update_verification.py: Manually add checksums for every aapt2 jar

By default, Gradle only downloads the jar for the host OS. This isn't
sufficient when folks trying to build BCR from source are running a
different OS than me.

Fixes: chenxiaolong#491

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>

gradle/update_verification.py

@@ -1,19 +1,19 @@
 #!/usr/bin/env python3
 
+import hashlib
 import io
 import os
 import subprocess
 import sys
 import tempfile
+import urllib.request
 import xml.etree.ElementTree as ET
 
 
-def add_source_exclusions(path):
-    tree = ET.parse(path)
-    root = tree.getroot()
+GOOGLE_MAVEN_REPO = 'https://dl.google.com/android/maven2'
 
-    ns = 'https://schema.gradle.org/dependency-verification'
-    ET.register_namespace('', ns)
+
+def add_source_exclusions(ns, root):
     configuration = root.find(f'{{{ns}}}configuration')
     trusted_artifacts = ET.SubElement(
         configuration, f'{{{ns}}}trusted-artifacts')
@@ -28,6 +28,54 @@ def add_source_exclusions(path):
             'regex': 'true',
         })
 
+
+def add_missing_aapt2_platforms(ns, root):
+    components = root.find(f'{{{ns}}}components')
+    aapt2 = components.find(f'{{{ns}}}component[@name="aapt2"]')
+
+    for platform in ['linux', 'osx', 'windows']:
+        group = aapt2.attrib['group']
+        name = aapt2.attrib['name']
+        version = aapt2.attrib['version']
+        filename = f'{name}-{version}-{platform}.jar'
+
+        if aapt2.find(f'{{{ns}}}artifact[@name="{filename}"]') is not None:
+            continue
+
+        path = f'{group.replace(".", "/")}/{name}/{version}/{filename}'
+        url = f'{GOOGLE_MAVEN_REPO}/{path}'
+
+        with urllib.request.urlopen(url) as r:
+            if r.status != 200:
+                raise Exception(f'{url} returned HTTP {r.status}')
+
+            digest = hashlib.file_digest(r, 'sha512')
+
+        artifact = ET.SubElement(aapt2, f'{{{ns}}}artifact',
+                                 attrib={'name': filename})
+
+        ET.SubElement(artifact, f'{{{ns}}}sha512', attrib={
+            'value': digest.hexdigest(),
+            'origin': 'Generated by Gradle',
+        })
+
+    aapt2[:] = sorted(aapt2, key=lambda child: child.attrib['name'])
+
+
+def patch_xml(path):
+    tree = ET.parse(path)
+    root = tree.getroot()
+
+    ns = 'https://schema.gradle.org/dependency-verification'
+    ET.register_namespace('', ns)
+
+    # Add exclusions to allow Android Studio to download sources.
+    add_source_exclusions(ns, root)
+
+    # Gradle only adds the aapt2 entry for the host OS. We have to manually add
+    # the checksums for the other major desktop OSs.
+    add_missing_aapt2_platforms(ns, root)
+
     # Match gradle's formatting exactly.
     ET.indent(tree, '   ')
     root.tail = '\n'
@@ -70,8 +118,7 @@ def main():
             cwd=root_dir,
         )
 
-    # Add exclusions to allow Android Studio to download sources.
-    add_source_exclusions(xml_file)
+    patch_xml(xml_file)
 
 
 if __name__ == '__main__':

gradle/verification-metadata.xml

@@ -721,6 +721,9 @@
          <artifact name="aapt2-8.1.3-10154469-linux.jar">
             <sha512 value="e8bd87050e1b3604761f201f54c463a63dbe30d09df1e58237a7646fd8646202da73eca354d6876d983e20c4b18687ddb53d2845a1f536acd7e10018ccf9f886" origin="Generated by Gradle"/>
          </artifact>
+         <artifact name="aapt2-8.1.3-10154469-osx.jar">
+            <sha512 value="b47a61ad6d1fa9a5cdd61fbdb2e748219e857b26d548ae422b5f5894db01575cb1f1c33d5a08c8eb8dba50520823ded6d45daf647fe4402848ae73e5c743b83e" origin="Generated by Gradle"/>
+         </artifact>
          <artifact name="aapt2-8.1.3-10154469-windows.jar">
             <sha512 value="230c755d8ffd075a5435249593bc818e7b6d601c3eb839efe23223ff44c7615d83690dbc100f7e16a99802cf7eec7d95df2b091a9f613e7f8bc68490a922caea" origin="Generated by Gradle"/>
          </artifact>