mirror of
https://github.com/flectar/mail.git
synced 2026-11-11 17:57:54 +00:00
48 lines
2.2 KiB
Bash
48 lines
2.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Check the single app signing identity used by every published Android APK.
|
|
set -euo pipefail
|
|
|
|
project_dir="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
|
|
for name in FLECTAR_ANDROID_KEYSTORE FLECTAR_ANDROID_KEYSTORE_PASSWORD FLECTAR_ANDROID_KEY_ALIAS FLECTAR_ANDROID_KEY_PASSWORD; do
|
|
if [[ -z "${!name:-}" ]]; then
|
|
printf 'Android signing requires %s. Restore the original app signing key and its credentials; never generate a replacement release key.\n' "$name" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
if [[ ! -f "$FLECTAR_ANDROID_KEYSTORE" ]]; then
|
|
printf 'The configured Android app signing keystore does not exist.\n' >&2
|
|
exit 1
|
|
fi
|
|
|
|
# keytool silently ignores a different -keypass for PKCS12, while Gradle's
|
|
# KeyStore.getKey does not. Reject inconsistent credentials before compilation.
|
|
if [[ "$FLECTAR_ANDROID_KEYSTORE_PASSWORD" != "$FLECTAR_ANDROID_KEY_PASSWORD" ]]; then
|
|
details="$(keytool -list -J-Duser.language=en -J-Duser.country=US \
|
|
-keystore "$FLECTAR_ANDROID_KEYSTORE" \
|
|
-storepass:env FLECTAR_ANDROID_KEYSTORE_PASSWORD)"
|
|
if [[ "$details" == *"Keystore type: PKCS12"* ]]; then
|
|
printf 'PKCS12 requires matching keystore and private-key passwords.\n' >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
expected="$(cat "$project_dir/platform/android/app-signing-certificate.sha256")"
|
|
if [[ ! "$expected" =~ ^[0-9a-f]{64}$ ]]; then
|
|
printf 'The pinned Android app signing certificate SHA-256 is invalid.\n' >&2
|
|
exit 1
|
|
fi
|
|
actual="$(keytool -exportcert -keystore "$FLECTAR_ANDROID_KEYSTORE" \
|
|
-alias "$FLECTAR_ANDROID_KEY_ALIAS" \
|
|
-storepass:env FLECTAR_ANDROID_KEYSTORE_PASSWORD | sha256sum)"
|
|
if [[ "${actual%% *}" != "$expected" ]]; then
|
|
printf 'Android signing key differs from the pinned app identity. Alpha, beta, and stable must use the original key; do not replace the fingerprint.\n' >&2
|
|
exit 1
|
|
fi
|
|
# Exporting a certificate alone also succeeds for certificate-only entries.
|
|
# A discarded CSR proves that the private key and its password are usable.
|
|
keytool -certreq -keystore "$FLECTAR_ANDROID_KEYSTORE" \
|
|
-alias "$FLECTAR_ANDROID_KEY_ALIAS" \
|
|
-storepass:env FLECTAR_ANDROID_KEYSTORE_PASSWORD \
|
|
-keypass:env FLECTAR_ANDROID_KEY_PASSWORD >/dev/null
|
|
printf '%s\n' "$expected"
|