From b621a8ebd00605c951cf0f1f16a6a29f9a2dfd0f Mon Sep 17 00:00:00 2001
From: Harsh Shandilya <me@msfjarvis.dev>
Date: Sun, 11 Apr 2021 12:46:11 +0530
Subject: [PATCH] scripts: add secrets and snapshot helpers

Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
---
 scripts/deploy-snapshot.sh | 13 +++++++++++++
 scripts/encrypt-secret.sh  | 16 ++++++++++++++++
 scripts/signing-cleanup.sh |  9 +++++++++
 scripts/signing-setup.sh   | 17 +++++++++++++++++
 4 files changed, 55 insertions(+)
 create mode 100755 scripts/deploy-snapshot.sh
 create mode 100755 scripts/encrypt-secret.sh
 create mode 100755 scripts/signing-cleanup.sh
 create mode 100755 scripts/signing-setup.sh

diff --git a/scripts/deploy-snapshot.sh b/scripts/deploy-snapshot.sh
new file mode 100755
index 00000000..69167fc7
--- /dev/null
+++ b/scripts/deploy-snapshot.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+export SSHDIR="$HOME/.ssh"
+mkdir -p "$SSHDIR"
+echo "$ACTIONS_DEPLOY_KEY" > "$SSHDIR/key"
+chmod 600 "$SSHDIR/key"
+export SERVER_DEPLOY_STRING="$SSH_USERNAME@$SERVER_ADDRESS:$SERVER_DESTINATION"
+mkdir -p "$GITHUB_WORKSPACE/Claw"
+cp -v ./app/build/outputs/apk/release/*.apk "$GITHUB_WORKSPACE/Claw/"
+cd "$GITHUB_WORKSPACE/Claw"
+rsync -ahvcr --omit-dir-times --progress --delete --no-o --no-g -e "ssh -i $SSHDIR/key -o StrictHostKeyChecking=no -p $SSH_PORT" . "$SERVER_DEPLOY_STRING"
diff --git a/scripts/encrypt-secret.sh b/scripts/encrypt-secret.sh
new file mode 100755
index 00000000..abbcf559
--- /dev/null
+++ b/scripts/encrypt-secret.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Simple script that uses OpenSSL to encrypt a provided file with a provided key, and writes the result
+# to the provided path. Yes it's very needy.
+
+INPUT_FILE="${1:-}"
+OUTPUT_FILE="${2:-}"
+ENCRYPT_KEY="${3:-}"
+
+if [[ -n "$ENCRYPT_KEY" && -n "$INPUT_FILE" && -n "$OUTPUT_FILE" ]]; then
+    openssl enc -aes-256-cbc -md sha256 -pbkdf2 -e -in "${INPUT_FILE}" -out "${OUTPUT_FILE}" -k "${ENCRYPT_KEY}"
+else
+    echo "Usage: ./encrypt-secret.sh <input file> <output file> <encryption key>"
+fi
diff --git a/scripts/signing-cleanup.sh b/scripts/signing-cleanup.sh
new file mode 100755
index 00000000..3351456a
--- /dev/null
+++ b/scripts/signing-cleanup.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Delete Release key
+rm -f keystore.jks
+
+# Delete signing config
+rm -f keystore.properties
diff --git a/scripts/signing-setup.sh b/scripts/signing-setup.sh
new file mode 100755
index 00000000..64de677f
--- /dev/null
+++ b/scripts/signing-setup.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ENCRYPT_KEY="${1:-}"
+
+declare -A SECRETS
+SECRETS[secrets/keystore.cipher]=keystore.jks
+SECRETS[secrets/props.cipher]=keystore.properties
+
+if [[ -n "$ENCRYPT_KEY" ]]; then
+    for src in "${!SECRETS[@]}"; do
+      openssl enc -aes-256-cbc -md sha256 -pbkdf2 -d -in "${src}" -out "${SECRETS[${src}]}" -k "${ENCRYPT_KEY}"
+    done
+else
+    echo "Usage: ./signing-setup.sh <encryption key>"
+fi