halkyon/tool/release.sh

#!/usr/bin/env bash
# Builds a release and publishes it: the Android APK (one for every phone, signed with
# the app's key) and the Linux snap, both connecting to learn.halkyon.eu, the project's
# instance; a list of their checksums signed with GPG; all of it as a release on
# code.halkyon.app, and the snap in the Snap Store's edge channel. Run on a developer's
# laptop, never in CI: the app's key never leaves it.
#
#   tool/release.sh v0.1.0
#
# Before: the version, with a build number above the last release's, in
# halkyon_learn_flutter/pubspec.yaml on main, pushed; the tag signed on that commit and
# pushed (git tag -s v0.1.0 -m 'Halkyon Learn 0.1.0' && git push origin v0.1.0);
# `snapcraft login` with the project's account. The script asks for the key's password
# and a Forgejo token (scope write:repository) first, checks both, and then runs
# unattended until GPG asks for its passphrase; neither is ever written down.
#
# The app's key is a PKCS #12 keystore at $HALKYON_ANDROID_KEYSTORE (default below), its
# alias $HALKYON_ANDROID_KEY_ALIAS. Its certificate's SHA-256 is committed in
# tool/release/android-certificate.sha256, and nothing signed otherwise is released.
set -euo pipefail
cd "$(git rev-parse --show-toplevel)"

readonly server_url='https://learn.halkyon.eu/'
readonly forgejo='https://code.halkyon.app'
readonly repository='project-halkyon/halkyon_learn'
readonly pubspec='halkyon_learn_flutter/pubspec.yaml'
readonly certificate_file='tool/release/android-certificate.sha256'
keystore="${HALKYON_ANDROID_KEYSTORE:-$HOME/.local/share/halkyon-learn/android-release.p12}"
readonly key_alias="${HALKYON_ANDROID_KEY_ALIAS:-halkyon-learn}"

fail() {
  echo "✗ $*" >&2
  exit 1
}
step() { echo "▸ $*"; }

[ $# -eq 1 ] || fail 'Usage: tool/release.sh v<major>.<minor>.<patch>'
readonly tag="$1"
[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || fail "$tag is no version tag such as v1.2.3."
readonly version="${tag#v}"

step "Checking what $tag releases"
[ -z "$(git status --porcelain)" ] || fail 'The working tree has changes.'
[ "$(git symbolic-ref --quiet --short HEAD)" = main ] || fail 'Not on main.'
git fetch --quiet origin main
[ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ] ||
  fail 'main differs from origin/main: pull or push first.'
[ "$(git cat-file -t "$tag" 2>/dev/null)" = tag ] ||
  fail "No annotated tag $tag: git tag -s $tag -m 'Halkyon Learn $version'"
[ "$(git rev-parse "$tag^{commit}")" = "$(git rev-parse HEAD)" ] ||
  fail "$tag isn't on HEAD."
[ "$(git ls-remote origin "refs/tags/$tag" | cut -f1)" = "$(git rev-parse "$tag")" ] ||
  fail "origin doesn't have $tag as it is here: git push origin $tag"
# Signed by a key deploys accept too: the primary key's fingerprint ends GnuPG's
# VALIDSIG line, as %GP gives it for the commits deploy/redeploy.sh checks.
validsig=$(git verify-tag --raw "$tag" 2>&1 | grep '^\[GNUPG:\] VALIDSIG ' || true)
readonly signer="${validsig##* }"
if [ -z "$validsig" ] || ! grep -qx "$signer" deploy/allowed-signers; then
  fail "$tag isn't signed by a key in deploy/allowed-signers."
fi

declared=$(sed -n 's/^version: *//p' "$pubspec")
[ "${declared%%+*}" = "$version" ] || fail "$pubspec says ${declared%%+*}, not $version."
readonly build="${declared#*+}"
[[ "$build" =~ ^[0-9]+$ ]] || fail "$pubspec's version lacks its build number (+N)."
# Every release raises the build number: Android installs only higher ones, and the
# server tells apps below its minimum build to update.
if previous=$(git describe --tags --abbrev=0 --match 'v*' "$tag^" 2>/dev/null); then
  previous_build=$(git show "$previous:$pubspec" | sed -n 's/^version: *[^+]*+//p')
  [ "$build" -gt "$previous_build" ] ||
    fail "Build $build isn't above $previous's build $previous_build."
fi

pinned=$(sed -n 's/^ *FLUTTER_VERSION: *//p' .forgejo/workflows/ci.yaml)
running=$(flutter --version --machine | sed -n 's/^ *"frameworkVersion": *"\([^"]*\)".*/\1/p')
[ "$running" = "$pinned" ] || fail "Flutter is $running here, CI pins $pinned."

