Node / meshtastic / Meshtastic-Android / files / scripts / verify-flatpak / verify.sh

Displaying Raw • Download

T8b949e#!/usr/bin/env bash

T8b949e# Local replica of the official Flathub packaging build (flathub/org.meshtastic.MeshtasticDesktop)

T8b949e# but flipped to true-offline mode: our flatpak-sources.json is included and

T8b949e# --share=network is removed from the build phase.

T8b949e#

T8b949e# Goal: validate flatpak-sources.json end-to-end (download + verify sha256s +

T8b949e# offline Gradle build) without round-tripping through the Flathub repo's CI.

T8b949e#

T8b949e# Requirements:

T8b949e# - Docker (Docker Desktop on macOS works for --download-only mode; full builds

T8b949e# need a Linux host because flatpak-builder uses nested bwrap which fails

T8b949e# under Docker Desktop's seccomp sandbox).

T8b949e# - ~15GB free disk for the SDK + Gradle cache + builddir.

T8b949e#

T8b949e# Usage:

T8b949e# scripts/verify-flatpak/verify.sh # full offline build (Linux only)

T8b949e# scripts/verify-flatpak/verify.sh --download-only # URLs+sha256 only (works on macOS)

T8b949e# scripts/verify-flatpak/verify.sh --arch aarch64 # cross-arch via QEMU emulation

T8b949e# scripts/verify-flatpak/verify.sh --shell # drop into builder container shell

T8b949e# scripts/verify-flatpak/verify.sh --skip-regen # reuse flatpak-sources.json; still re-clone upstream + re-rsync source

T8b949e# scripts/verify-flatpak/verify.sh --rebuild-only # tight loop: refresh overlay+manifest only, then re-run flatpak-builder

T8b949e#

T8b949e# Iteration tip: after a build fails partway, fix the overlay YAML (or the

T8b949e# Meshtastic-Android source) and re-run with --rebuild-only — Gradle regen,

T8b949e# upstream-repo fetch, and full source rsync are all skipped, so you get straight

T8b949e# back to flatpak-builder in seconds.

Tffa657set -euo pipefail

Te6edf3ARCHTff7b72=Ta5d6ff"x86_64"

Te6edf3DROP_TO_SHELLTff7b72=T79c0ff0

Te6edf3DOWNLOAD_ONLYTff7b72=T79c0ff0

Te6edf3SKIP_REGENTff7b72=T79c0ff0

Te6edf3REBUILD_ONLYTff7b72=T79c0ff0

Tff7b72while Tff7b72[Tff7b72[ Te6edf3$# -gt T79c0ff0 Tff7b72]Tff7b72]Tb4b4b4; Tff7b72do

Tff7b72case Ta5d6ff"Te6edf3$1Ta5d6ff" Tff7b72in

--archTff7b72) Te6edf3ARCHTff7b72=Ta5d6ff"Te6edf3$2Ta5d6ff"Tb4b4b4; Tffa657shift T79c0ff2 Tb4b4b4;Tb4b4b4;

--shellTff7b72) Te6edf3DROP_TO_SHELLTff7b72=T79c0ff1Tb4b4b4; Tffa657shift Tb4b4b4;Tb4b4b4;

--download-onlyTff7b72) Te6edf3DOWNLOAD_ONLYTff7b72=T79c0ff1Tb4b4b4; Tffa657shift Tb4b4b4;Tb4b4b4;

--skip-regenTff7b72) Te6edf3SKIP_REGENTff7b72=T79c0ff1Tb4b4b4; Tffa657shift Tb4b4b4;Tb4b4b4;

--rebuild-onlyTff7b72) Te6edf3REBUILD_ONLYTff7b72=T79c0ff1Tb4b4b4; Te6edf3SKIP_REGENTff7b72=T79c0ff1Tb4b4b4; Tffa657shift Tb4b4b4;Tb4b4b4;

-hTb4b4b4|--helpTff7b72) sed -n Ta5d6ff'2,28p' Ta5d6ff"Te6edf3$0Ta5d6ff"Tb4b4b4; Tffa657exit T79c0ff0 Tb4b4b4;Tb4b4b4;

*Tff7b72) Tffa657echo Ta5d6ff"Ta5d6ffUnknown arg: Te6edf3$1Ta5d6ff" >Tb4b4b4&T79c0ff2Tb4b4b4; Tffa657exit T79c0ff2 Tb4b4b4;Tb4b4b4;

