app: enable bundle signing

Signed-off-by: Varun Patil <[email protected]>

.github/workflows/release.yaml

@@ -22,12 +22,23 @@ jobs:
         with:
           node-version: 20.x
 
+      - name: Set up php
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: 8.2
+          extensions: mbstring, iconv, fileinfo, intl, mysql, pdo_mysql
+          coverage: none
+
       - name: Build
         run: |
           make dev-setup
           make patch-external
           make build-js-production
-          ./scripts/bundle.sh
+
+      - name: Bundle app
+        run: bash scripts/bundle.sh
+        env:
+          APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Upload app tarball to release
         uses: svenstaro/upload-release-action@v2

scripts/bundle.sh

@@ -1,20 +1,44 @@
 #!/bin/bash
 
+# Fail on error
+set -e
+
+# Source directory
 src=`pwd`
 
+# Copy source files to temp
 rm -rf /tmp/memories
 mkdir -p /tmp/memories
 cp -R appinfo l10n img js lib templates COPYING README.md CHANGELOG.md exiftest* composer* /tmp/memories
+sudo chown -R www-data:www-data /tmp/memories
 
-cd /tmp
+# Cleanup
+pushd /tmp
 rm -rf memories.tar.gz
 
-cd memories
+# Get exiftool and other binaries
+pushd memories
 sh "$src/scripts/get-bin-ext.sh"
-cd ..
+popd
+
+# Get certificate and key
+wget -O memories.crt https://raw.githubusercontent.com/nextcloud/app-certificate-requests/master/memories/memories.crt
+echo -e "$APP_PRIVATE_KEY" > memories.key
+
+# Sign app
+git clone --recurse-submodules --depth 1 --branch v28.0.5 https://github.com/nextcloud/server nextcloud
+php nextcloud/occ integrity:sign-app \
+    --privateKey=/tmp/memories.key \
+    --certificate=/tmp/memories.crt \
+    --path=/tmp/memories
+
+rm -rf nextcloud
+rm -rf memories.crt memories.key
 
+# Bundle app
 tar --no-same-owner -p -zcf memories.tar.gz memories/
-rm -rf memories
+rm -rf memories/
 
-cd $src
+# Move bundle to source
+popd
 mv /tmp/memories.tar.gz .