step 'Checking the tools'
for tool in snapcraft unsquashfs gpg curl jq sha256sum unzip; do
  command -v "$tool" >/dev/null || fail "$tool is missing."
done
sdk="${ANDROID_HOME:-${ANDROID_SDK_ROOT:-$HOME/Android/Sdk}}"
build_tools=$(find "$sdk/build-tools" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort -V | tail -n 1)
[ -n "$build_tools" ] || fail "No Android build tools in $sdk (ANDROID_HOME)."
readonly apksigner="$build_tools/apksigner" aapt2="$build_tools/aapt2"
# keytool, and the java apksigner runs on, come with a JDK: the one on the PATH, else
# the one Android Studio brings.
jdk_bin=$(dirname "$(command -v java || echo /snap/android-studio/current/jbr/bin/java)")
[ -x "$jdk_bin/java" ] && [ -x "$jdk_bin/keytool" ] || fail 'No JDK found (java, keytool).'
export PATH="$jdk_bin:$PATH"
readonly keytool="$jdk_bin/keytool"
account=$(snapcraft whoami 2>/dev/null | sed -n 's/^username: *//p' || true)
[ -n "$account" ] || fail 'Not logged in to the Snap Store: snapcraft login'

[ -f "$certificate_file" ] || fail "$certificate_file is missing."
certificate=$(grep -v '^#' "$certificate_file" | tr -d ' :\n' | tr 'A-F' 'a-f' || true)
readonly certificate
[[ "$certificate" =~ ^[0-9a-f]{64}$ ]] || fail "$certificate_file holds no SHA-256."
[ -f "$keystore" ] || fail "No keystore at $keystore (HALKYON_ANDROID_KEYSTORE)."
keystore=$(realpath "$keystore")
readonly keystore

step 'Asking for the secrets'
read -rsp "Password of $keystore: " password
echo
key_certificate=$(HALKYON_ANDROID_KEYSTORE_PASSWORD="$password" "$keytool" -list -v \
  -keystore "$keystore" -alias "$key_alias" \
  -storepass:env HALKYON_ANDROID_KEYSTORE_PASSWORD 2>/dev/null |
  sed -n 's/^.*SHA256: *//p' | head -n 1 | tr -d ':' | tr 'A-F' 'a-f' || true)
[ -n "$key_certificate" ] || fail "Wrong password, or no key $key_alias in $keystore."
[ "$key_certificate" = "$certificate" ] ||
  fail "The key $key_alias in $keystore isn't the one in $certificate_file."

read -rsp "Forgejo token for $forgejo (write:repository): " token
echo
# The token goes to curl in a configuration read from a file descriptor, so it never
# shows in the list of processes as an argument would.
forgejo_api() {
  curl --fail-with-body --silent --show-error \
    --config <(printf 'header = "Authorization: token %s"\n' "$token") "$@"
}
forgejo_api --output /dev/null "$forgejo/api/v1/user" ||
  fail "$forgejo doesn't take the token."
[ "$(forgejo_api --output /dev/null --write-out '%{http_code}' \
  "$forgejo/api/v1/repos/$repository/releases/tags/$tag" 2>/dev/null || true)" = 404 ] ||
  fail "A release of $tag exists already on $forgejo."

readonly out="build/release/$tag"
readonly source="$out/source"
readonly apk="halkyon-learn-$version.apk"
readonly snap="halkyon-learn_${version}_amd64.snap"
rm -rf "$out"
git worktree prune
mkdir -p "$out"
cleanup() { git worktree remove --force "$source" 2>/dev/null || true; }
trap cleanup EXIT

