kepr-build-apk.sh

1#!/bin/sh2# Build the signed release APK for Kepr Builds.3#4# Signing comes from local.properties (koh-ignored); without it the release APK5# is unsigned and Android refuses to install it, so fail loudly here rather than6# publish something nobody can install. After the build we additionally verify7# the produced artifact (audit M-10): a configured keystore does not by itself8# prove the APK is signed, that its applicationId and versionCode match the9# release policy, or that the v2/v3 signing chain is intact.10set -eu1112JAVA_HOME="${JAVA_HOME:-/Applications/Android Studio.app/Contents/jbr/Contents/Home}"13export JAVA_HOME1415# Canonical values live in app/build.gradle (defaultConfig.applicationId,16# defaultConfig.versionCode). Update these constants only when that file17# changes — they are the post-build cross-check the audit calls for.18EXPECTED_APPLICATION_ID="com.peachpasswords"19EXPECTED_VERSION_CODE="240145"2021./gradlew --no-configuration-cache :app:assembleRelease2223APK=app/build/outputs/apk/release/app-release.apk24if [ ! -f "$APK" ]; then25    echo "refusing to publish: $APK not produced" >&226    exit 127fi2829APKSIGNER=""30if [ -n "${ANDROID_HOME:-}" ] && [ -x "${ANDROID_HOME}/build-tools/latest/apksigner" ]; then31    APKSIGNER="${ANDROID_HOME}/build-tools/latest/apksigner"32elif command -v apksigner >/dev/null 2>&1; then33    APKSIGNER=$(command -v apksigner)34else35    echo "refusing to publish: apksigner not found (set ANDROID_HOME or add to PATH)" >&236    exit 137fi3839if ! "$APKSIGNER" verify --print-certs "$APK"; then40    echo "refusing to publish: $APK failed apksigner verify (unsigned or v1-only)" >&241    exit 142fi4344AAPT2=""45if [ -n "${ANDROID_HOME:-}" ] && [ -x "${ANDROID_HOME}/build-tools/latest/aapt2" ]; then46    AAPT2="${ANDROID_HOME}/build-tools/latest/aapt2"47elif command -v aapt2 >/dev/null 2>&1; then48    AAPT2=$(command -v aapt2)49else50    echo "refusing to publish: aapt2 not found (set ANDROID_HOME or add to PATH)" >&251    exit 152fi5354BADGING=$("$AAPT2" dump badging "$APK")55ACTUAL_APPID=$(echo "$BADGING" | sed -n "s/^package: name='\([^']*\)'.*/\1/p")56ACTUAL_VCODE=$(echo "$BADGING" | sed -n "s/^package:.*versionCode='\([^']*\)'.*/\1/p")57if [ "$ACTUAL_APPID" != "$EXPECTED_APPLICATION_ID" ]; then58    echo "refusing to publish: applicationId '$ACTUAL_APPID' != expected '$EXPECTED_APPLICATION_ID'" >&259    exit 160fi61if [ "$ACTUAL_VCODE" != "$EXPECTED_VERSION_CODE" ]; then62    echo "refusing to publish: versionCode '$ACTUAL_VCODE' != expected '$EXPECTED_VERSION_CODE'" >&263    exit 164fi6566mkdir -p build/kepr67cp "$APK" build/kepr/peach-android.apk6869if ! grep -q '^peachStoreFile=' local.properties 2>/dev/null; then70    echo "refusing to publish: no signing key configured in local.properties" >&271    exit 172fi