kepr-build-helpers.sh

1#!/bin/sh2# Sourceable, secret-free helpers for the Kepr release gate.3#4# This file intentionally contains no signing or Gradle commands. It only5# selects a stable SDK tool directory and validates public release metadata so6# the publication script and its hermetic negative-path tests share one7# implementation.89# Return success only for a stable build-tools directory basename such as10# "35.0.0". Preview/RC/beta/canary labels, "latest", leading-zero segments,11# and arbitrary names are rejected before any version sorting occurs.12is_stable_build_tools_basename() {13    build_tools_name=$114    old_ifs=$IFS15    IFS=.16    # shellcheck disable=SC208617    set -- $build_tools_name18    IFS=$old_ifs19    [ "$#" -eq 3 ] || return 120    for segment in "$@"; do21        case "$segment" in22            0|[1-9]|[1-9][0-9]*) ;;23            *) return 1 ;;24        esac25    done26}2728# Print the newest stable build-tools directory containing both tools. Only29# basenames that passed is_stable_build_tools_basename reach sort -V.30find_stable_build_tools_dir() {31    sdk_root=$132    build_tools_root=$sdk_root/build-tools33    [ -d "$build_tools_root" ] || return 13435    best_name=36    for candidate in "$build_tools_root"/*; do37        [ -d "$candidate" ] || continue38        candidate_name=${candidate##*/}39        is_stable_build_tools_basename "$candidate_name" || continue40        [ -x "$candidate/apksigner" ] || continue41        [ -x "$candidate/aapt2" ] || continue4243        if [ -z "$best_name" ] ||44            [ "$(printf '%s\n' "$best_name" "$candidate_name" | LC_ALL=C sort -V | tail -n 1)" = "$candidate_name" ]; then45            best_name=$candidate_name46        fi47    done4849    [ -n "$best_name" ] || return 150    printf '%s\n' "$build_tools_root/$best_name"51}5253# Read and validate the one-line semantic version authority. Keep this in the54# shared helper so publication tests exercise the exact same root-file gate.55read_root_semver() {56    version_file=$157    [ -r "$version_file" ] || return 158    root_version=$(sed -n '1p' "$version_file") || return 159    [ -n "$root_version" ] || return 160    is_strict_semver "$root_version" || return 161    # A second non-empty line would make VERSION ambiguous even if the first62    # line happened to be valid.63    extra_lines=$(sed -n '2,$p' "$version_file" | sed '/^[[:space:]]*$/d')64    [ -z "$extra_lines" ] || return 165    printf '%s\n' "$root_version"66}6768is_strict_semver() {69    semantic_version=$170    case "$semantic_version" in71        ''|*[!0-9.]* ) return 1 ;;72    esac73    old_ifs=$IFS74    IFS=.75    # shellcheck disable=SC208676    set -- $semantic_version77    IFS=$old_ifs78    [ "$#" -eq 3 ] || return 179    for segment in "$@"; do80        case "$segment" in81            0|[1-9]|[1-9][0-9]*) ;;82            *) return 1 ;;83        esac84    done85}8687# Validate Gradle output-metadata.json, the APK's aapt2 badging, and VERSION as88# one release identity. The Python standard library is used only for parsing89# generated JSON; duplicate keys and ambiguous element lists are rejected.90# Arguments: metadata-json badging-file root-version expected-app-id expected-output expected-abi91validate_release_metadata() {92    metadata_file=$193    badging_file=$294    root_version=$395    expected_app_id=$496    expected_output=$597    expected_abi=$69899    python3 - "$metadata_file" "$badging_file" "$root_version" "$expected_app_id" "$expected_output" "$expected_abi" <<'PY'100import json101import re102import sys103104metadata_path, badging_path, root_version, expected_app_id, expected_output, expected_abi = sys.argv[1:]105106def reject(message):107    raise SystemExit("release metadata rejected: " + message)108109def strict_semver(value):110    if not isinstance(value, str) or not re.fullmatch(r"(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)", value):111        reject("version is not strict SemVer")112    for segment in value.split("."):113        if int(segment) > 2147483647:114            reject("version segment is out of range")115116class NoDuplicateKeys(dict):117    def __init__(self, pairs):118        seen = set()119        for key, value in pairs:120            if key in seen:121                reject("duplicate JSON key: " + key)122            seen.add(key)123            self[key] = value124125try:126    with open(metadata_path, encoding="utf-8") as stream:127        metadata = json.load(stream, object_pairs_hook=NoDuplicateKeys)128except (OSError, json.JSONDecodeError) as error:129    reject("malformed Gradle metadata: " + str(error))130131if not isinstance(metadata, dict):132    reject("Gradle metadata root is not an object")133if metadata.get("applicationId") != expected_app_id:134    reject("Gradle applicationId does not match production package")135elements = metadata.get("elements")136if not isinstance(elements, list) or not all(isinstance(item, dict) for item in elements):137    reject("Gradle metadata elements are malformed")138matches = [item for item in elements if item.get("outputFile") == expected_output]139if len(matches) != 1:140    reject("Gradle metadata must contain exactly one matching APK element")141element = matches[0]142if element.get("versionName") != root_version:143    reject("Gradle versionName does not match VERSION")144expected_code = element.get("versionCode")145if isinstance(expected_code, bool) or not isinstance(expected_code, int) or expected_code < 1:146    reject("Gradle versionCode is missing or invalid")147strict_semver(root_version)148149try:150    with open(badging_path, encoding="utf-8") as stream:151        badging = stream.read()152except OSError as error:153    reject("APK badging could not be read: " + str(error))154155package_lines = [line for line in badging.splitlines() if line.startswith("package:")]156if len(package_lines) != 1:157    reject("APK badging must contain exactly one package line")158match = re.fullmatch(159    r"package: name='([^']+)' versionCode='([^']+)' versionName='([^']+)'(?: .*)?",160    package_lines[0],161)162if not match:163    reject("APK badging package line is malformed")164apk_app_id, apk_code, apk_version = match.groups()165if apk_app_id != expected_app_id:166    reject("APK applicationId does not match Gradle metadata")167if apk_code != str(expected_code):168    reject("APK versionCode does not match Gradle metadata")169if apk_version != root_version:170    reject("APK versionName does not match VERSION")171strict_semver(apk_version)172native_lines = [line for line in badging.splitlines() if line.startswith("native-code:")]173if native_lines != [f"native-code: '{expected_abi}'"]:174    reject("APK native ABI does not match requested platform")175PY176}