@lynxship/cli 0.1.3 → 0.1.4

package/README.md

@@ -97,6 +97,21 @@ Progress percentages are shown only when LynxShip has a real measurement. Long
 Rspeedy, Gradle and Xcode operations remain visible in the event journal until
 their completion checkpoint is known; no timer-based percentage is invented.
 
+### Project-safe Android signing
+
+LynxShip does not require every project to contain a LynxShip-specific signing
+helper. During a real Android build it creates a temporary Gradle init script,
+passes it with Gradle's `--init-script` option, and removes it when the build
+finishes. The script reads only the already configured machine credentials and
+uses the Android Components `finalizeDsl` hook to configure the standard
+`release` build type. The project's Gradle files are left unchanged.
+
+This supports normal Android Gradle Plugin application projects using either
+Groovy or Kotlin DSL. Projects with custom flavor tasks, non-standard signing
+plugins, or no Android `release` build type must expose their signing contract
+explicitly; LynxShip fails with a clear diagnostic rather than producing an
+unverified artifact.
+
 ## Main commands
 
 ```text

package/dist/android-build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android-build.d.ts","sourceRoot":"","sources":["../src/android-build.ts"],"names":[],"mappings":"AAWA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAWhD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACvD;AAoID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa7D;AAED,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsCpE;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAyJnB"}
+{"version":3,"file":"android-build.d.ts","sourceRoot":"","sources":["../src/android-build.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAWhD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACvD;AA0LD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa7D;AAED,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsCpE;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAgKnB"}

package/dist/android-build.js

@@ -1,6 +1,7 @@
-import { access, copyFile, cp, mkdir, readFile, readdir, } from "node:fs/promises";
+import { access, chmod, copyFile, cp, mkdir, mkdtemp, readFile, readdir, rm, writeFile, } from "node:fs/promises";
 import { execFileSync } from "node:child_process";
 import { constants as fsConstants, existsSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { assert, sha256 } from "@lynxship/contracts";
 import { transitionBuild } from "@lynxship/build-orchestrator";
@@ -33,6 +34,56 @@ async function signingEnvironment(root) {
     assert(missing.length === 0, "BUILD_SIGNING_REQUIRED", `Signed Android builds require configuration. Missing: ${missing.join(", ")}. Run \`lynxship android configure\`.`);
     return { ...process.env, ...values };
 }
+async function createSigningInitScript() {
+    const directory = await mkdtemp(join(tmpdir(), "lynxship-gradle-"));
+    const file = join(directory, "android-signing.init.gradle");
+    const script = `
+def keystorePath = System.getenv("LYNXSHIP_KEYSTORE_PATH")
+def keyAlias = System.getenv("LYNXSHIP_KEY_ALIAS")
+def keystorePassword = System.getenv("LYNXSHIP_KEYSTORE_PASSWORD")
+def keyPassword = System.getenv("LYNXSHIP_KEY_PASSWORD")
+
+gradle.allprojects { project ->
+    project.plugins.withId("com.android.application") {
+        def configureSigning = { android ->
+            def signing = android.signingConfigs.findByName("release")
+            if (signing == null) {
+                signing = android.signingConfigs.create("lynxshipRelease")
+            }
+            signing.storeFile = project.file(keystorePath)
+            signing.storePassword = keystorePassword
+            signing.keyAlias = keyAlias
+            signing.keyPassword = keyPassword
+
+            def release = android.buildTypes.findByName("release")
+            if (release == null) {
+                throw new GradleException(
+                    "LynxShip requires an Android release build type"
+                )
+            }
+            release.signingConfig = signing
+            project.logger.lifecycle(
+                "[LynxShip] Applied machine signing credentials to \${project.path}:release"
+            )
+        }
+
+        def androidComponents = project.extensions.findByName("androidComponents")
+        if (androidComponents != null) {
+            androidComponents.finalizeDsl { android ->
+                configureSigning(android)
+            }
+        } else {
+            project.afterEvaluate {
+                configureSigning(project.extensions.findByName("android"))
+            }
+        }
+    }
+}
+`;
+    await writeFile(file, script, "utf8");
+    await chmod(file, 0o600).catch(() => undefined);
+    return { directory, file };
+}
 async function verifySignedArtifact(root, artifactPath, options) {
     if (artifactPath.endsWith(".apk")) {
         const apksigner = androidTool("apksigner");
@@ -161,6 +212,7 @@ export async function runRealAndroidBuild(job, options) {
         quiet: options.quiet ?? false,
         onOutput: options.onEvent,
     };
+    let signingInitDirectory;
     try {
         transitionBuild(job, "uploading_source", "local Android source prepared");
         job.logs.push({
@@ -189,7 +241,10 @@ export async function runRealAndroidBuild(job, options) {
         step("Android host synchronized", 40);
         transitionBuild(job, "building", `Gradle ${artifact.task}`);
         step(`Running real Gradle task ${artifact.task}…`);
-        const gradleArgs = [artifact.task];
+        step("Applying temporary LynxShip Android signing adapter…");
+        const signingInitScript = await createSigningInitScript();
+        signingInitDirectory = signingInitScript.directory;
+        const gradleArgs = ["--init-script", signingInitScript.file, artifact.task];
         if (process.env.CI)
             gradleArgs.push("--stacktrace");
         await runProcess(wrapper, gradleArgs, {
@@ -258,4 +313,8 @@ export async function runRealAndroidBuild(job, options) {
         });
         throw error;
     }
+    finally {
+        if (signingInitDirectory)
+            await rm(signingInitDirectory, { recursive: true, force: true });
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lynxship/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Build, sign, store, submit and update LynxJS applications from the terminal.",
   "type": "module",
   "license": "MIT",
@@ -67,10 +67,10 @@
     "cli-progress": "3.12.0",
     "ora": "8.2.0",
     "qrcode-terminal": "0.12.0",
-    "@lynxship/db": "0.1.0",
     "@lynxship/build-orchestrator": "0.1.0",
-    "@lynxship/signing": "0.1.0",
+    "@lynxship/db": "0.1.0",
     "@lynxship/contracts": "0.1.0",
+    "@lynxship/signing": "0.1.0",
     "@lynxship/submit": "0.1.0"
   },
   "devDependencies": {