mirror of
https://github.com/simplex-chat/simplex-chat.git
synced 2026-10-24 04:03:41 +00:00
26 lines
1.2 KiB
Bash
Executable File
26 lines
1.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Downloads the released arm64 APK at the branch's latest release tag and checks that SimpleX signed it.
|
|
# Usage: scripts/ci/android/release-apk.sh <dir>
|
|
# The APK is then <dir>/simplex-aarch64.apk. Needs the build tools of the runner's SDK, before install-sdk.sh replaces it.
|
|
|
|
set -euo pipefail
|
|
|
|
# the release signing certificate, as scripts/simplex-chat-reproduce-builds-android.sh checks it
|
|
simplex_key=3C:52:C4:FD:3C:AD:1C:07:C9:B0:0A:70:80:E3:58:FA:B9:FE:FC:B8:AF:5A:EC:14:77:65:F1:6D:0F:21:AD:85
|
|
dir=$1
|
|
tag=$(git describe --tags --abbrev=0 --match 'v*' --exclude '*-armv7a' --exclude '*-fdroid')
|
|
apk=$dir/simplex-aarch64.apk
|
|
echo "release $tag"
|
|
|
|
mkdir -p "$dir"
|
|
curl -fsSL -o "$apk" "https://github.com/simplex-chat/simplex-chat/releases/download/$tag/simplex-aarch64.apk"
|
|
apksigner=$(find "$ANDROID_HOME/build-tools" -name apksigner | sort -V | tail -n 1)
|
|
signer=$("$apksigner" verify --print-certs "$apk" | sed -n 's/.*certificate SHA-256 digest: //p' | head -n 1 | fold -w2 | paste -sd: | tr '[:lower:]' '[:upper:]')
|
|
if [ "$signer" != "$simplex_key" ]; then
|
|
echo "error: $apk is signed by $signer, not SimpleX"
|
|
exit 1
|
|
fi
|
|
echo "signed by SimpleX: $signer"
|
|
ls -la "$apk"
|