Merge branch 'sign-android'

Author: benma

Makefile

@@ -66,8 +66,10 @@ qt-windows:
 	$(MAKE) buildweb
 	cd frontends/qt && $(MAKE) windows
 android:
-	$(MAKE) buildweb
 	cd frontends/android && ${MAKE} apk-debug
+# Create signed .apk and .aab.
+android-assemble-release:
+	cd frontends/android && ${MAKE} assemble-release
 ios:
 	cd frontends/ios && ${MAKE} build
 osx-sec-check:

docs/BUILD.md

@@ -114,7 +114,7 @@ To create the installer, run the NSIS UI, then: compile NSI scripts -> frontend/
 ### Build
 Enter the Docker environment: `make dockerdev`
 
-Within the Docker dev environment, build the Android App: `make android`
+Within the Docker dev environment, build the **debug version** of the Android App: `make android`
 
 To update the app icon, execute `frontends/android/mkicon.sh`.
 The script isn't run during `make android` build.
@@ -129,6 +129,17 @@ After connecting the device via USB, it is possible to verify the connection wit
 
 Inside `frontends/android` folder: `make deploy-debug`
 
+### Release build
+
+To assemble the signed release .apk and .aab files, run `make android-assemble-release`.
+
+The keystore file `frontends/android/BitBoxApp/app/bitboxapp.jks` must be present.
+
+Build artifacts:
+* `frontends/android/BitBoxApp/app/build/outputs/apk/release/app-release.apk`
+* `frontends/android/BitBoxApp/app/build/outputs/bundle/release/app-release.aab`
+
+
 ### Deploy troubleshooting
 If the apk install goes wrong, here are some Android configuration that could help:
 * Enable developer options

frontends/android/BitBoxApp/.gitignore

@@ -17,3 +17,6 @@
 /app/src/main/assets/web
 # Autogenerated mobileserver output
 /mobileserver/mobileserver.aar
+# Keystore is mounted inside docker only, but just to be sure we ignore it so
+# it is not accidentally committed.
+/app/bitboxapp.jks

frontends/android/BitBoxApp/app/build.gradle

@@ -19,11 +19,23 @@ android {
             }
         }
     }
+    signingConfigs {
+        release {
+            def env = System.getenv()
+            if (env.containsKey('KEYSTORE_STORE_FILE')) {
+                keyAlias env['KEYSTORE_KEY_ALIAS']
+                keyPassword env['KEYSTORE_KEY_PASSWORD']
+                storeFile file(env['KEYSTORE_STORE_FILE'])
+                storePassword env['KEYSTORE_STORE_PASSWORD']
+            }
+        }
+    }
     buildTypes {
         release {
             minifyEnabled false
             proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
             resValue "string", "app_name", "BitBoxApp"
+            signingConfig signingConfigs.release
         }
         debug {
             applicationIdSuffix ".debug"

frontends/android/Makefile

@@ -2,12 +2,16 @@ include ../../android-env.mk.inc
 
 apk-debug:
 	${MAKE} prepare-android
-	cd BitBoxApp && ./gradlew assemble
+	cd BitBoxApp && ./gradlew assembleDebug
+# Creates signed release .apk and .aab.
+assemble-release:
+	./assemble_release.sh
 deploy-debug:
 	adb install -r ./BitBoxApp/app/build/outputs/apk/debug/app-debug.apk
 clean:
 	cd BitBoxApp && ./gradlew clean
 prepare-android:
+	cd ../../ && ${MAKE} buildweb
 	rm -rf BitBoxApp/app/src/main/assets/web
 	mkdir -p BitBoxApp/app/src/main/assets/web
 	cp -aR ../web/build/* BitBoxApp/app/src/main/assets/web/

frontends/android/assemble_release.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+set -e
+
+# make sure it's not exported
+unset -v key_password
+unset -v store_password
+
+# make sure variables are not automatically exported
+set +o allexport
+
+keystore=BitBoxApp/app/bitboxapp.jks
+key_alias=bitboxapp
+expected_fingerprint="Certificate fingerprint (SHA-256): 67:E9:05:08:F7:49:BE:9D:CF:B1:83:33:92:BA:99:EE:BF:89:37:B1:BA:DD:F3:05:63:1C:E2:D9:FB:A5:0B:D7"
+
+if [[ ! -f "$keystore" ]]; then
+  echo "Keystore file not found: $keystore"
+  exit 1
+fi
+
+echo "Enter keystore password:"
+IFS= read -rs store_password < /dev/tty
+
+# check store password
+if ! keytool -list -keystore "$keystore" -storepass "$store_password" -alias "$key_alias" > /dev/null 2>&1; then
+  echo "Invalid keystore password"
+  exit 1
+fi
+
+# check expected key exists
+if ! keytool -list -keystore "$keystore" -storepass "$store_password" 2>/dev/null | grep -q "$expected_fingerprint"; then
+  echo "Keystore does not contain expected key"
+  exit 1
+fi
+
+echo "Enter password for key '$key_alias':"
+IFS= read -rs key_password < /dev/tty
+if ! keytool -certreq -keystore "$keystore" -storepass "$store_password" \
+        -alias "$key_alias" -keypass "$key_password" > /dev/null 2>&1; then
+  echo "Invalid key password"
+  exit 1
+fi
+
+export KEYSTORE_STORE_FILE=bitboxapp.jks
+export KEYSTORE_KEY_ALIAS="$key_alias"
+export KEYSTORE_KEY_PASSWORD="$key_password"
+export KEYSTORE_STORE_PASSWORD="$store_password"
+
+make prepare-android
+(cd BitBoxApp && ./gradlew assembleRelease bundleRelease)