0.2.64 update

release.ps1

@@ -8,6 +8,7 @@
         index.html            landing page people are sent to
         latest.json           update manifest the app polls
         memby-<version>.apk   the build itself
+        *.apk.sha256          SHA-256 checksum for the build
         LICENSE / NOTICE      licence terms and acknowledgements
 
     Copy that folder to whatever the NAS serves, keeping the file names. Old APKs can
@@ -85,6 +86,33 @@ if (-not (Test-Path $apk)) {
     throw "No release APK found at $apk"
 }
 
+# A successful Gradle task is not sufficient evidence for a release: verify the
+# finished archive with the Android SDK tool before it can enter dist/out.
+$sdk = $env:ANDROID_HOME
+if (-not $sdk) {
+    $sdkLine = Get-Content -LiteralPath (Join-Path $root 'local.properties') |
+        Where-Object { $_ -match '^sdk\.dir=' } |
+        Select-Object -First 1
+    if ($sdkLine) {
+        $sdk = $sdkLine.Substring($sdkLine.IndexOf('=') + 1).
+            Replace('\:', ':').
+            Replace('\\', '\')
+    }
+}
+if (-not $sdk -or -not (Test-Path -LiteralPath $sdk -PathType Container)) {
+    throw 'Android SDK not found; the release signature cannot be verified.'
+}
+$buildTools = Get-ChildItem -LiteralPath (Join-Path $sdk 'build-tools') -Directory |
+    Sort-Object { [version]$_.Name } -Descending |
+    Select-Object -First 1
+if (-not $buildTools) { throw 'Android SDK Build Tools are not installed.' }
+$apkSigner = Join-Path $buildTools.FullName 'apksigner.bat'
+if (-not (Test-Path -LiteralPath $apkSigner -PathType Leaf)) {
+    throw "APK signer not found: $apkSigner"
+}
+& $apkSigner verify --verbose --print-certs $apk
+if ($LASTEXITCODE -ne 0) { throw 'APK signature verification failed' }
+
 # --- assemble the publish folder -------------------------------------------
 
 $apkName = "memby-$Version.apk"
@@ -94,6 +122,9 @@ if (Test-Path $outDir) { Remove-Item $outDir -Recurse -Force }
 New-Item -ItemType Directory -Force $outDir | Out-Null
 
 Copy-Item $apk (Join-Path $outDir $apkName)
+$sha256 = (Get-FileHash -LiteralPath $apk -Algorithm SHA256).Hash.ToLowerInvariant()
+Set-Content -LiteralPath (Join-Path $outDir "$apkName.sha256") `
+    -Value "$sha256  $apkName" -Encoding ascii
 Copy-Item (Join-Path $root 'LICENSE') (Join-Path $outDir 'LICENSE')
 $notice = (Get-Content -Raw (Join-Path $root 'NOTICE')).
               Replace('https://g.sublogue.com/admin/memby', $SourceUrl)
@@ -104,6 +135,7 @@ Set-Content -LiteralPath (Join-Path $outDir 'NOTICE') -Value $notice -Encoding u
 $manifest = [ordered]@{
     version  = $Version
     apkUrl   = $apkName
+    sha256   = $sha256
     notes    = $Notes
 } | ConvertTo-Json
 Set-Content -LiteralPath (Join-Path $outDir 'latest.json') -Value $manifest -Encoding utf8