mirror of
https://github.com/sudosylabs/vnidrop.git
synced 2026-08-05 18:39:55 +02:00
87 lines
1.9 KiB
Bash
Executable File
87 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ $# -ne 2 ]]; then
|
|
printf 'Usage: %s <apk> <expected-certificate-sha256>\n' "$0" >&2
|
|
exit 2
|
|
fi
|
|
|
|
apk=$1
|
|
expected_fingerprint=$2
|
|
build_tools_version=${ANDROID_BUILD_TOOLS_VERSION:-36.0.0}
|
|
|
|
normalize_fingerprint() {
|
|
printf '%s' "$1" |
|
|
tr -d '[:space:]:' |
|
|
tr '[:upper:]' '[:lower:]'
|
|
}
|
|
|
|
find_apksigner() {
|
|
if [[ -n ${APKSIGNER:-} ]]; then
|
|
[[ -x $APKSIGNER ]] || {
|
|
printf 'Configured apksigner is not executable: %s\n' "$APKSIGNER" >&2
|
|
return 1
|
|
}
|
|
printf '%s\n' "$APKSIGNER"
|
|
return
|
|
fi
|
|
|
|
local sdk_root=${ANDROID_SDK_ROOT:-${ANDROID_HOME:-}}
|
|
if [[ -n $sdk_root ]]; then
|
|
local pinned="$sdk_root/build-tools/$build_tools_version/apksigner"
|
|
if [[ -x $pinned ]]; then
|
|
printf '%s\n' "$pinned"
|
|
return
|
|
fi
|
|
fi
|
|
|
|
if command -v apksigner >/dev/null 2>&1; then
|
|
command -v apksigner
|
|
return
|
|
fi
|
|
|
|
printf 'apksigner %s was not found in the Android SDK or PATH\n' \
|
|
"$build_tools_version" >&2
|
|
return 1
|
|
}
|
|
|
|
[[ -s $apk ]] || {
|
|
printf 'APK is missing or empty: %s\n' "$apk" >&2
|
|
exit 1
|
|
}
|
|
|
|
apksigner_path="$(find_apksigner)" || exit 1
|
|
if ! signature_report="$(
|
|
"$apksigner_path" verify --verbose --print-certs "$apk" 2>&1
|
|
)"; then
|
|
printf 'APK signature verification failed:\n%s\n' "$signature_report" >&2
|
|
exit 1
|
|
fi
|
|
|
|
actual_fingerprint="$(
|
|
printf '%s\n' "$signature_report" |
|
|
awk '
|
|
tolower($0) ~ /^signer #1 certificate sha-256 digest:[[:space:]]*/ {
|
|
line = $0
|
|
sub(/^[^:]*:[[:space:]]*/, "", line)
|
|
print line
|
|
exit
|
|
}
|
|
'
|
|
)"
|
|
[[ -n $actual_fingerprint ]] || {
|
|
printf 'Could not read the APK signing certificate fingerprint\n' >&2
|
|
exit 1
|
|
}
|
|
|
|
actual_fingerprint="$(normalize_fingerprint "$actual_fingerprint")"
|
|
expected_fingerprint="$(normalize_fingerprint "$expected_fingerprint")"
|
|
[[ $actual_fingerprint == "$expected_fingerprint" ]] || {
|
|
printf 'APK signing certificate mismatch: expected %s, got %s\n' \
|
|
"$expected_fingerprint" "$actual_fingerprint" >&2
|
|
exit 1
|
|
}
|
|
|
|
printf '%s\n' "$actual_fingerprint"
|