108 lines
3.5 KiB
Bash
108 lines
3.5 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)
|
|
app_root="$repo_root/client/flutter_android"
|
|
artifacts_root="$repo_root/artifacts"
|
|
apk_source="$app_root/build/app/outputs/flutter-apk/app-release.apk"
|
|
keystore_path=
|
|
|
|
cleanup() {
|
|
if [ -n "$keystore_path" ] && [ -f "$keystore_path" ]; then
|
|
rm -f -- "$keystore_path"
|
|
fi
|
|
unset REMOTEDESK_ANDROID_KEYSTORE_PATH
|
|
unset REMOTEDESK_ANDROID_KEYSTORE_PASSWORD
|
|
unset REMOTEDESK_ANDROID_KEY_ALIAS
|
|
unset REMOTEDESK_ANDROID_KEY_PASSWORD
|
|
}
|
|
trap cleanup EXIT HUP INT TERM
|
|
|
|
has_signing=0
|
|
if [ -n "${ANDROID_KEYSTORE_BASE64:-}" ] ||
|
|
[ -n "${ANDROID_KEYSTORE_PASSWORD:-}" ] ||
|
|
[ -n "${ANDROID_KEY_ALIAS:-}" ] ||
|
|
[ -n "${ANDROID_KEY_PASSWORD:-}" ]; then
|
|
has_signing=1
|
|
fi
|
|
|
|
if [ "$has_signing" -eq 1 ] && {
|
|
[ -z "${ANDROID_KEYSTORE_BASE64:-}" ] ||
|
|
[ -z "${ANDROID_KEYSTORE_PASSWORD:-}" ] ||
|
|
[ -z "${ANDROID_KEY_ALIAS:-}" ] ||
|
|
[ -z "${ANDROID_KEY_PASSWORD:-}" ];
|
|
}; then
|
|
echo "Android release signing secrets are incomplete" >&2
|
|
exit 1
|
|
fi
|
|
|
|
require_signing=${REQUIRE_RELEASE_SIGNING:-0}
|
|
if [ "${DRONE_BUILD_EVENT:-}" = "tag" ]; then
|
|
require_signing=1
|
|
fi
|
|
if [ "$require_signing" -eq 1 ] && [ "$has_signing" -ne 1 ]; then
|
|
echo "A tag build requires all Android release signing secrets" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$has_signing" -eq 1 ]; then
|
|
keystore_path=$(mktemp "${TMPDIR:-/tmp}/remotedesk-android-keystore.XXXXXX")
|
|
chmod 600 "$keystore_path"
|
|
printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > "$keystore_path"
|
|
if [ ! -s "$keystore_path" ]; then
|
|
echo "Decoded Android keystore is empty" >&2
|
|
exit 1
|
|
fi
|
|
export REMOTEDESK_ANDROID_KEYSTORE_PATH="$keystore_path"
|
|
export REMOTEDESK_ANDROID_KEYSTORE_PASSWORD="$ANDROID_KEYSTORE_PASSWORD"
|
|
export REMOTEDESK_ANDROID_KEY_ALIAS="$ANDROID_KEY_ALIAS"
|
|
export REMOTEDESK_ANDROID_KEY_PASSWORD="$ANDROID_KEY_PASSWORD"
|
|
fi
|
|
|
|
cd "$app_root"
|
|
flutter build apk --release
|
|
if [ ! -s "$apk_source" ]; then
|
|
echo "Android release APK was not generated" >&2
|
|
exit 1
|
|
fi
|
|
|
|
android_sdk=${ANDROID_SDK_ROOT:-${ANDROID_HOME:-}}
|
|
if [ -z "$android_sdk" ] || [ ! -d "$android_sdk/build-tools" ]; then
|
|
echo "Android SDK build-tools are unavailable" >&2
|
|
exit 1
|
|
fi
|
|
apksigner=$(find "$android_sdk/build-tools" -type f -name apksigner -print | sort -V | tail -n 1)
|
|
if [ -z "$apksigner" ]; then
|
|
echo "apksigner is unavailable" >&2
|
|
exit 1
|
|
fi
|
|
signature_report=$($apksigner verify --verbose --print-certs "$apk_source")
|
|
printf '%s\n' "$signature_report"
|
|
if [ "$has_signing" -eq 1 ] && printf '%s\n' "$signature_report" | grep -Fq 'CN=Android Debug'; then
|
|
echo "Production signing was requested but the APK uses the Android debug certificate" >&2
|
|
exit 1
|
|
fi
|
|
|
|
version=$(sed -n 's/^version:[[:space:]]*//p' "$app_root/pubspec.yaml" | head -n 1 | tr -d '\r')
|
|
case "$version" in
|
|
*+*) ;;
|
|
*) echo "Android pubspec version must contain a build number" >&2; exit 1 ;;
|
|
esac
|
|
version_name=${version%+*}
|
|
version_code=${version#*+}
|
|
case "$version_name" in
|
|
''|*[!0-9A-Za-z._-]*) echo "Android version name is unsafe" >&2; exit 1 ;;
|
|
esac
|
|
case "$version_code" in
|
|
''|*[!0-9]*) echo "Android build number is invalid" >&2; exit 1 ;;
|
|
esac
|
|
|
|
mkdir -p "$artifacts_root"
|
|
apk_name="RemoteDesk-Android-${version_name}-build${version_code}.apk"
|
|
apk_output="$artifacts_root/$apk_name"
|
|
install -m 0644 "$apk_source" "$apk_output"
|
|
apk_hash=$(sha256sum "$apk_output" | cut -d ' ' -f 1)
|
|
printf '%s %s\n' "$apk_hash" "$apk_name" > "$apk_output.sha256"
|
|
printf 'Package: %s\n' "$apk_output"
|
|
printf 'SHA256: %s\n' "$apk_hash"
|