pakstr 0.6.0 → 0.8.0

package/dist/runners/DockerGradleRunner.js

@@ -4,57 +4,311 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DockerGradleRunner = void 0;
-const child_process_1 = require("child_process");
-const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
+const releaseVerification_1 = require("../android/releaseVerification");
+const releaseSigning_1 = require("../core/releaseSigning");
+const process_1 = require("./process");
+const CONTAINER_KEYSTORE_PATH = "/run/secrets/pakstr/release.keystore";
+const CONTAINER_RELEASE_APK = "/workspace/app/build/outputs/apk/release/app-release.apk";
+const CONTAINER_DEBUG_APK = "/workspace/app/build/outputs/apk/debug/app-debug.apk";
 class DockerGradleRunner {
     image;
+    execute;
     constructor(image = process.env.PAKSTR_DOCKER_IMAGE ??
-        "git.nostrdev.com/stuff/pakstr/android-builder:latest") {
+        "git.nostrdev.com/stuff/pakstr/android-builder:latest", execute = process_1.runProcess) {
         this.image = image;
+        this.execute = execute;
+    }
+    async build(request) {
+        this.checkDockerAvailable();
+        this.ensureDockerImage();
+        const signing = request.mode === "release" ? requireSigning(request.signing) : undefined;
+        const storage = this.createBuildStorage(request.androidRoot, signing);
+        let primaryError;
+        let result;
+        try {
+            result =
+                request.mode === "release"
+                    ? this.buildRelease(request, signing, storage)
+                    : this.buildDebug(request, storage);
+        }
+        catch (error) {
+            primaryError = error;
+        }
+        let cleanupError;
+        try {
+            this.removeBuildStorage(storage);
+        }
+        catch (error) {
+            cleanupError = error;
+        }
+        if (primaryError) {
+            if (cleanupError) {
+                console.error("Docker signing storage cleanup also failed:", safeErrorMessage(cleanupError));
+            }
+            throw primaryError;
+        }
+        if (cleanupError)
+            throw cleanupError;
+        if (!result)
+            throw new Error("Docker build completed without a result");
+        return result;
+    }
+    buildDebug(request, storage) {
+        this.execute("docker", [
+            "run",
+            "--rm",
+            "-v",
+            `${storage.workspaceVolume}:/workspace`,
+            this.image,
+            "./gradlew",
+            "assembleDebug",
+            "-Dorg.gradle.vfs.watch=false",
+        ], {
+            env: (0, releaseSigning_1.removeSigningVariables)(process.env),
+            streamOutput: true,
+        });
+        const artifactPath = hostArtifactPath(request.androidRoot, "debug");
+        this.copyFromVolume(storage.workspaceVolume, CONTAINER_DEBUG_APK, artifactPath);
+        return { artifactPath: requireApk(artifactPath) };
     }
-    async build(androidRoot, mode) {
-        console.log("🐳 Using Docker Gradle");
-        checkDockerAvailable();
-        ensureDockerImage(this.image);
-        const task = mode === "release" ? "assembleRelease" : "assembleDebug";
-        (0, child_process_1.execSync)(`docker run --rm \
-      --platform linux/amd64 \
-      -v "${androidRoot}:/workspace" \
-      ${this.image} \
-      ./gradlew ${task} -Dorg.gradle.vfs.watch=false`, {
-            stdio: "inherit",
+    buildRelease(request, signing, storage) {
+        if (!storage.signingVolume) {
+            throw new Error("Docker release build requires signing storage");
+        }
+        const secrets = signingSecrets(signing);
+        const dockerEnv = (0, releaseSigning_1.createGradleSigningEnvironment)(signing, process.env, CONTAINER_KEYSTORE_PATH);
+        const environmentNames = [
+            releaseSigning_1.INTERNAL_KEYSTORE_PATH_ENV,
+            releaseSigning_1.PUBLIC_SIGNING_ENV.keystorePassword,
+            releaseSigning_1.PUBLIC_SIGNING_ENV.keyAlias,
+            releaseSigning_1.PUBLIC_SIGNING_ENV.keyPassword,
+        ];
+        this.execute("docker", [
+            "run",
+            "--rm",
+            "-v",
+            `${storage.workspaceVolume}:/workspace`,
