From 0f88f2c1e5e108021ccddeee24f1216107115791 Mon Sep 17 00:00:00 2001
From: Lena <lena@omega>
Date: Wed, 1 Jul 2026 00:00:00 +0000
Subject: build: verify release inputs

Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.
---
 test-rig/sdk-packages-e2e.txt | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 test-rig/sdk-packages-e2e.txt

(limited to 'test-rig/sdk-packages-e2e.txt')

diff --git a/test-rig/sdk-packages-e2e.txt b/test-rig/sdk-packages-e2e.txt
new file mode 100644
index 0000000..4732f6e
--- /dev/null
+++ b/test-rig/sdk-packages-e2e.txt
@@ -0,0 +1,2 @@
+emulator
+system-images;android-35;default;x86_64
-- 
cgit v1.2.3