61 lines
2.1 KiB
Bash
Executable file
61 lines
2.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
APK_PATH="${1:-build/apk/vpn-app-arm64.apk}"
|
|
EXPECTED_VERSION_CODE="${2:-2}"
|
|
EXPECTED_VERSION_NAME="${3:-0.1.1}"
|
|
EXPECTED_CERT_SHA256="${VPN_ANDROID_CERT_SHA256:-21d36442ec814833725cee45306daec63960fc988cd1c8705665ecf7d3b7f63d}"
|
|
ANDROID_SDK_PATH="${ANDROID_SDK_ROOT:-${ANDROID_HOME:-/home/snw/Android/sdk}}"
|
|
|
|
if [[ ! -f "$APK_PATH" ]]; then
|
|
echo "APK not found: $APK_PATH" >&2
|
|
exit 2
|
|
fi
|
|
|
|
BUILD_TOOLS_DIR="$(find "$ANDROID_SDK_PATH/build-tools" -mindepth 1 -maxdepth 1 -type d -print | sort -V | tail -n 1)"
|
|
AAPT="$BUILD_TOOLS_DIR/aapt"
|
|
APKSIGNER="$BUILD_TOOLS_DIR/apksigner"
|
|
ZIPALIGN="$BUILD_TOOLS_DIR/zipalign"
|
|
|
|
for tool in "$AAPT" "$APKSIGNER" "$ZIPALIGN"; do
|
|
if [[ ! -x "$tool" ]]; then
|
|
echo "Required Android build tool not found: $tool" >&2
|
|
exit 2
|
|
fi
|
|
done
|
|
|
|
unzip -tqq "$APK_PATH"
|
|
|
|
BADGING="$($AAPT dump badging "$APK_PATH")"
|
|
EXPECTED_PACKAGE="package: name='su.snw.vpn_app' versionCode='$EXPECTED_VERSION_CODE' versionName='$EXPECTED_VERSION_NAME'"
|
|
if [[ "$BADGING" != *"$EXPECTED_PACKAGE"* ]]; then
|
|
echo "Unexpected package or version metadata" >&2
|
|
echo "Expected: $EXPECTED_PACKAGE" >&2
|
|
echo "$BADGING" | head -n 1 >&2
|
|
exit 3
|
|
fi
|
|
|
|
NATIVE_CODE="$(printf '%s\n' "$BADGING" | sed -n "s/^native-code: //p")"
|
|
if [[ "$NATIVE_CODE" != "'arm64-v8a'" ]]; then
|
|
echo "Unexpected native ABI set: ${NATIVE_CODE:-none}" >&2
|
|
exit 3
|
|
fi
|
|
|
|
SIGNATURE_REPORT="$($APKSIGNER verify --verbose --print-certs "$APK_PATH")"
|
|
CERT_SHA256="$(printf '%s\n' "$SIGNATURE_REPORT" | sed -n 's/^Signer #1 certificate SHA-256 digest: //p' | tr -d ':[:space:]' | tr '[:upper:]' '[:lower:]')"
|
|
if [[ "$CERT_SHA256" != "$EXPECTED_CERT_SHA256" ]]; then
|
|
echo "Unexpected signing certificate SHA-256: $CERT_SHA256" >&2
|
|
exit 3
|
|
fi
|
|
|
|
$ZIPALIGN -c -P 16 -v 4 "$APK_PATH" >/dev/null
|
|
|
|
APK_SIZE="$(stat -c '%s' "$APK_PATH")"
|
|
APK_SHA256="$(sha256sum "$APK_PATH" | cut -d ' ' -f 1)"
|
|
echo "APK verification passed"
|
|
echo " file: $APK_PATH"
|
|
echo " package: su.snw.vpn_app"
|
|
echo " version: $EXPECTED_VERSION_NAME ($EXPECTED_VERSION_CODE)"
|
|
echo " ABI: arm64-v8a"
|
|
echo " size: $APK_SIZE bytes"
|
|
echo " SHA-256: $APK_SHA256"
|