+            "-v",
+            `${storage.signingVolume}:/run/secrets/pakstr:ro`,
+            ...environmentNames.flatMap(name => ["--env", name]),
+            this.image,
+            "./gradlew",
+            "assembleRelease",
+            "--no-daemon",
+            "-Dorg.gradle.vfs.watch=false",
+        ], {
+            env: dockerEnv,
+            secrets,
+            streamOutput: true,
+        });
+        const verification = (0, releaseVerification_1.verifyReleaseApk)({
+            artifactPath: CONTAINER_RELEASE_APK,
+            expectedApplicationId: request.expectedApplicationId,
+            signing,
+            toolKeystorePath: CONTAINER_KEYSTORE_PATH,
+            executor: this.createVerificationExecutor(storage, signing),
         });
-        const apkPath = path_1.default.join(androidRoot, "app", "build", "outputs", "apk", mode, mode === "debug" ? "app-debug.apk" : "app-release.apk");
-        if (!fs_1.default.existsSync(apkPath)) {
-            throw new Error(`APK not found: ${apkPath}`);
+        const artifactPath = hostArtifactPath(request.androidRoot, "release");
+        this.copyFromVolume(storage.workspaceVolume, CONTAINER_RELEASE_APK, artifactPath);
+        return { artifactPath: requireApk(artifactPath), verification };
+    }
+    createBuildStorage(androidRoot, signing) {
+        const suffix = (0, crypto_1.randomUUID)();
+        const storage = {
+            workspaceVolume: `pakstr-workspace-${suffix}`,
+            signingVolume: signing ? `pakstr-signing-${suffix}` : undefined,
+        };
+        assertRegularAbsolutePath(androidRoot, "Android workspace");
+        if (signing) {
+            assertRegularAbsolutePath(signing.keystorePath, "Temporary keystore", true);
+        }
+        try {
+            this.execute("docker", ["volume", "create", storage.workspaceVolume]);
+            if (storage.signingVolume) {
+                this.execute("docker", ["volume", "create", storage.signingVolume]);
+            }
+            this.copyDirectoryToVolume(androidRoot, storage.workspaceVolume);
+            if (signing && storage.signingVolume) {
+                this.copyFileToVolume(signing.keystorePath, storage.signingVolume, "/run/secrets/pakstr/release.keystore", signingSecrets(signing));
+            }
+            return storage;
+        }
+        catch (error) {
+            try {
+                this.removeBuildStorage(storage);
+            }
+            catch (cleanupError) {
+                console.error("Docker signing storage cleanup also failed:", safeErrorMessage(cleanupError));
+            }
+            throw error;
+        }
+    }
+    copyDirectoryToVolume(source, volume) {
+        const container = `pakstr-workspace-copy-${(0, crypto_1.randomUUID)()}`;
+        try {
+            this.execute("docker", [
+                "create",
+                "--name",
+                container,
+                "-v",
+                `${volume}:/workspace`,
+                this.image,
+                "true",
+            ]);
+            this.execute("docker", ["cp", `${source}${path_1.default.sep}.`, `${container}:/workspace`]);
+        }
+        finally {
+            this.removeContainer(container);
+        }
+    }
+    copyFileToVolume(source, volume, destination, secrets) {
+        const container = `pakstr-signing-copy-${(0, crypto_1.randomUUID)()}`;
+        try {
+            this.execute("docker", [
+                "create",
+                "--name",
+                container,
+                "-v",
+                `${volume}:/run/secrets/pakstr`,
+                this.image,
+                "true",
+            ]);
+            this.execute("docker", ["cp", "-a", source, `${container}:${destination}`], {
+                secrets,
+            });
+        }
+        finally {
+            this.removeContainer(container);
+        }
+    }
+    copyFromVolume(volume, source, destination) {
+        const container = `pakstr-output-copy-${(0, crypto_1.randomUUID)()}`;
+        fs_1.default.mkdirSync(path_1.default.dirname(destination), { recursive: true });
+        fs_1.default.rmSync(destination, { force: true });