Tff7b72esac

Tff7b72done

Tff7b72case Ta5d6ff"Te6edf3$ARCHTa5d6ff" Tff7b72in

x86_64Tff7b72) Te6edf3DOCKER_PLATFORMTff7b72=Ta5d6ff"linux/amd64" Tb4b4b4;Tb4b4b4;

aarch64Tff7b72) Te6edf3DOCKER_PLATFORMTff7b72=Ta5d6ff"linux/arm64" Tb4b4b4;Tb4b4b4;

*Tff7b72) Tffa657echo Ta5d6ff"Ta5d6ffUnsupported --arch: Te6edf3$ARCHTa5d6ff (use x86_64 or aarch64)Ta5d6ff" >Tb4b4b4&T79c0ff2Tb4b4b4; Tffa657exit T79c0ff2 Tb4b4b4;Tb4b4b4;

Tff7b72esac

Te6edf3REPO_ROOTTff7b72=Ta5d6ff"Tff7b72$(git -C Ta5d6ff"Tff7b72$(dirname Ta5d6ff"Te6edf3$0Ta5d6ff"Tff7b72)Ta5d6ff" rev-parse --show-toplevelTff7b72)Ta5d6ff"

Te6edf3WORKTff7b72=Ta5d6ff"Te6edf3$REPO_ROOTTa5d6ff/build/flatpak-verifyTa5d6ff"

Te6edf3OVERLAYTff7b72=Ta5d6ff"Te6edf3$REPO_ROOTTa5d6ff/scripts/verify-flatpak/desktop-offline.yamlTa5d6ff"

Te6edf3SOURCES_JSONTff7b72=Ta5d6ff"Te6edf3$REPO_ROOTTa5d6ff/flatpak-sources.jsonTa5d6ff"

Te6edf3GRADLE_HOME_ISOLATEDTff7b72=Ta5d6ff"Te6edf3$REPO_ROOTTa5d6ff/build/flatpak-gradle-homeTa5d6ff"

Te6edf3FLATHUB_REPOTff7b72=Ta5d6ff"https://github.com/flathub/org.meshtastic.MeshtasticDesktop.git"

T8b949e# bilelmoussaoui's image is what the upstream flatpak CI uses; freedesktop-24.08 is the latest

T8b949e# tag available. The 25.08 runtime declared in the manifest is pulled from

T8b949e# flathub at build time inside the container.

Te6edf3BUILDER_IMAGETff7b72=Ta5d6ff"bilelmoussaoui/flatpak-github-actions:freedesktop-24.08"

stepTff7b72(Tff7b72) Tff7b72{ Tffa657printf Ta5d6ff'\n\033[1;34m==> %s\033[0m\n' Ta5d6ff"Te6edf3$*Ta5d6ff"Tb4b4b4; Tff7b72}

failTff7b72(Tff7b72) Tff7b72{ Tffa657printf Ta5d6ff'\033[1;31m!! %s\033[0m\n' Ta5d6ff"Te6edf3$*Ta5d6ff" >Tb4b4b4&T79c0ff2Tb4b4b4; Tffa657exit T79c0ff1Tb4b4b4; Tff7b72}

Tffa657command -v docker >/dev/null T79c0ff2>Tb4b4b4&T79c0ff1 Tff7b72|| fail Ta5d6ff"docker is required; install Docker Desktop or equivalent."

T8b949e# Refuse full-build mode on macOS — nested bwrap fails under Docker Desktop's

T8b949e# seccomp and the user will spend 20 minutes finding out. They can override

T8b949e# with --download-only.

Tff7b72if Tff7b72[Tff7b72[ Ta5d6ff"Tff7b72$(uname -sTff7b72)Ta5d6ff" Tff7b72=Tff7b72= Ta5d6ff"Darwin" Tff7b72&& Te6edf3$DOWNLOAD_ONLY -eq T79c0ff0 Tff7b72&& Te6edf3$DROP_TO_SHELL -eq T79c0ff0 Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

fail Ta5d6ff"Full flatpak-builder runs require a Linux host (nested bwrap fails under Docker Desktop on macOS). Re-run with --download-only, or use --shell to poke around manually."

