Repack and zipalign APKs only with compressed libs and v1 sig

Signed-off-by: Ilya Danilkin <nezorflame@gmail.com>

scripts/build_gapps.sh

@@ -66,7 +66,7 @@ ZIPCOMPRESSIONLEVEL="0" # Store only the files in the zip without compressing th
 . "$SCRIPTS/inc.sourceshelper.sh"
 
 # Check tools
-checktools aapt coreutils java jarsigner unzip zip tar realpath zipalign
+checktools aapt apksigner coreutils java jarsigner unzip zip tar realpath zipalign
 
 case "$API" in
 19) PLATFORM="4.4" ;;

scripts/inc.buildhelper.sh

@@ -326,16 +326,19 @@ buildapk() {
   fi
 
   install -D "$sourceapk" "$targetapk"
-  if [ "$API" -lt "23" ] && (unzip -qqql "$targetapk" | grep -q "lib/"); then #only if pre-Marshmallow and the lib folder exists
-    unzip -Z -1 "$targetapk" | grep "lib/" | grep -v "/crazy." | xargs zip -q -d "$targetapk" #delete all libs, except crazy-linked
-  elif [ "$API" -ge "23" ] && (unzip -qqql "$targetapk" | grep -q "lib/"); then #Marshmallow needs (if any exist) libs to be stored without compression within the APK
-    unzip -qqq -o "$targetapk" -d "$targetdir" "lib/*"
-    zip -q -d "$targetapk" "lib/*" #delete all libs
-    CURRENTPWD="$(realpath .)" #if we ever switch to bash, make this a pushd-popd trick
-    cd "$targetdir"
-    zip -q -r -D -Z store -b "$targetdir" "$targetapk" "lib/" #no parameter for output and mode, we are in 'add and update existing' mode which is default. Lib files have to be stored without compression.
-    cd "$CURRENTPWD"
-    rm -rf "$targetdir/lib/"
+
+  if (unzip -v "$targetapk" | grep "lib/" | grep -qv "Stored"); then #check if there are compressed libs present
+    if [ "$API" -lt "23" ]; then #only if pre-Marshmallow
+      unzip -Z -1 "$targetapk" | grep "lib/" | grep -v "/crazy." | xargs zip -q -d "$targetapk" #delete all libs, except crazy-linked
+    else #Marshmallow and above needs libs to be stored without compression within the APK
+      unzip -qqq -o "$targetapk" -d "$targetdir" "lib/*"
+      zip -q -d "$targetapk" "lib/*" #delete all libs
+      CURRENTPWD="$(realpath .)" #if we ever switch to bash, make this a pushd-popd trick
+      cd "$targetdir"
+      zip -q -r -D -Z store -b "$targetdir" "$targetapk" "lib/" #no parameter for output and mode, we are in 'add and update existing' mode which is default. Lib files have to be stored without compression.
+      cd "$CURRENTPWD"
+      rm -rf "$targetdir/lib/"
+    fi
   fi
 }
 

scripts/inc.packagetarget.sh

@@ -11,7 +11,13 @@
 #	GNU General Public License for more details.
 #
 alignbuild() {
+  echo "Zipaligning APKs..."
   for f in $(find "$build" -name '*.apk'); do
+    # skip zipaligning for APKs signed with apksigner, because zipalign strips its signature
+    # see https://developer.android.com/studio/command-line/zipalign
+    if timeout 1m apksigner verify --verbose --print-certs "$f" 2>/dev/null | grep -q "(JAR signing): false"; then
+      continue
+    fi
     mv "$f" "$f.orig"
     zopfli=""
     if [ -n "$ZIPALIGNRECOMPRESS" ]; then

scripts/inc.tools.sh

@@ -24,8 +24,8 @@ checktools() {
           echo 'Coreutils is required for install, basename, readlink, md5sum and other utilities, but is not installed or found in sh $PATH.';;
         jarsigner|keytool)
           echo 'JDK is required for jarsigner and keytools utilities, but is not installed or found in sh $PATH.';;
-        aapt|zipalign)
-          echo 'Android SDK is required for aapt and zipalign utilities, but is not installed or found in sh $PATH.';;
+        aapt|apksigner|zipalign)
+          echo 'Android SDK is required for aapt, apksigner and zipalign utilities, but is not installed or found in sh $PATH.';;
         *)
           echo "$command is required but is not installed.";;
       esac

show_apksignature.sh

@@ -20,12 +20,13 @@ SCRIPTS="$TOP/scripts"
 
 # shellcheck source=scripts/inc.tools.sh
 . "$SCRIPTS/inc.tools.sh"
-checktools base64 coreutils unzip
+checktools apksigner base64 coreutils unzip
 
 for argument in "$@"; do
   file="$(readlink -f "$argument")"
   if [ -f "$file" ]; then
-    echo "signature of $file:"
+    apksigner verify --verbose --print-certs "$file"
+    echo "Signature of $file:"
     RSAFILE="META-INF/CERT"
     unzip -l "$file" | grep -q "$RSAFILE.RSA"
     if [ "$?" != "0" ]; then