+        try {
+            this.execute("docker", [
+                "create",
+                "--name",
+                container,
+                "-v",
+                `${volume}:/workspace:ro`,
+                this.image,
+                "true",
+            ]);
+            this.execute("docker", ["cp", `${container}:${source}`, destination]);
+        }
+        finally {
+            this.removeContainer(container);
+        }
+    }
+    createVerificationExecutor(storage, signing) {
+        const secrets = signingSecrets(signing);
+        return {
+            run: (tool, args, env = {}) => {
+                const volumeArgs = ["-v", `${storage.workspaceVolume}:/workspace:ro`];
+                if (tool === "keytool") {
+                    if (!storage.signingVolume) {
+                        throw new Error("Signer verification requires Docker signing storage");
+                    }
+                    volumeArgs.push("-v", `${storage.signingVolume}:/run/secrets/pakstr:ro`);
+                }
+                return this.execute("docker", [
+                    "run",
+                    "--rm",
+                    ...volumeArgs,
+                    ...Object.keys(env).flatMap(name => ["--env", name]),
+                    this.image,
+                    tool,
+                    ...args,
+                ], { env: { ...(0, releaseSigning_1.removeSigningVariables)(process.env), ...env }, secrets });
+            },
+        };
+    }
+    removeBuildStorage(storage) {
+        const failures = [];
+        for (const volume of [storage.signingVolume, storage.workspaceVolume]) {
+            if (!volume)
+                continue;
+            try {
+                this.execute("docker", ["volume", "rm", "--force", volume]);
+            }
+            catch {
+                failures.push(volume);
+            }
+        }
+        if (failures.length) {
+            throw new Error(`Failed to remove temporary Docker volume(s): ${failures.join(", ")}`);
+        }
+    }
+    removeContainer(container) {
+        try {
+            this.execute("docker", ["rm", "--force", container]);
+        }
+        catch {
+            // A failed docker create leaves no container to remove.
+        }
+    }
+    checkDockerAvailable() {
+        try {
+            this.execute("docker", ["--version"]);
+        }
+        catch {
+            throw new Error("Docker is not installed or not running. Please install Docker Desktop first.");
+        }
+    }
+    ensureDockerImage() {
+        try {
+            this.execute("docker", ["image", "inspect", this.image]);
+            console.log(`🐳 Docker image ready: ${this.image}`);
+        }
+        catch {
+            console.log(`⬇️ Pulling Docker image: ${this.image}`);
+            this.execute("docker", ["pull", this.image], { streamOutput: true });
         }
-        return apkPath;
     }
 }
 exports.DockerGradleRunner = DockerGradleRunner;
-function checkDockerAvailable() {
-    try {
-        (0, child_process_1.execSync)("docker --version", {
-            stdio: "ignore",
-        });
+function hostArtifactPath(androidRoot, mode) {
+    return path_1.default.join(androidRoot, "app", "build", "outputs", "apk", mode, `app-${mode}.apk`);
+}
+function requireApk(artifactPath) {
+    if (!fs_1.default.existsSync(artifactPath) || !fs_1.default.lstatSync(artifactPath).isFile()) {
+        throw new Error(`APK not found after Docker build: ${artifactPath}`);
     }
-    catch (err) {
-        throw new Error("🐳 Docker is not installed or not running. Please install Docker Desktop first.");
+    return artifactPath;
+}
+function requireSigning(signing) {
+    if (!signing) {
+        throw new Error("Release build requires an internal signing context");
     }
+    return signing;
 }
-function ensureDockerImage(image) {
-    try {
-        (0, child_process_1.execSync)(`docker image inspect ${image}`, {
-            stdio: "ignore",
-        });
-        console.log(`🐳 Docker image ready: ${image}`);
+function signingSecrets(signing) {
+    return [
+        signing.storePassword,
+        signing.keyAlias,
+        signing.keyPassword,
