chore: bump code version (#76)

* feat: add build script

* fix: fix build script

* fix: remove `jarsigner -verify`

.github/workflows/build.yml

@@ -0,0 +1,141 @@
+name: Android build (signed AAB / debug APK)
+run-name: "Android • ${{ inputs.target }} • ${{ inputs.ref || github.ref_name }}"
+
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: "What to build"
+        type: choice
+        required: true
+        default: release_aab
+        options:
+        - release_aab
+        - debug_apk
+      ref:
+        description: "Git ref (branch/tag/sha)"
+        required: false
+        default: "master"
+
+jobs:
+  build:
+    name: "Build (${{ inputs.target }})"
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref }}
+        submodules: recursive
+        fetch-depth: 0
+
+    - name: Set up JDK
+      uses: actions/setup-java@v4
+      with:
+        distribution: temurin
+        java-version: "17"
+
+    - name: Set up Gradle
+      uses: gradle/actions/setup-gradle@v4
+
+    - name: Set up Android SDK
+      uses: android-actions/setup-android@v3
+
+    - name: Configure build
+      id: cfg
+      shell: bash
+      run: |
+        set -euo pipefail
+        case "${{ inputs.target }}" in
+          release_aab)
+            echo "gradle_task=bundleRelease" >> "$GITHUB_OUTPUT"
+            echo "kind=aab" >> "$GITHUB_OUTPUT"
+            echo "artifact_name=release-aab" >> "$GITHUB_OUTPUT"
+            echo "needs_signing=true" >> "$GITHUB_OUTPUT"
+            ;;
+          debug_apk)
+            echo "gradle_task=assembleDebug" >> "$GITHUB_OUTPUT"
+            echo "kind=apk" >> "$GITHUB_OUTPUT"
+            echo "artifact_name=debug-apk" >> "$GITHUB_OUTPUT"
+            echo "needs_signing=false" >> "$GITHUB_OUTPUT"
+            ;;
+          *)
+            echo "Unknown target: ${{ inputs.target }}" >&2
+            exit 1
+            ;;
+        esac
+
+    - name: Decode keystore from secret
+      if: ${{ steps.cfg.outputs.needs_signing == 'true' }}
+      shell: bash
+      env:
+        KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+      run: |
+        set -euo pipefail
+        if [[ -z "${KEYSTORE_B64}" ]]; then
+          echo "Missing secret ANDROID_KEYSTORE_BASE64" >&2
+          exit 1
+        fi
+        echo "${KEYSTORE_B64}" | base64 --decode > release.keystore.jks
+        echo "KEYSTORE_PATH=${PWD}/release.keystore.jks" >> "$GITHUB_ENV"
+
+    - name: Build
+      shell: bash
+      run: |
+        set -euo pipefail
+        chmod +x ./gradlew
+        ./gradlew --no-daemon --stacktrace ${{ steps.cfg.outputs.gradle_task }}
+
+    - name: Locate built artifact
+      id: locate
+      shell: bash
+      run: |
+        set -euo pipefail
+        
+        if [[ "${{ steps.cfg.outputs.kind }}" == "aab" ]]; then
+          FILE="./ui/build/outputs/bundle/release/ui-release.aab"
+        else
+          FILE="./ui/build/outputs/apk/debug/ui-debug.apk"
+        fi
+        
+        if [[ -z "${FILE}" ]]; then
+          echo "Built file not found" >&2
+          exit 1
+        fi
+        
+        echo "built_file=${FILE}" >> "$GITHUB_OUTPUT"
+
+    - name: Sign AAB
+      if: ${{ steps.cfg.outputs.needs_signing == 'true' }}
+      id: sign
+      shell: bash
+      env:
+        KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+        KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+      run: |
+        set -euo pipefail
+        
+        AAB="${{ steps.locate.outputs.built_file }}"
+        SIGNED_AAB="${AAB%.aab}-signed.aab"
+        
+        if [[ -z "${KEYSTORE_PASSWORD}" || -z "${KEY_ALIAS}" ]]; then
+          echo "Missing one of secrets: ANDROID_KEYSTORE_PASSWORD / ANDROID_KEY_ALIAS" >&2
+          exit 1
+        fi
+        
+        jarsigner \
+          -keystore "${KEYSTORE_PATH}" \
+          -storepass "${KEYSTORE_PASSWORD}" \
+          -signedjar "${SIGNED_AAB}" \
+          "${AAB}" \
+          "${KEY_ALIAS}"
+        
+        echo "final_file=${SIGNED_AAB}" >> "$GITHUB_OUTPUT"
+
+    - name: Upload artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.cfg.outputs.artifact_name }}
+        path: ${{ steps.sign.outputs.final_file || steps.locate.outputs.built_file }}
+        if-no-files-found: error

gradle.properties

@@ -1,5 +1,5 @@
-amneziawgVersionCode=9
-amneziawgVersionName=2.0.0
+amneziawgVersionCode=11
+amneziawgVersionName=2.0.1
 amneziawgPackageName=org.amnezia.awg
 
 # When configured, Gradle will run in incubating parallel mode.

tunnel/tools/libwg-go/go.mod

@@ -3,12 +3,12 @@ module github.com/amnezia-vpn/amneziawg-android
 go 1.24.4
 
 require (
-	github.com/amnezia-vpn/amneziawg-go v0.2.16
-	golang.org/x/sys v0.33.0
+	github.com/amnezia-vpn/amneziawg-go v0.2.18
+	golang.org/x/sys v0.36.0
 )
 
 require (
-	golang.org/x/crypto v0.39.0 // indirect
-	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/crypto v0.42.0 // indirect
+	golang.org/x/net v0.44.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 )

tunnel/tools/libwg-go/go.sum

@@ -1,15 +1,23 @@
 github.com/amnezia-vpn/amneziawg-go v0.2.16 h1:XY6HOq/xtqH8ZXMncRWkjFs85EKdN10NLNnw23kTpE0=
 github.com/amnezia-vpn/amneziawg-go v0.2.16/go.mod h1:nRkPpIzjCxMW8pZKXTRkpqAQVlmFJdVOGkeQSC7wbms=
+github.com/amnezia-vpn/amneziawg-go v0.2.18 h1:pUn7/P8qdGmHd6JmE3bCQXPblZs3vruWR98nLODQLJg=
+github.com/amnezia-vpn/amneziawg-go v0.2.18/go.mod h1:aMgOk9MuX0xI7b5TKAYp8pLM54RlXcOPzDvYw3YEO5A=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
 golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
 golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
 golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
+golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
 golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
 golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
 golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=