# The APK is built from a checkout of the tag, so nothing in the working tree (build
# caches, files git ignores) can get into it.
step "Building the APK from $tag"
git worktree add --quiet --detach "$source" "$tag"
(
  cd "$source/halkyon_learn_flutter"
  flutter pub get --enforce-lockfile
  HALKYON_ANDROID_KEYSTORE="$keystore" \
    HALKYON_ANDROID_KEY_ALIAS="$key_alias" \
    HALKYON_ANDROID_KEYSTORE_PASSWORD="$password" \
    flutter build apk --release --dart-define=SERVER_URL="$server_url"
  # The Gradle daemon would otherwise live on with the password in its environment.
  (cd android && ./gradlew --stop >/dev/null) || true
)
cp "$source/halkyon_learn_flutter/build/app/outputs/flutter-apk/app-release.apk" "$out/$apk"
unset password

step 'Checking the APK'
signers=$("$apksigner" verify --print-certs "$out/$apk" |
  sed -n 's/^Signer #[0-9]* certificate SHA-256 digest: //p' || true)
[ "$signers" = "$certificate" ] ||
  fail "The APK isn't signed by the app's key alone, but by: $signers"
badging=$("$aapt2" dump badging "$out/$apk")
grep -q "^package: name='app.halkyon.learn' versionCode='$build' versionName='$version'" \
  <<<"$badging" || fail "The APK isn't app.halkyon.learn $version, build $build."
! grep -q '^application-debuggable' <<<"$badging" || fail 'The APK is debuggable.'
# grep's count is kept, not sent to /dev/null: there grep stops at the first match, which
# ends unzip with SIGPIPE, and pipefail counts that as a failure.
named=$(unzip -p "$out/$apk" lib/arm64-v8a/libapp.so | grep -caF "$server_url" || true)
[ "${named:-0}" -gt 0 ] || fail "The APK doesn't name $server_url."

# The snap builds the repository's committed HEAD, which is the tag (checked above). Its
# app part is cleaned so that it is built anew from this commit; the Flutter part stays.
step "Building the snap from $tag (in LXD)"
snapcraft clean halkyon-learn
snapcraft pack --output "$out"
[ -f "$out/$snap" ] || fail "snapcraft made no $snap."
snap_yaml=$(unsquashfs -cat "$out/$snap" meta/snap.yaml)
grep -qx "version: '\{0,1\}$version'\{0,1\}" <<<"$snap_yaml" ||
  fail "The snap isn't version $version."

step 'Signing the checksums'
(cd "$out" && sha256sum "$apk" "$snap" >SHA256SUMS)
gpg --local-user "$signer" --armor --detach-sign --output "$out/SHA256SUMS.asc" \
  "$out/SHA256SUMS"

step "Publishing the release on $forgejo"
notes="Halkyon Learn $version for Android and Linux. Both connect to learn.halkyon.eu, \
the project's instance.

- **Android:** \`$apk\`, one APK for every phone, signed with the app's key; the \
SHA-256 of its certificate is \`$certificate\`.
- **Linux:** \`$snap\`, also in the Snap Store: \`snap install halkyon-learn --edge\`.

\`SHA256SUMS\` lists the files' checksums, signed with the GPG key \`$signer\` \
(\`SHA256SUMS.asc\`)."
release=$(jq -n --arg tag "$tag" --arg name "Halkyon Learn $version" --arg body "$notes" \
  '{tag_name: $tag, name: $name, body: $body}' |
  forgejo_api --header 'Content-Type: application/json' --data @- \
    "$forgejo/api/v1/repos/$repository/releases" | jq -r .id)
for file in "$apk" "$snap" SHA256SUMS SHA256SUMS.asc; do
  forgejo_api --output /dev/null --form "attachment=@$out/$file" \
    "$forgejo/api/v1/repos/$repository/releases/$release/assets?name=$file"
done
echo "  $forgejo/$repository/releases/tag/$tag"

# Last, as the Store may hold a revision for review; the release above stands either way.
step "Uploading the snap to the Snap Store's edge channel (as $account)"
snapcraft upload --release=edge "$out/$snap" ||
  fail "The upload failed; once fixed: snapcraft upload --release=edge $out/$snap"

echo "✓ Released $tag."