Tff7b72fi

Tff7b72if Tff7b72[Tff7b72[ Te6edf3$SKIP_REGEN -eq T79c0ff0 Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

step Ta5d6ff"Regenerating flatpak-sources.json via isolated Gradle home"

rm -rf Ta5d6ff"Te6edf3$GRADLE_HOME_ISOLATEDTa5d6ff"

T8b949e# The settings plugin (org.meshtastic.flatpak.sources.settings) captures URLs from

T8b949e# build start — no init script or -I flag needed.

Tff7b72(Tffa657cd Ta5d6ff"Te6edf3$REPO_ROOTTa5d6ff" Tff7b72&& ./gradlew --no-build-cache -Dorg.gradle.isolated-projectsTff7b72=Tffa657false --no-configuration-cache -Pmeshtastic.flatpakSourcesTff7b72=Tffa657true Tffea00\

-Dgradle.user.homeTff7b72=Ta5d6ff"Te6edf3$GRADLE_HOME_ISOLATEDTa5d6ff" Tffea00\

:desktopApp:packageUberJarForCurrentOS :captureFlatpakSourcesTff7b72)

cp Ta5d6ff"Te6edf3$REPO_ROOTTa5d6ff/build/flatpak-ops-sources.jsonTa5d6ff" Ta5d6ff"Te6edf3$SOURCES_JSONTa5d6ff"

Tff7b72elif Tff7b72[Tff7b72[ ! -f Ta5d6ff"Te6edf3$SOURCES_JSONTa5d6ff" Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

fail Ta5d6ff"Ta5d6ff--skip-regen specified but Te6edf3$SOURCES_JSONTa5d6ff does not exist.Ta5d6ff"

Tff7b72fi

Tff7b72if Tff7b72[Tff7b72[ Te6edf3$REBUILD_ONLY -eq T79c0ff1 Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

Tff7b72[Tff7b72[ -d Ta5d6ff"Te6edf3$WORKTa5d6ff/org.meshtastic.MeshtasticDesktop/.gitTa5d6ff" Tff7b72]Tff7b72] Tff7b72|| Tffea00\

fail Ta5d6ff"Ta5d6ff--rebuild-only needs an existing workspace at Te6edf3$WORKTa5d6ff; run without it once first.Ta5d6ff"

Tff7b72else

step Ta5d6ff"Ta5d6ffPreparing workspace at Te6edf3$WORKTa5d6ff"

mkdir -p Ta5d6ff"Te6edf3$WORKTa5d6ff"

Tff7b72if Tff7b72[Tff7b72[ ! -d Ta5d6ff"Te6edf3$WORKTa5d6ff/org.meshtastic.MeshtasticDesktop/.gitTa5d6ff" Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

git clone --depth T79c0ff1 --recurse-submodules Ta5d6ff"Te6edf3$FLATHUB_REPOTa5d6ff" Ta5d6ff"Te6edf3$WORKTa5d6ff/org.meshtastic.MeshtasticDesktopTa5d6ff"

Tff7b72else

git -C Ta5d6ff"Te6edf3$WORKTa5d6ff/org.meshtastic.MeshtasticDesktopTa5d6ff" fetch --depth T79c0ff1 origin master

git -C Ta5d6ff"Te6edf3$WORKTa5d6ff/org.meshtastic.MeshtasticDesktopTa5d6ff" reset --hard origin/master

git -C Ta5d6ff"Te6edf3$WORKTa5d6ff/org.meshtastic.MeshtasticDesktopTa5d6ff" submodule update --init --recursive --depth T79c0ff1

Tff7b72fi

Tff7b72fi

T8b949e# Always refreshed — these are the iteration knobs:

T8b949e# overlay yaml = the manifest we're testing

T8b949e# flatpak-sources.json = the artifact we're validating

step Ta5d6ff"Wiring overlay manifest + our flatpak-sources.json"

cp Ta5d6ff"Te6edf3$OVERLAYTa5d6ff" Ta5d6ff"Te6edf3$WORKTa5d6ff/org.meshtastic.MeshtasticDesktop/org.meshtastic.MeshtasticDesktop.yamlTa5d6ff"

cp Ta5d6ff"Te6edf3$SOURCES_JSONTa5d6ff" Ta5d6ff"Te6edf3$WORKTa5d6ff/org.meshtastic.MeshtasticDesktop/flatpak-sources.jsonTa5d6ff"

