blob: 61bf556d830591734d2f8ec39ee2d0ec221c6626 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
#!/usr/bin/env bash
# # Setup instructions before this script will work
#
# * Follow the instructions in ../README.md
# * Import and trust the GPG keys of everyone who the build server should trust code from
# * Ensure that the machine running this script is allowed to upload to releases.mullvad.net.
set -eu
shopt -s nullglob
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
BUILD_DIR="$SCRIPT_DIR/mullvadvpn-app"
LAST_BUILT_DIR="$SCRIPT_DIR/last-built"
UPLOAD_DIR="$SCRIPT_DIR/upload"
ANDROID_CREDENTIALS_DIR="$SCRIPT_DIR/credentials-android"
BRANCHES_TO_BUILD=("origin/main")
TAG_PATTERN_TO_BUILD="^android/"
function upload {
for f in MullvadVPN-*.{apk,aab}; do
sha256sum "$f" > "$f.sha256"
mv "$f" "$f.sha256" "$UPLOAD_DIR/"
done
}
function build_ref {
ref=$1
tag=${2:-""}
current_hash="$(git rev-parse "$ref^{commit}")"
if [ -f "$LAST_BUILT_DIR/$current_hash" ]; then
# This commit has already been built
return 0
fi
echo ""
echo "[#] $ref: $current_hash, building new packages."
if [[ $ref == "refs/tags/"* ]] && ! git verify-tag "$ref"; then
echo "!!!"
echo "[#] $ref is a tag, but it failed GPG verification!"
echo "!!!"
sleep 60
return 0
elif [[ $ref == "refs/remotes/"* ]] && ! git verify-commit "$current_hash"; then
echo "!!!"
echo "[#] $ref is a branch, but it failed GPG verification!"
echo "!!!"
sleep 60
return 0
fi
# Clean our working dir and check out the code we want to build
rm -r dist/ 2&>/dev/null || true
git reset --hard
git checkout "$ref"
git submodule update
git clean -df
echo "Building Android app"
ANDROID_CREDENTIALS_DIR=$ANDROID_CREDENTIALS_DIR \
USE_MOLD=false \
./building/containerized-build.sh android --app-bundle || return 0
# If there is a tag for this commit then we append that to the produced artifacts
# A version suffix should only be created if there is a tag for this commit and it is not a release build
if [[ -n "$tag" ]]; then
# Remove disallowed version characters from the tag
version_suffix="+${tag//[^0-9a-z_-]/}"
# Will only match paths that include *-dev-* which means release builds will not be included
# Pipes all matching names and their new name to mv
pushd dist
for original_file in MullvadVPN-*-dev-*{.apk,.aab}; do
new_file=$(echo "$original_file" | sed -nE "s/^(MullvadVPN-.*-dev-.*)(\.apk|\.aab)$/\1$version_suffix\2/p")
mv "$original_file" "$new_file"
done
popd
fi
(cd dist/ && upload) || return 0
touch "$LAST_BUILT_DIR/$current_hash"
echo "Successfully finished Android build at $(date)"
}
cd "$BUILD_DIR"
while true; do
# Delete all tags. So when fetching we only get the ones existing on the remote
git tag | xargs git tag -d > /dev/null
git fetch --prune --tags 2> /dev/null || continue
# Tags can't include spaces so SC2207 isn't a problem here
# shellcheck disable=SC2207
tags=( $(git tag | grep "$TAG_PATTERN_TO_BUILD") )
for tag in "${tags[@]}"; do
build_ref "refs/tags/$tag" "$tag"
done
for branch in "${BRANCHES_TO_BUILD[@]}"; do
build_ref "refs/remotes/$branch"
done
sleep 240
done
|
