Android app (TWA) in android/, built with podman; serve assetlinks.json for it

android/build.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Builds the signed release APK into out/ with podman (no local JDK or Android SDK needed).
+#
+# The signing key lives outside the repo, in $KEYSTORE_DIR (default ~/.config/simpleadmin-web/android),
+# and is created on the first run. Back it up: an APK signed with a different key can't update an
+# installed one, and the panel's assetlinks.json names the key's fingerprint.
+set -euo pipefail
+
+here="$(cd "$(dirname "$0")" && pwd)"
+keydir="${KEYSTORE_DIR:-$HOME/.config/simpleadmin-web/android}"
+image=simpleadmin-web-android-build
+
+podman build -q -t "$image" "$here" >/dev/null
+
+mkdir -p "$keydir"
+chmod 700 "$keydir"
+if [[ ! -f "$keydir/release.jks" ]]; then
+    echo "Creating a signing key in $keydir"
+    (umask 077 && openssl rand -hex 24 >"$keydir/password")
+    podman run --rm -v "$keydir":/keystore:Z "$image" keytool -genkeypair -noprompt \
+        -keystore /keystore/release.jks -storetype PKCS12 -storepass "$(cat "$keydir/password")" \
+        -alias release -keyalg RSA -keysize 4096 -validity 10000 -dname "CN=zio.sh"
+fi
+
+podman run --rm \
+    -v "$here":/src:Z \
+    -v "$keydir":/keystore:ro,Z \
+    -v simpleadmin-web-android-gradle:/root/.gradle \
+    -e KEYSTORE_PASSWORD="$(cat "$keydir/password")" \
+    "$image" gradle --no-daemon -q assembleRelease
+
+mkdir -p "$here/out"
+cp "$here/app/build/outputs/apk/release/app-release.apk" "$here/out/simpleadmin-web.apk"
+echo "APK: $here/out/simpleadmin-web.apk"
+echo "Signing key SHA-256 (for SAW_ANDROID_CERT_SHA256):"
+podman run --rm -v "$keydir":/keystore:ro,Z "$image" keytool -list -keystore /keystore/release.jks \
+    -storepass "$(cat "$keydir/password")" -alias release | sed -n 's/.*SHA-256): //p'