" ]; then + echo "build-apk: unexpected release permissions:" >&2 + printf '%s\n' "$actual_permissions" >&2 + exit 1 +fi + +expected_sdk=$(cat <<EOF +minSdkVersion:'31' +targetSdkVersion:'36' +EOF +) +actual_sdk=$("$AAPT2" dump badging "$APK" \ + | sed -n '/^minSdkVersion:/p; /^targetSdkVersion:/p') +if [ "$actual_sdk" != "$expected_sdk" ]; then + echo "build-apk: unexpected release SDK levels:" >&2 + printf '%s\n' "$actual_sdk" >&2 + exit 1 +fi + +expected_abis="native-code: 'arm64-v8a' 'x86_64'" +actual_abis=$("$AAPT2" dump badging "$APK" | sed -n '/^native-code:/p') +if [ "$actual_abis" != "$expected_abis" ]; then + echo "build-apk: unexpected release ABIs: $actual_abis" >&2 + exit 1 +fi echo "build-apk: $APK" echo "build-apk: sha256 $SUM" |