3 # publish.py - part of the FDroid server tools
4 # Copyright (C) 2010-13, Ciaran Gultnieks, ciaran@ciarang.com
5 # Copyright (C) 2013-2014 Daniel Martà <mvdan@mvdan.cc>
7 # This program is free software: you can redistribute it and/or modify
8 # it under the terms of the GNU Affero General Public License as published by
9 # the Free Software Foundation, either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU Affero General Public License for more details.
17 # You should have received a copy of the GNU Affero General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
25 from argparse import ArgumentParser
29 from . import metadata
30 from .common import FDroidPopen, SdkToolsPopen, BuildException
38 global config, options
40 # Parse command line...
41 parser = ArgumentParser(usage="%(prog)s [options] "
42 "[APPID[:VERCODE] [APPID[:VERCODE] ...]]")
43 common.setup_global_opts(parser)
44 parser.add_argument("appid", nargs='*', help="app-id with optional versioncode in the form APPID[:VERCODE]")
45 metadata.add_metadata_arguments(parser)
46 options = parser.parse_args()
47 metadata.warnings_action = options.W
49 config = common.read_config(options)
51 if not ('jarsigner' in config and 'keytool' in config):
52 logging.critical('Java JDK not found! Install in standard location or set java_paths!')
56 if not os.path.isdir(log_dir):
57 logging.info("Creating log directory")
61 if not os.path.isdir(tmp_dir):
62 logging.info("Creating temporary directory")
66 if not os.path.isdir(output_dir):
67 logging.info("Creating output directory")
68 os.makedirs(output_dir)
70 unsigned_dir = 'unsigned'
71 if not os.path.isdir(unsigned_dir):
72 logging.warning("No unsigned directory - nothing to do")
75 for f in [config['keystorepassfile'],
77 config['keypassfile']]:
78 if not os.path.exists(f):
79 logging.error("Config error - missing '{0}'".format(f))
83 # https://dev.guardianproject.info/projects/bazaar/wiki/FDroid_Audit
84 # that a package could be crafted, such that it would use the same signing
85 # key as an existing app. While it may be theoretically possible for such a
86 # colliding package ID to be generated, it seems virtually impossible that
87 # the colliding ID would be something that would be a) a valid package ID,
88 # and b) a sane-looking ID that would make its way into the repo.
89 # Nonetheless, to be sure, before publishing we check that there are no
90 # collisions, and refuse to do any publishing if that's the case...
91 allapps = metadata.read_metadata()
92 vercodes = common.read_pkg_args(options.appid, True)
96 m.update(appid.encode('utf-8'))
97 keyalias = m.hexdigest()[:8]
98 if keyalias in allaliases:
99 logging.error("There is a keyalias collision - publishing halted")
101 allaliases.append(keyalias)
102 logging.info("{0} apps, {0} key aliases".format(len(allapps),
105 # Process any apks that are waiting to be signed...
106 for apkfile in sorted(glob.glob(os.path.join(unsigned_dir, '*.apk'))):
108 appid, vercode = common.apknameinfo(apkfile)
109 apkfilename = os.path.basename(apkfile)
110 if vercodes and appid not in vercodes:
112 if appid in vercodes and vercodes[appid]:
113 if vercode not in vercodes[appid]:
115 logging.info("Processing " + apkfile)
117 # There ought to be valid metadata for this app, otherwise why are we
118 # trying to publish it?
119 if appid not in allapps:
120 logging.error("Unexpected {0} found in unsigned directory"
121 .format(apkfilename))
125 if app.Binaries is not None:
127 # It's an app where we build from source, and verify the apk
128 # contents against a developer's binary, and then publish their
129 # version if everything checks out.
130 # The binary should already have been retrieved during the build
132 srcapk = apkfile + ".binary"
134 # Compare our unsigned one with the downloaded one...
135 compare_result = common.verify_apks(srcapk, apkfile, tmp_dir)
137 logging.error("...verification failed - publish skipped : "
141 # Success! So move the downloaded file to the repo, and remove
143 shutil.move(srcapk, os.path.join(output_dir, apkfilename))
148 # It's a 'normal' app, i.e. we sign and publish it...
150 # Figure out the key alias name we'll use. Only the first 8
151 # characters are significant, so we'll use the first 8 from
152 # the MD5 of the app's ID and hope there are no collisions.
153 # If a collision does occur later, we're going to have to
154 # come up with a new alogrithm, AND rename all existing keys
156 if appid in config['keyaliases']:
157 # For this particular app, the key alias is overridden...
158 keyalias = config['keyaliases'][appid]
159 if keyalias.startswith('@'):
161 m.update(keyalias[1:].encode('utf-8'))
162 keyalias = m.hexdigest()[:8]
165 m.update(appid.encode('utf-8'))
166 keyalias = m.hexdigest()[:8]
167 logging.info("Key alias: " + keyalias)
169 # See if we already have a key for this application, and
170 # if not generate one...
171 p = FDroidPopen([config['keytool'], '-list',
172 '-alias', keyalias, '-keystore', config['keystore'],
173 '-storepass:file', config['keystorepassfile']])
174 if p.returncode != 0:
175 logging.info("Key does not exist - generating...")
176 p = FDroidPopen([config['keytool'], '-genkey',
177 '-keystore', config['keystore'],
179 '-keyalg', 'RSA', '-keysize', '2048',
180 '-validity', '10000',
181 '-storepass:file', config['keystorepassfile'],
182 '-keypass:file', config['keypassfile'],
183 '-dname', config['keydname']])
184 # TODO keypass should be sent via stdin
185 if p.returncode != 0:
186 raise BuildException("Failed to generate key")
188 # Sign the application...
189 p = FDroidPopen([config['jarsigner'], '-keystore', config['keystore'],
190 '-storepass:file', config['keystorepassfile'],
191 '-keypass:file', config['keypassfile'], '-sigalg',
192 'SHA1withRSA', '-digestalg', 'SHA1',
194 # TODO keypass should be sent via stdin
195 if p.returncode != 0:
196 raise BuildException("Failed to sign application")
199 p = SdkToolsPopen(['zipalign', '-v', '4', apkfile,
200 os.path.join(output_dir, apkfilename)])
201 if p.returncode != 0:
202 raise BuildException("Failed to align application")
205 # Move the source tarball into the output directory...
206 tarfilename = apkfilename[:-4] + '_src.tar.gz'
207 tarfile = os.path.join(unsigned_dir, tarfilename)
208 if os.path.exists(tarfile):
209 shutil.move(tarfile, os.path.join(output_dir, tarfilename))
211 logging.info('Published ' + apkfilename)
214 if __name__ == "__main__":