From 0f88f2c1e5e108021ccddeee24f1216107115791 Mon Sep 17 00:00:00 2001 From: Lena Date: Wed, 1 Jul 2026 00:00:00 +0000 Subject: build: verify release inputs Pin and verify what goes into a release: JitPack confined to the SPAKE2 module via exclusiveContent, the vendored subtree pulled by commit SHA instead of a mutable tag, a pinned Docker base digest with a checksummed cmdline-tools download, and a verifyScrcpyServer task wired into every assets merge. The expected server checksum can be overridden with -PscrcpyServerSha256 when the jar is built from source. build-apk now requires apksigner and fails unless independent signature verification succeeds. Split the test image into unit and e2e targets so JVM-only test runs do not download an emulator. Ship THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add scripts/check as the host quality gate. --- app/src/main/assets/THIRD_PARTY_NOTICES | 59 +++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 app/src/main/assets/THIRD_PARTY_NOTICES (limited to 'app/src/main') diff --git a/app/src/main/assets/THIRD_PARTY_NOTICES b/app/src/main/assets/THIRD_PARTY_NOTICES new file mode 100644 index 0000000..6dfcad2 --- /dev/null +++ b/app/src/main/assets/THIRD_PARTY_NOTICES @@ -0,0 +1,59 @@ +scrcpy-android third-party notices +================================== + +This application includes the following open-source components. Complete +corresponding source is available from the listed versioned source URLs. + +libadb-android 3.1.1 +-------------------- +Copyright 2021 Muntashir Al-Islam and contributors. +Licensed under GPL-3.0-or-later OR Apache-2.0; this application uses the +Apache-2.0 option. Portions retain BSD-3-Clause and MIT notices. +Source: https://github.com/MuntashirAkon/libadb-android/tree/3.1.1 + +SPAKE2-Java / spake2-android 2.2.1 +---------------------------------- +Copyright 2021 Muntashir Al-Islam and contributors. +Licensed under LGPL-3.0-only. The Android artifact contains spake2-c and +components under LGPL-3.0-or-later, LGPL-2.1-or-later, Apache-2.0, ISC, MIT, +and public-domain terms. +Source: https://github.com/MuntashirAkon/spake2-java/tree/2.2.1 +Native source: https://github.com/MuntashirAkon/spake2-c/tree/0d15933e5ba3e662cb01245a7ac0dc9fca3eac31 +License: https://www.gnu.org/licenses/lgpl-3.0.txt + +The application source and build scripts needed to replace this library with +a modified compatible version and rebuild the application are available at: +https://codeberg.org/0xlena/scrcpy-android + +Reverse engineering for debugging modifications to LGPL-covered components +is permitted. + +Bouncy Castle Provider 1.84 +--------------------------- +Copyright 2000-2023 The Legion of the Bouncy Castle Inc. +Licensed under the MIT license. +Source: https://github.com/bcgit/bc-java/tree/r1rv84 + +Conscrypt Android 2.5.2 +----------------------- +Copyright 2016 The Android Open Source Project. +Licensed under Apache-2.0. Contains modified portions of Netty and Apache +Harmony under Apache-2.0. +Source: https://github.com/google/conscrypt/tree/2.5.2 +Notice: https://github.com/google/conscrypt/blob/2.5.2/NOTICE + +AndroidX Annotation 1.9.1 +------------------------- +Copyright The Android Open Source Project. +Licensed under Apache-2.0. +Source: https://android.googlesource.com/platform/frameworks/support/ + +scrcpy server 4.0 +----------------- +Copyright 2018 Genymobile and 2018-2026 Romain Vimont. +Licensed under Apache-2.0. +Source: https://github.com/Genymobile/scrcpy/tree/v4.0 + +The Apache-2.0 terms used by this application and several components are in +the top-level LICENSE file in the source distribution: +https://codeberg.org/0xlena/scrcpy-android/src/branch/master/LICENSE -- cgit v1.2.3