Add APK release flow with R2 redirects and updater support

scripts/apk/verify-release.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<USAGE
+Usage:
+  scripts/apk/verify-release.sh [--base-url https://dewemoji.com/downloads]
+USAGE
+}
+
+base_url="https://dewemoji.com/downloads"
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --base-url) base_url="$2"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "error: unknown argument '$1'" >&2; usage; exit 1 ;;
+  esac
+done
+
+version_url="${base_url%/}/version.json"
+apk_url="${base_url%/}/dewemoji-latest.apk"
+
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "${tmp_dir}"' EXIT
+
+version_file="${tmp_dir}/version.json"
+apk_file="${tmp_dir}/dewemoji-latest.apk"
+
+echo "== Fetch version metadata =="
+curl -fsSL "${version_url}" -o "${version_file}"
+python3 - <<PY
+import json
+from pathlib import Path
+
+obj = json.loads(Path("${version_file}").read_text(encoding="utf-8"))
+required = ["appId", "channel", "versionName", "versionCode", "apkUrl", "sha256", "publishedAt"]
+missing = [k for k in required if k not in obj]
+if missing:
+    raise SystemExit(f"error: missing fields in version.json: {', '.join(missing)}")
+
+print(f"versionName={obj['versionName']}")
+print(f"versionCode={obj['versionCode']}")
+print(f"apkUrl={obj['apkUrl']}")
+print(f"sha256={obj['sha256']}")
+PY
+
+echo "== Download latest APK =="
+curl -fL "${apk_url}" -o "${apk_file}"
+
+local_sha="$(shasum -a 256 "${apk_file}" | awk '{print $1}')"
+expected_sha="$(python3 - <<PY
+import json
+from pathlib import Path
+obj = json.loads(Path("${version_file}").read_text(encoding="utf-8"))
+print(obj["sha256"])
+PY
+)"
+
+echo "local_sha=${local_sha}"
+echo "expected_sha=${expected_sha}"
+
+if [[ "${local_sha}" != "${expected_sha}" ]]; then
+  echo "error: checksum mismatch" >&2
+  exit 1
+fi
+
+echo "OK: release metadata and APK checksum are consistent"