From cceed1258df9c6394d19e4c19688264649b17bfc Mon Sep 17 00:00:00 2001
From: Jonas Herzig <me@johni0702.de>
Date: Tue, 3 Oct 2017 14:01:20 +0200
Subject: [PATCH] Apply externally generated signature to replaymod.jar if
 requested

---
 gradle/reprod/setup.sh | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/gradle/reprod/setup.sh b/gradle/reprod/setup.sh
index 63aa00dc..b8230679 100755
--- a/gradle/reprod/setup.sh
+++ b/gradle/reprod/setup.sh
@@ -99,3 +99,20 @@ popd
 popd # Back to root
 
 ./gradlew -Preprod $PROXY_SETTINGS -I gradle/reprod/init.gradle "$@"
+
+if [ "$SIGNED_JAR" == "1" ]; then
+    echo "Trying fetch signature for resulting jar file.."
+    # Note: This requires there to be one and only one jar file (ignoring source artifacts)
+    jar="build/libs/$(ls build/libs | grep -v sources)"
+    jar_hash=$(sha256val "$jar")
+    pushd gradle/reprod/tmp
+    mkdir sign_tmp
+    pushd sign_tmp
+        # Signatures are generated using:
+        # jarsigner -sigfile johni -signedjar signed.jar unsigned.jar replaymod
+        # jar xf signed.jar META-INF/MANIFEST.MF META-INF/JOHNI.SF META-INF/JOHNI.RSA
+        # tar cJf signature.tar.xz META-INF
+        wget -O - "https://www.johni0702.de/replaymod/signature/$jar_hash" | tar xJ
+        jar uMf "../../../../$jar" META-INF/
+    popd
+fi