From 0f88f2c1e5e108021ccddeee24f1216107115791 Mon Sep 17 00:00:00 2001
From: Lena <lena@omega>
Date: Wed, 1 Jul 2026 00:00:00 +0000
Subject: build: verify release inputs

Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.
---
 settings.gradle | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

(limited to 'settings.gradle')

diff --git a/settings.gradle b/settings.gradle
index 78b1a9c..060839b 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -11,9 +11,16 @@ dependencyResolutionManagement {
     repositories {
         google()
         mavenCentral()
-        // JitPack is required for spake2-android, pulled in by :adb (libadb-android).
-        // Kept at settings level so the :adb module stays untouched upstream.
-        maven { url 'https://jitpack.io' }
+        // JitPack is used only for libadb's SPAKE2 pairing bridge. Do not
+        // allow it to shadow artifacts available from the primary repos.
+        exclusiveContent {
+            forRepository {
+                maven { url 'https://jitpack.io' }
+            }
+            filter {
+                includeModule 'com.github.MuntashirAkon.spake2-java', 'spake2-android'
+            }
+        }
     }
 }
 
-- 
cgit v1.2.3