claudeandbit
3f14c01b00
Adds sign-apk.sh (align-check + apksigner), fdroid-update.sh (fdroid update over a binary repo, signing the index with its own separate key), publish.sh (S3-compatible upload) and the composite action tying them together, matching weblib-ci's shape. zipalign is not a standalone nixpkgs attribute; resolved by measurement rather than assumption that Gradle/AGP already aligns its output (Android's own docs, corroborated by fdroidserver never shelling out to zipalign) and added check_zip_alignment.py as the safety net, since apksigner itself does not check alignment at all. nixpkgs is pinned via a committed nixpkgs-pin revision, since this repo has no flake.lock of its own for with-nixpkgs.sh to read (fdroid-repo-ci#1, weblib-ci#9) -- a missing or malformed pin fails loudly rather than degrading to an unpinned nix shell. No consumer repo, bucket, hostname or channel name is hard-coded: which repo holds the keys and runs the publish has already changed once during this issue and may again, so every example uses a placeholder. 42 offline/local-only test assertions across five suites (run_tests.sh), including fault injection on the alignment check, the password/argument validation, and the with-nixpkgs.sh fail-loud paths. Co-authored-by: bit <bit@das-labor.org>
92 lines
4.2 KiB
Bash
Executable File
92 lines
4.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# End-to-end test of fdroid-update.sh: a throwaway index-signing keystore, a
|
|
# repo/ directory holding one already-signed fixture APK (from sign-apk.sh --
|
|
# binary-repo mode never builds or app-signs anything itself), a real
|
|
# `fdroid update` resolved through with-nixpkgs.sh/nixpkgs-pin.
|
|
#
|
|
# The fixture APK's AndroidManifest.xml is not real binary AXML -- building
|
|
# one needs aapt2, i.e. the Android SDK this repo deliberately avoids
|
|
# depending on. fdroidserver's own parser (androguard) rejects it and skips
|
|
# the app ("Failed to get APK information"), which is expected and asserted
|
|
# on below rather than hidden: what this test proves is the *indexing and
|
|
# index-signing* pipeline, which is what fdroid-update.sh exists for and
|
|
# what fdroid-repo-ci#1 asks to be verified -- "assert the index exists" --
|
|
# not that fdroidserver's manifest parser accepts a hand-built fixture.
|
|
set -euo pipefail
|
|
here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
source "$here/test_lib.sh"
|
|
|
|
work=$(mktemp -d)
|
|
trap 'rm -rf "$work"' EXIT
|
|
cd "$work"
|
|
mkdir -p repo
|
|
|
|
echo "generating throwaway index keystore..."
|
|
bash "$here/with-nixpkgs.sh" jdk21 keytool -genkeypair \
|
|
-keystore index.jks -storepass idxpass123 -keypass idxpass123 \
|
|
-alias indexkey -keyalg RSA -keysize 2048 -validity 1 \
|
|
-dname "CN=Index, OU=Test, O=Test, L=Test, S=Test, C=US" >/dev/null 2>&1
|
|
assert_file_exists "throwaway index keystore was created" index.jks
|
|
|
|
echo "signing a fixture APK with sign-apk.sh, to sit in repo/..."
|
|
bash "$here/with-nixpkgs.sh" jdk21 keytool -genkeypair \
|
|
-keystore app.jks -storepass apppass123 -keypass apppass123 \
|
|
-alias appkey -keyalg RSA -keysize 2048 -validity 1 \
|
|
-dname "CN=App, OU=Test, O=Test, L=Test, S=Test, C=US" >/dev/null 2>&1
|
|
bash "$here/with-nixpkgs.sh" python3 python3 - "$work" <<'PYEOF'
|
|
import struct, sys, zipfile
|
|
|
|
def add_stored(zf, name, data, align=4):
|
|
info = zipfile.ZipInfo(name)
|
|
info.compress_type = zipfile.ZIP_STORED
|
|
header_len = 30 + len(name.encode())
|
|
start = zf.fp.tell() + header_len
|
|
pad = (-start) % align
|
|
if pad:
|
|
if pad < 4:
|
|
pad += align
|
|
extra_len = pad - 4
|
|
info.extra = struct.pack("<HH", 0xD935, extra_len) + b"\x00" * extra_len
|
|
zf.writestr(info, data)
|
|
|
|
work = sys.argv[1]
|
|
with zipfile.ZipFile(f"{work}/unsigned.apk", "w") as zf:
|
|
add_stored(zf, "AndroidManifest.xml", b"0123456789")
|
|
PYEOF
|
|
export APP_KS_PASS=apppass123
|
|
bash "$here/sign-apk.sh" unsigned.apk repo/com.example.testapp_1.apk app.jks appkey APP_KS_PASS \
|
|
--min-sdk-version 21 --max-sdk-version 34 >/dev/null
|
|
assert_file_exists "fixture APK signed and placed in repo/" repo/com.example.testapp_1.apk
|
|
|
|
echo "--- fault: no repo/ directory is refused ---"
|
|
assert_failure "fdroid-update.sh refuses a root with no repo/" \
|
|
bash "$here/fdroid-update.sh" "$work/does-not-have-repo" index.jks indexkey IDX_KS_PASS
|
|
|
|
echo "--- fault: missing password env var is refused ---"
|
|
assert_failure "fdroid-update.sh refuses when the password env var is unset" \
|
|
env -u IDX_KS_PASS bash "$here/fdroid-update.sh" "$work" index.jks indexkey IDX_KS_PASS
|
|
|
|
echo "--- revert: a real run, needs no network ---"
|
|
export IDX_KS_PASS=idxpass123
|
|
assert_success "fdroid-update.sh runs fdroid update successfully" \
|
|
bash "$here/fdroid-update.sh" "$work" index.jks indexkey IDX_KS_PASS
|
|
|
|
assert_file_exists "index-v2.json exists and is non-empty" repo/index-v2.json
|
|
assert_file_exists "index-v1.jar (signed index) exists and is non-empty" repo/index-v1.jar
|
|
assert_file_exists "entry.jar (signed entry, apksigner v1) exists and is non-empty" repo/entry.jar
|
|
|
|
echo "--- index-v2.json is valid JSON, not just a non-empty file ---"
|
|
assert_success "index-v2.json parses as JSON" \
|
|
bash "$here/with-nixpkgs.sh" python3 python3 -c "import json; json.load(open('repo/index-v2.json'))"
|
|
|
|
echo "--- index-v1.jar is a validly signed jar (its own signature, not apksigner's) ---"
|
|
assert_success "jarsigner -verify accepts the signed index" \
|
|
bash "$here/with-nixpkgs.sh" jdk21 jarsigner -verify repo/index-v1.jar
|
|
|
|
echo "--- config.yml never holds a literal password ---"
|
|
assert_failure "config.yml has no literal password (uses {env: ...} instead)" \
|
|
grep -q "idxpass123" "$work/config.yml"
|
|
|
|
report_and_exit
|