blob: 27327b4502d7fb64b3642fcafb4fb056b53793b7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
#!/usr/bin/env bash
set -eu
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
CONTAINER_RUNNER=${CONTAINER_RUNNER:-"podman"}
CONTAINER_IMAGE_NAME=$(cat "$SCRIPT_DIR/../../building/android-container-image.txt")
ARTIFACT_DIR=${1:?'Usage: sign.sh <artifact-dir>'}
if [[ ! -d "$ARTIFACT_DIR" ]]; then
echo "Error: not a directory: $ARTIFACT_DIR"
exit 1
fi
if [[ -z ${YUBIKEY_PIN-} ]]; then
echo "YUBIKEY_PIN pin must be set."
exit 1
fi
if [[ -z ${YUBIKEY_PATH-} ]]; then
echo "YUBIKEY_PATH must be set."
exit 1
fi
if [[ -n ${OVERRIDE_PROVIDER_CONFIG-} ]]; then
optional_override_provider_config=(-v "$OVERRIDE_PROVIDER_CONFIG:/usr/local/etc/pkcs11_java.cfg:Z")
fi
printf '%s' "$YUBIKEY_PIN" | "$CONTAINER_RUNNER" secret create --replace YUBIKEY_PIN -
cleanup() { "$CONTAINER_RUNNER" secret rm YUBIKEY_PIN 2>/dev/null || true; }
trap cleanup EXIT
"$CONTAINER_RUNNER" run --rm -it -q \
--device "$YUBIKEY_PATH" \
--secret YUBIKEY_PIN,type=env \
-v "$SCRIPT_DIR/wait-for-pcscd.sh:/wait-for-pcscd.sh:Z" \
-v "$SCRIPT_DIR/sign.sh:/sign.sh:Z" \
-v "$ARTIFACT_DIR:/artifact_dir:Z" \
"${optional_override_provider_config[@]}" \
-w "/artifact_dir" \
--entrypoint /wait-for-pcscd.sh \
"$CONTAINER_IMAGE_NAME" \
bash -c 'shopt -s nullglob; /sign.sh MullvadVPN-*.aab MullvadVPN-*.apk'
|