Tff7b72if Tff7b72[Tff7b72[ Te6edf3$REBUILD_ONLY -eq T79c0ff0 Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

step Ta5d6ff"Snapshotting Meshtastic-Android checkout (excluding build/, .gradle/)"

rsync -a --delete Tffea00\

--excludeTff7b72=Ta5d6ff'/build/' Tffea00\

--excludeTff7b72=Ta5d6ff'/.gradle/' Tffea00\

--excludeTff7b72=Ta5d6ff'*/build/' Tffea00\

--excludeTff7b72=Ta5d6ff'*/.gradle/' Tffea00\

--excludeTff7b72=Ta5d6ff'/.idea/' Tffea00\

--excludeTff7b72=Ta5d6ff'/local.properties' Tffea00\

Ta5d6ff"Te6edf3$REPO_ROOTTa5d6ff/Ta5d6ff" Ta5d6ff"Te6edf3$WORKTa5d6ff/org.meshtastic.MeshtasticDesktop/meshtastic-android/Ta5d6ff"

Tff7b72fi

step Ta5d6ff"Ta5d6ffPulling builder image: Te6edf3$BUILDER_IMAGETa5d6ff (Te6edf3$DOCKER_PLATFORMTa5d6ff)Ta5d6ff"

docker pull --platform Ta5d6ff"Te6edf3$DOCKER_PLATFORMTa5d6ff" Ta5d6ff"Te6edf3$BUILDER_IMAGETa5d6ff" >/dev/null

Te6edf3DOCKER_RUN_ARGSTff7b72=Tff7b72(

--rm

--privileged

-v Ta5d6ff"Te6edf3$WORKTa5d6ff/org.meshtastic.MeshtasticDesktop:/workTa5d6ff"

-w /work

--platform Ta5d6ff"Te6edf3$DOCKER_PLATFORMTa5d6ff"

--security-opt Te6edf3seccompTff7b72=unconfined

Tff7b72)

Tff7b72if Tff7b72[Tff7b72[ Te6edf3$DROP_TO_SHELL -eq T79c0ff1 Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

step Ta5d6ff"Dropping into builder shell — flatpak-builder is on PATH"

Tffa657exec docker run -it Ta5d6ff"Tffd700${Te6edf3DOCKER_RUN_ARGSTb4b4b4[@]Tffd700}Ta5d6ff" Ta5d6ff"Te6edf3$BUILDER_IMAGETa5d6ff" bash

Tff7b72fi

T8b949e# Build flatpak-builder invocation. --download-only mode skips the bwrap-based

T8b949e# build phase, which is the part that fails under Docker Desktop on macOS.

Tff7b72if Tff7b72[Tff7b72[ Te6edf3$DOWNLOAD_ONLY -eq T79c0ff1 Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

Te6edf3BUILDER_EXTRA_FLAGSTff7b72=Ta5d6ff"--download-only"

Te6edf3SUCCESS_MSGTff7b72=Ta5d6ff"All sources downloaded and sha256-verified successfully (URLs + hashes OK; Gradle build NOT exercised)"

Tff7b72else

Te6edf3BUILDER_EXTRA_FLAGSTff7b72=Ta5d6ff""

Te6edf3SUCCESS_MSGTff7b72=Ta5d6ff"Full offline build succeeded — flatpak-sources.json is complete and self-sufficient"

Tff7b72fi

step Ta5d6ff"Ta5d6ffRunning flatpak-builder (arch=Te6edf3$ARCHTa5d6ff, mode=Tff7b72$(Tff7b72[Tff7b72[ Te6edf3$DOWNLOAD_ONLY -eq T79c0ff1 Tff7b72]Tff7b72] Tff7b72&& Tffa657echo download-only Tff7b72|| Tffa657echo full-buildTff7b72)Ta5d6ff)Ta5d6ff"

docker run Ta5d6ff"Tffd700${Te6edf3DOCKER_RUN_ARGSTb4b4b4[@]Tffd700}Ta5d6ff" Ta5d6ff"Te6edf3$BUILDER_IMAGETa5d6ff" bash -c Ta5d6ff"Ta5d6ffset -e

flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

flatpak-builder --user --repo=repo --install-deps-from=flathub --force-clean \

--disable-rofiles-fuse Te6edf3$BUILDER_EXTRA_FLAGSTa5d6ff \

builddir org.meshtastic.MeshtasticDesktop.yaml

echo

echo '=== Te6edf3$SUCCESS_MSGTa5d6ff ==='

Ta5d6ff"