thepraandClaude Opus 5.5
94cc74bb95
- The Arasaka F-Droid repository, packages.arasaka.software/fdroid/repo, is signed with the same key as the app, so the fingerprint F-Droid or Obtainium checks is the one already on the download page for the APK. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T9uhaCTSycTh1r8At679Pz
89 lines
3.5 KiB
Bash
Executable File
89 lines
3.5 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
version=$1
|
|
here=$(pwd)
|
|
root=${PACKAGES_ROOT:-/var/www/packages.arasaka.software}
|
|
keep=${FDROID_KEEP:-3}
|
|
url=https://packages.arasaka.software/fdroid/repo
|
|
fingerprint=5F52CFF4F52F4E0B6DA6CD044BFCEAF78D1D42DB24F2470602DB7F19CBFDF846
|
|
id=software.arasaka.meweb
|
|
apk=$here/releases/$version/MeWeb-$version-android.apk
|
|
test -f "$apk"
|
|
if [ -z "${MEWEB_KEYSTORE_B64:-}" ] || [ -z "${MEWEB_KEYSTORE_PASS:-}" ]; then
|
|
echo "::error::the repository secrets MEWEB_KEYSTORE_B64 and MEWEB_KEYSTORE_PASS are not set"
|
|
exit 1
|
|
fi
|
|
major=$(echo "$version" | cut -d. -f1)
|
|
minor=$(echo "$version" | cut -d. -f2)
|
|
patch=$(echo "$version" | cut -d. -f3)
|
|
code=$((major * 10000 + minor * 100 + patch))
|
|
|
|
tools/setup.sh --group fdroid
|
|
tools=$here/tools/fdroid/linux-x64
|
|
pinned=$(sed -n 's/^fdroidserver==\([^ ]*\).*/\1/p' packaging/fdroid/requirements.txt)
|
|
venv=$tools/fdroidserver-$pinned
|
|
if [ ! -x "$venv/bin/fdroid" ]; then
|
|
rm -rf "$venv"
|
|
UV_CACHE_DIR=$tools/cache UV_PYTHON_INSTALL_DIR=$tools/python "$tools/uv-x86_64-unknown-linux-gnu/uv" venv -q --python 3.12 "$venv"
|
|
UV_CACHE_DIR=$tools/cache "$tools/uv-x86_64-unknown-linux-gnu/uv" pip install -q --python "$venv/bin/python" --require-hashes -r packaging/fdroid/requirements.txt
|
|
fi
|
|
JAVA_HOME=$(ls -d "$here"/tools/jdk/linux-x64/*/ | head -n 1)
|
|
ANDROID_HOME=$here/tools/android-sdk
|
|
PATH=$JAVA_HOME/bin:$PATH
|
|
export JAVA_HOME ANDROID_HOME PATH
|
|
|
|
exec 9>>"$root/.lock"
|
|
flock -w 2700 9
|
|
|
|
keys=$(mktemp -d)
|
|
trap 'rm -rf "$keys"' EXIT
|
|
(umask 077 && printf '%s' "$MEWEB_KEYSTORE_B64" | base64 -d > "$keys/meweb.keystore")
|
|
MEWEB_KEYSTORE=$keys/meweb.keystore
|
|
export MEWEB_KEYSTORE MEWEB_KEYSTORE_PASS
|
|
unset MEWEB_KEYSTORE_B64
|
|
held=$(keytool -J-Duser.language=en -list -v -keystore "$MEWEB_KEYSTORE" -storepass:env MEWEB_KEYSTORE_PASS -alias meweb | sed -n 's/^.*SHA256: *//p' | tr -d ':')
|
|
test "$held" = "$fingerprint"
|
|
|
|
state=$root/.fdroid
|
|
snap=$state/$(date -u +%Y%m%d%H%M%S)-$version
|
|
mkdir -p "$snap/repo" "$snap/metadata" "$snap/tmp"
|
|
if [ -e "$root/fdroid/repo" ]; then
|
|
prior=$(readlink -f "$root/fdroid/repo")/..
|
|
for file in "$prior"/repo/*.apk; do
|
|
[ -e "$file" ] && ln "$file" "$snap/repo/"
|
|
done
|
|
cp -a "$prior/metadata/." "$snap/metadata/"
|
|
cp "$prior/repo/index-v2.json" "$snap/repo/"
|
|
if [ -f "$prior/tmp/apkcache.json" ]; then cp "$prior/tmp/apkcache.json" "$snap/tmp/"; fi
|
|
fi
|
|
cp packaging/fdroid/config.yml "$snap/config.yml"
|
|
chmod 600 "$snap/config.yml"
|
|
cp packaging/fdroid/icon.png "$snap/icon.png"
|
|
cp -r packaging/fdroid/metadata/. "$snap/metadata/"
|
|
rm -f "$snap/repo/${id}_$code.apk"
|
|
cp "$apk" "$snap/repo/${id}_$code.apk"
|
|
(cd "$snap/repo" && ls "$id"_*.apk | sed 's/.*_\([0-9]*\)\.apk$/\1/' | sort -n | head -n "-$keep" | while read -r old; do
|
|
rm -f "${id}_$old.apk"
|
|
done)
|
|
|
|
(cd "$snap" && "$venv/bin/fdroid" update)
|
|
rm -rf "$snap/repo/status"
|
|
chmod -R u=rwX,go=rX "$snap/repo"
|
|
|
|
mkdir -p "$root/fdroid"
|
|
ln -sfn "../.fdroid/$(basename "$snap")/repo" "$root/fdroid/repo.new"
|
|
mv -T -f "$root/fdroid/repo.new" "$root/fdroid/repo"
|
|
ls -1d "$state"/*/ | sort | head -n -3 | while read -r old; do
|
|
find "$old" -maxdepth 0 -mmin +1440 -exec rm -rf {} +
|
|
done
|
|
echo "published ${id}_$code.apk in $root/fdroid/repo"
|
|
|
|
if [ "$root" = /var/www/packages.arasaka.software ]; then
|
|
curl -fsS "$url/entry.jar" -o "$keys/entry.jar"
|
|
signed=$(keytool -J-Duser.language=en -printcert -jarfile "$keys/entry.jar" | sed -n 's/^.*SHA256: *//p' | head -n 1 | tr -d ':')
|
|
test "$signed" = "$fingerprint"
|
|
curl -fsS "$url/index-v2.json" | grep -Eq "\"versionCode\": ?$code\b"
|
|
curl -fsSI "$url/${id}_$code.apk" > /dev/null
|
|
echo "live at $url: $id $version ($code)"
|
|
fi
|