+        signing.keystorePath,
+    ];
+}
+function assertRegularAbsolutePath(candidate, label, requireFile = false) {
+    if (!path_1.default.isAbsolute(candidate)) {
+        throw new Error(`${label} path must be absolute`);
     }
-    catch {
-        console.log(`📦 Docker image missing: ${image}`);
-        console.log(`⬇️ Pulling ${image}...`);
-        (0, child_process_1.execSync)(`docker pull ${image}`, {
-            stdio: "inherit",
-        });
+    if (!fs_1.default.existsSync(candidate)) {
+        throw new Error(`${label} path does not exist`);
+    }
+    const stat = fs_1.default.lstatSync(candidate);
+    if (stat.isSymbolicLink()) {
+        throw new Error(`${label} path must not be a symbolic link`);
     }
+    if (requireFile ? !stat.isFile() : !stat.isDirectory()) {
+        throw new Error(`${label} path has an unexpected filesystem type`);
+    }
+}
+function safeErrorMessage(error) {
+    return error instanceof Error ? error.message : "unknown Docker cleanup error";
 }

package/dist/runners/LocalGradleRunner.js

@@ -4,47 +4,108 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalGradleRunner = void 0;
-const child_process_1 = require("child_process");
-const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const releaseVerification_1 = require("../android/releaseVerification");
+const releaseSigning_1 = require("../core/releaseSigning");
+const process_1 = require("./process");
 class LocalGradleRunner {
-    async build(androidRoot, mode) {
-        const gradleTask = mode === "release" ? "assembleRelease" : "assembleDebug";
+    async build(request) {
+        const { androidRoot, mode } = request;
+        const gradlewPath = path_1.default.join(androidRoot, "gradlew");
+        if (!fs_1.default.existsSync(gradlewPath)) {
+            throw new Error("gradlew not found in Android project root");
+        }
         console.log("⚙️ Local Gradle build");
         console.log("📂 Android:", androidRoot);
-        const gradlewFile = path_1.default.join(androidRoot, "gradlew");
-        if (!fsExists(gradlewFile)) {
-            throw new Error("❌ gradlew not found in Android project root");
+        if (mode === "debug") {
+            (0, process_1.runProcess)(gradlewPath, ["assembleDebug"], {
+                cwd: androidRoot,
+                env: (0, releaseSigning_1.removeSigningVariables)(process.env),
+                streamOutput: true,
+            });
+            return { artifactPath: requireApk(androidRoot, "debug") };
         }
-        const gradlewPath = "./gradlew";
-        console.log("📍 Using:", gradlewPath);
-        (0, child_process_1.execSync)(`bash "${gradlewPath}" ${gradleTask}`, {
+        const signing = requireSigning(request.signing);
+        const secrets = signingSecrets(signing);
+        const gradleEnv = (0, releaseSigning_1.createGradleSigningEnvironment)(signing);
+        (0, process_1.runProcess)(gradlewPath, ["assembleRelease", "--no-daemon"], {
             cwd: androidRoot,
-            stdio: "inherit",
+            env: gradleEnv,
+            secrets,
+            streamOutput: true,
         });
-        const apkPath = findApk(androidRoot, mode);
-        if (!apkPath) {
-            throw new Error("❌ APK not found after Gradle build");
-        }
-        console.log("✅ APK created:", apkPath);
-        return apkPath;
+        const artifactPath = requireApk(androidRoot, "release");
+        const executor = createLocalVerificationExecutor(signing);
+        const verification = (0, releaseVerification_1.verifyReleaseApk)({
+            artifactPath,
+            expectedApplicationId: request.expectedApplicationId,
+            signing,
+            executor,
+        });
+        return { artifactPath, verification };
     }
 }
 exports.LocalGradleRunner = LocalGradleRunner;
-function findApk(androidRoot, mode) {
-    const apkDir = path_1.default.join(androidRoot, "app", "build", "outputs", "apk", mode);
-    if (!fs_1.default.existsSync(apkDir)) {
-        return null;
+function createLocalVerificationExecutor(signing) {
+    const androidHome = process.env.ANDROID_HOME ??
+        process.env.ANDROID_SDK_ROOT ??
