From 0f88f2c1e5e108021ccddeee24f1216107115791 Mon Sep 17 00:00:00 2001 From: Lena Date: Wed, 1 Jul 2026 00:00:00 +0000 Subject: build: verify release inputs Pin and verify what goes into a release: JitPack confined to the SPAKE2 module via exclusiveContent, the vendored subtree pulled by commit SHA instead of a mutable tag, a pinned Docker base digest with a checksummed cmdline-tools download, and a verifyScrcpyServer task wired into every assets merge. The expected server checksum can be overridden with -PscrcpyServerSha256 when the jar is built from source. build-apk now requires apksigner and fails unless independent signature verification succeeds. Split the test image into unit and e2e targets so JVM-only test runs do not download an emulator. Ship THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add scripts/check as the host quality gate. --- scripts/fetch-vendor | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'scripts/fetch-vendor') diff --git a/scripts/fetch-vendor b/scripts/fetch-vendor index 4c73381..1e3ae59 100755 --- a/scripts/fetch-vendor +++ b/scripts/fetch-vendor @@ -35,10 +35,10 @@ fi if [ ! -d "$LIBADB_PREFIX" ]; then echo "fetch-vendor: adding $LIBADB_PREFIX @ $LIBADB_TAG ($LIBADB_SHA)" - git subtree add --prefix="$LIBADB_PREFIX" "$LIBADB_REPO" "$LIBADB_TAG" --squash + git subtree add --prefix="$LIBADB_PREFIX" "$LIBADB_REPO" "$LIBADB_SHA" --squash else echo "fetch-vendor: pulling $LIBADB_PREFIX @ $LIBADB_TAG ($LIBADB_SHA)" - git subtree pull --prefix="$LIBADB_PREFIX" "$LIBADB_REPO" "$LIBADB_TAG" --squash + git subtree pull --prefix="$LIBADB_PREFIX" "$LIBADB_REPO" "$LIBADB_SHA" --squash fi echo "fetch-vendor: ok" -- cgit v1.2.3