From 0f88f2c1e5e108021ccddeee24f1216107115791 Mon Sep 17 00:00:00 2001 From: Lena Date: Wed, 1 Jul 2026 00:00:00 +0000 Subject: build: verify release inputs Pin and verify what goes into a release: JitPack confined to the SPAKE2 module via exclusiveContent, the vendored subtree pulled by commit SHA instead of a mutable tag, a pinned Docker base digest with a checksummed cmdline-tools download, and a verifyScrcpyServer task wired into every assets merge. The expected server checksum can be overridden with -PscrcpyServerSha256 when the jar is built from source. build-apk now requires apksigner and fails unless independent signature verification succeeds. Split the test image into unit and e2e targets so JVM-only test runs do not download an emulator. Ship THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add scripts/check as the host quality gate. --- vendor/libadb-android/libadb/build.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'vendor/libadb-android/libadb') diff --git a/vendor/libadb-android/libadb/build.gradle b/vendor/libadb-android/libadb/build.gradle index c5bee94..33a9b9f 100644 --- a/vendor/libadb-android/libadb/build.gradle +++ b/vendor/libadb-android/libadb/build.gradle @@ -52,7 +52,7 @@ publishing { dependencies { implementation "androidx.annotation:annotation:1.9.1" - implementation 'org.bouncycastle:bcprov-jdk15to18:1.81' + implementation 'org.bouncycastle:bcprov-jdk15to18:1.84' implementation 'com.github.MuntashirAkon.spake2-java:spake2-android:2.2.1' testImplementation 'junit:junit:4.13.2' -- cgit v1.2.3