GitLab

at 2024-02-28T16:17:42+01:00

Bug 41093: Unsign APKs before signing them

Use the bspatch file we create during the build to unsign the apk (which
was signed by the QA key) before signing it with the release key.

 mkdir -p ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"

 chgrp signing ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"

 chmod g+w ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"

-cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.apk ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"

+cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.apk \

+  ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.bspatch \

+  ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"

 cd ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"

 # Sign all packages

 for arch in ${ARCHS}; do

   qa_apk=${projname}-qa-android-${arch}-${tbb_version}.apk

+  unsigned_apk=${projname}-qa-unsigned-android-${arch}-${tbb_version}.apk

+  unsigned_apk_bspatch=${projname}-qa-unsign-android-${arch}-${tbb_version}.bspatch

   signed_apk=${projname}-android-${arch}-${tbb_version}.apk

-  sign_apk "$qa_apk" "$signed_apk"

+  bspatch "$qa_apk" "$unsigned_apk" "$unsigned_apk_bspatch"

+  sign_apk "$unsigned_apk" "$signed_apk"

   verify_apk "$signed_apk"

   cp -f "$signed_apk" ~/"$SIGNING_PROJECTNAME-$tbb_version"

 done

 install_packages cmake libusb-1.0-0-dev libedit-dev gengetopt libpcsclite-dev help2man chrpath dh-exec

 # Install deps for android/apk signing

-install_packages unzip openjdk-11-jdk-headless openjdk-11-jre-headless

+install_packages unzip openjdk-11-jdk-headless openjdk-11-jre-headless bsdiff

 # Install deps for macos-rcodesign signing

 install_packages p7zip-full zstd

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build

Commits:

2 changed files:

Changes: