kepr-build-apk.sh

1#!/bin/sh2# Build and publish the release APK for Kepr Builds.3#4# Kepr Beta builds use the established release certificate. Validate the produced5# APK's package, version, ABI, and signing identity before staging it.6set -eu78JAVA_HOME="/opt/homebrew/opt/openjdk@17/libexec/openjdk.jdk/Contents/Home"9if [ ! -d "$JAVA_HOME" ]; then10    echo "refusing to publish: required Java 17 runtime not found at $JAVA_HOME" >&211    exit 112fi13export JAVA_HOME1415ROOT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)16cd "$ROOT_DIR"1718# Keep the tool-selection and public metadata gates shared with the hermetic19# negative-path test; this script owns build orchestration only.20# shellcheck source=scripts/kepr-build-helpers.sh21. "$ROOT_DIR/scripts/kepr-build-helpers.sh"2223# Resolve the SDK from the environment first, then the non-secret sdk.dir in24# local.properties. Pick the newest *versioned* build-tools directory containing both25# tools; build-tools/latest is intentionally never trusted or consulted.26SDK_ROOT="${ANDROID_HOME:-${ANDROID_SDK_ROOT:-}}"27if [ -z "$SDK_ROOT" ]; then28    SDK_ROOT=$(sed -n 's/^sdk\.dir=//p' "$ROOT_DIR/local.properties" 2>/dev/null | sed -n '1p')29fi30if [ -z "$SDK_ROOT" ] || [ ! -d "$SDK_ROOT/build-tools" ]; then31    echo "refusing to publish: Android SDK build-tools directory not found" >&232    exit 133fi3435BUILD_TOOLS_DIR=$(find_stable_build_tools_dir "$SDK_ROOT" || true)36if [ -z "$BUILD_TOOLS_DIR" ]; then37    echo "refusing to publish: no versioned build-tools directory has aapt2" >&238    exit 139fi40AAPT2="$BUILD_TOOLS_DIR/aapt2"4142ROOT_VERSION=$(read_root_semver "$ROOT_DIR/VERSION" || true)43if [ -z "$ROOT_VERSION" ]; then44    echo "refusing to publish: VERSION is missing or not strict semantic version" >&245    exit 146fi4748"$ROOT_DIR/gradlew" --no-configuration-cache :app:assembleRelease4950case "${KEPR_TARGET:-}" in51    android-arm64)52        APK_NAME="app-arm64-v8a-release.apk"53        EXPECTED_ABI="arm64-v8a"54        ;;55    android-x86)56        APK_NAME="app-x86_64-release.apk"57        EXPECTED_ABI="x86_64"58        ;;59    *)60        echo "refusing to publish: unsupported KEPR_TARGET '${KEPR_TARGET:-unset}'" >&261        exit 162        ;;63esac6465APK="$ROOT_DIR/app/build/outputs/apk/release/$APK_NAME"66METADATA="$ROOT_DIR/app/build/outputs/apk/release/output-metadata.json"67if [ ! -f "$APK" ] || [ ! -r "$APK" ]; then68    echo "refusing to publish: release APK was not produced" >&269    exit 170fi71if [ ! -f "$METADATA" ] || [ ! -r "$METADATA" ]; then72    echo "refusing to publish: Gradle output metadata was not produced" >&273    exit 174fi7576BADGING_FILE=$(mktemp "${TMPDIR:-/tmp}/peach-apk-badging.XXXXXX")77cleanup_badging() {78    [ -e "$BADGING_FILE" ] && trash "$BADGING_FILE"79}80trap cleanup_badging EXIT HUP INT TERM81"$AAPT2" dump badging "$APK" > "$BADGING_FILE"82if ! validate_release_metadata \83    "$METADATA" \84    "$BADGING_FILE" \85    "$ROOT_VERSION" \86    "com.peachpasswords" \87    "$APK_NAME" \88    "$EXPECTED_ABI"; then89    exit 190fi9192# Only a fully verified artifact reaches the Kepr staging directory. The93# basename includes SemVer + ABI so Kepr's Content-Disposition carries both94# to the browser, matching the {version}/{platform} tokens in kepr.build.95mkdir -p "$ROOT_DIR/build/kepr"96STAGED_NAME="peach-android-${ROOT_VERSION}-${KEPR_TARGET}.apk"97cp "$APK" "$ROOT_DIR/build/kepr/$STAGED_NAME"98echo "release APK verified and staged: build/kepr/$STAGED_NAME"