+        path_1.default.join(os_1.default.homedir(), "Library", "Android", "sdk");
+    const secrets = signingSecrets(signing);
+    return {
+        run(tool, args, env = {}) {
+            const command = resolveTool(tool, androidHome);
+            return (0, process_1.runProcess)(command, args, {
+                env: { ...process.env, ...env },
+                secrets,
+            });
+        },
+    };
+}
+function resolveTool(tool, androidHome) {
+    if (tool === "keytool")
+        return "keytool";
+    if (tool === "apkanalyzer") {
+        const analyzer = path_1.default.join(androidHome, "cmdline-tools", "latest", "bin", "apkanalyzer");
+        if (!fs_1.default.existsSync(analyzer)) {
+            throw new Error(`Required Android verification tool not found: ${analyzer}`);
+        }
+        return analyzer;
+    }
+    const buildToolsDir = path_1.default.join(androidHome, "build-tools");
+    if (!fs_1.default.existsSync(buildToolsDir)) {
+        throw new Error(`Android build-tools directory not found: ${buildToolsDir}`);
+    }
+    const versions = fs_1.default
+        .readdirSync(buildToolsDir)
+        .sort((a, b) => b.localeCompare(a, undefined, { numeric: true }));
+    const signer = versions
+        .map(version => path_1.default.join(buildToolsDir, version, "apksigner"))
+        .find(candidate => fs_1.default.existsSync(candidate));
+    if (!signer) {
+        throw new Error(`Required Android verification tool apksigner not found under ${buildToolsDir}`);
     }
-    const files = fs_1.default.readdirSync(apkDir);
-    const apk = files.find(file => file.endsWith(".apk") &&
-        !file.includes("metadata"));
-    if (!apk) {
-        return null;
+    return signer;
+}
+function requireApk(androidRoot, mode) {
+    const artifactPath = path_1.default.join(androidRoot, "app", "build", "outputs", "apk", mode, `app-${mode}.apk`);
+    if (!fs_1.default.existsSync(artifactPath) || !fs_1.default.lstatSync(artifactPath).isFile()) {
+        throw new Error(`APK not found after Gradle build: ${artifactPath}`);
+    }
+    return artifactPath;
+}
+function requireSigning(signing) {
+    if (!signing) {
+        throw new Error("Release build requires an internal signing context");
     }
-    return path_1.default.join(apkDir, apk);
+    return signing;
 }
-function fsExists(file) {
-    const fs = require("fs");
-    return fs.existsSync(file);
+function signingSecrets(signing) {
+    return [
+        signing.storePassword,
+        signing.keyAlias,
+        signing.keyPassword,
+        signing.keystorePath,
+    ];
 }

package/dist/runners/process.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runProcess = runProcess;
+exports.redact = redact;
+const child_process_1 = require("child_process");
+const MAX_DIAGNOSTIC_LENGTH = 32 * 1024;
+function runProcess(command, args, options = {}) {
+    const result = (0, child_process_1.spawnSync)(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    const stdout = redact(result.stdout ?? "", options.secrets ?? []);
+    const stderr = redact(result.stderr ?? "", options.secrets ?? []);
+    if (options.streamOutput) {
+        if (stdout)
+            process.stdout.write(stdout);
+        if (stderr)
+            process.stderr.write(stderr);
+    }
+    if (result.error) {
+        throw new Error(`Failed to run ${command}: ${redact(result.error.message, options.secrets ?? [])}`);
+    }
+    if (result.status !== 0) {
+        const diagnostic = bounded(`${stderr}\n${stdout}`.trim());
+        const suffix = diagnostic ? `\n${diagnostic}` : "";
+        throw new Error(`${command} exited with status ${result.status}${result.signal ? ` (${result.signal})` : ""}${suffix}`);
+    }
+    return { stdout, stderr };
+}
+function redact(value, secrets) {
+    return secrets
+        .filter(secret => secret.length > 0)
+        .sort((a, b) => b.length - a.length)
+        .reduce((output, secret) => output.split(secret).join("[REDACTED]"), value);
+}
+function bounded(value) {
+    if (value.length <= MAX_DIAGNOSTIC_LENGTH)
+        return value;
+    return `[diagnostic truncated]\n${value.slice(-MAX_DIAGNOSTIC_LENGTH)}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -27,6 +27,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "test": "npm run build && node --test test/*.test.js",
     "start": "node dist/index.js",
     "dev": "ts-node src/index.ts",
     "pack:test": "npm pack"