From 5ae2deb7048fec246cde7e97ac4cf640dbf7d0e9 Mon Sep 17 00:00:00 2001
From: f321x <f@f321x.com>
Date: Wed, 25 Jun 2025 13:50:48 +0200
Subject: [PATCH] android: shasum pin barcode scanner

pins the barcode scanner aar used in the android build and its 2
dependencies to a sha256 hash using a script `fetch_barcode_scanner.sh`
which is called in the process of building the apk by `make_apk.sh`.
It fetches the 3 aar files if not already existing, puts them in
`/contrib/android/aars` and verifies their shasum against the hardcoded
hashes in `fetch_barcode_scanner.sh`.
---
 .gitignore                               |  1 +
 contrib/android/buildozer_qml.spec       | 13 +++---
 contrib/android/fetch_barcode_scanner.sh | 50 ++++++++++++++++++++++++
 contrib/android/make_apk.sh              |  4 ++
 4 files changed, 63 insertions(+), 5 deletions(-)
 create mode 100755 contrib/android/fetch_barcode_scanner.sh

diff --git a/.gitignore b/.gitignore
index 9f013f3c7..0cb917442 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,6 +39,7 @@ contrib/build-linux/appimage/.cache/
 contrib/osx/.cache/
 contrib/osx/build-venv/
 contrib/android/android_debug.keystore
+contrib/android/.cache/
 contrib/secp256k1/
 contrib/zbar/
 contrib/libusb/
diff --git a/contrib/android/buildozer_qml.spec b/contrib/android/buildozer_qml.spec
index 59da3d80e..a0e4e6709 100644
--- a/contrib/android/buildozer_qml.spec
+++ b/contrib/android/buildozer_qml.spec
@@ -156,17 +156,20 @@ android.accept_sdk_license = True
 android.add_jars = .buildozer/android/platform/*/build/libs_collections/Electrum/jar/*.jar
 
 
+android.add_aars =
+    contrib/android/.cache/aars/BarcodeScannerView.aar,
+    contrib/android/.cache/aars/CameraView.aar,
+    contrib/android/.cache/aars/zxing-cpp.aar
+
+
 # (list) List of Java files to add to the android project (can be java or a
 # directory containing the files)
 android.add_src = electrum/gui/qml/java_classes/
 
-# (list) Gradle repositories to add {can be necessary for some android.gradle_dependencies}
-# e.g. android.gradle_repositories = maven { url "https://repo.spring.io/release" }
-android.add_gradle_repositories = maven { url "https://jitpack.io" }
-
+# kotlin-stdlib is required for zxing-cpp (BarcodeScannerView)
 android.gradle_dependencies =
     com.android.support:support-compat:28.0.0,
-    com.github.markusfisch:BarcodeScannerView:1.6.0
+    org.jetbrains.kotlin:kotlin-stdlib:1.8.22
 
 android.add_activities = org.electrum.qr.SimpleScannerActivity
 
diff --git a/contrib/android/fetch_barcode_scanner.sh b/contrib/android/fetch_barcode_scanner.sh
new file mode 100755
index 000000000..ce6056aec
--- /dev/null
+++ b/contrib/android/fetch_barcode_scanner.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+# script to fetch and pin https://github.com/markusfisch/BarcodeScannerView and its dependencies,
+# https://github.com/markusfisch/CameraView/ and https://github.com/markusfisch/zxing-cpp
+# which are being used as barcode scanner in the Android app.
+
+# To bump the version of BarcodeScannerView, get the newest version tag from the github repo,
+# then get the required dependencies from
+# https://jitpack.io/com/github/markusfisch/BarcodeScannerView/**NEWEST_VERSION**/BarcodeScannerView-**NEWEST_VERSION**.pom
+# then fetch the aars from jitpack and update the versions and sha256s below. Also update kotlin-stdlib
+# in buildozer_qml.spec
+
+BARCODE_SCANNER_VIEW_VERSION="1.6.0"
+BARCODE_SCANNER_VIEW_AAR_SHA256="2be6c9a5ab86f7198683af4a6c0e5acd3e8fe6a02df2d12c3b716dc422537789"
+
+CAMERA_VIEW_VERSION="1.9.2"
+CAMERA_VIEW_AAR_SHA256="3c9be35d29b84637d2a2b0e0e7253bc5a35408fafb26c5cb7225aeb7326e2be4"
+
+ZXING_CPP_VERSION="v2.2.0.1"
+ZXING_CPP_AAR_SHA256="7991381f181ff16555c4ac9c5d83e6a0d3a7da896efb8c3807897305ca33b957"
+
+DOWNLOAD_REPOSITORY_ROOT="https://jitpack.io/com/github/markusfisch"
+
+set -e
+
+CONTRIB_ANDROID="$(dirname "$(readlink -e "$0")")"
+CONTRIB="$CONTRIB_ANDROID"/..
+CACHEDIR="$CONTRIB_ANDROID/.cache"
+
+. "$CONTRIB"/build_tools_util.sh
+
+# check if $CACHEDIR/aars exists, create it if not
+if [ ! -d "$CACHEDIR/aars" ]; then
+    mkdir -p "$CACHEDIR/aars"
+fi
+
+info "Fetching BarcodeScannerView..."
+download_if_not_exist "$CACHEDIR/aars/BarcodeScannerView.aar" \
+    "${DOWNLOAD_REPOSITORY_ROOT}/BarcodeScannerView/${BARCODE_SCANNER_VIEW_VERSION}/BarcodeScannerView-${BARCODE_SCANNER_VIEW_VERSION}.aar"
+verify_hash "$CACHEDIR/aars/BarcodeScannerView.aar" "$BARCODE_SCANNER_VIEW_AAR_SHA256"
+
+info "Fetching CameraView..."
+download_if_not_exist "$CACHEDIR/aars/CameraView.aar" \
+    "${DOWNLOAD_REPOSITORY_ROOT}/CameraView/${CAMERA_VIEW_VERSION}/CameraView-${CAMERA_VIEW_VERSION}.aar"
+verify_hash "$CACHEDIR/aars/CameraView.aar" "$CAMERA_VIEW_AAR_SHA256"
+
+info "Fetching zxing-cpp..."
+download_if_not_exist "$CACHEDIR/aars/zxing-cpp.aar" \
+    "${DOWNLOAD_REPOSITORY_ROOT}/zxing-cpp/${ZXING_CPP_VERSION}/zxing-cpp-${ZXING_CPP_VERSION}.aar"
+verify_hash "$CACHEDIR/aars/zxing-cpp.aar" "$ZXING_CPP_AAR_SHA256"
diff --git a/contrib/android/make_apk.sh b/contrib/android/make_apk.sh
index 0eb245c91..11b5ad89c 100755
--- a/contrib/android/make_apk.sh
+++ b/contrib/android/make_apk.sh
@@ -27,6 +27,10 @@ info "preparing electrum-locale."
     rm -r "$PROJECT_ROOT/electrum/locale/locale"/*/electrum.po
 )
 
+# fetch barcode scanner aars
+info "fetching barcode scanner aars."
+"$CONTRIB_ANDROID"/fetch_barcode_scanner.sh || fail "fetch_barcode_scanner.sh failed"
+
 pushd "$CONTRIB_ANDROID"
 
 info "apk building phase starts."