|
1 | 1 | #!/usr/bin/env bash |
2 | | -# Fetch a pinned Mozilla pdf.js prebuilt distribution into ./dist for deployment. |
3 | | -# pdf.js is pure JS (Apache-2.0) -> no 32/64-bit concern; the same dist serves every ABI. |
4 | | -# Run at rootfs-build time on a networked host; the extracted dist is then deployed to |
5 | | -# /library/www/html/pdfjs (see the iiab-android setup script). |
| 2 | +# Fetch pinned Mozilla pdf.js prebuilt distributions into ./dist and emit a manifest the |
| 3 | +# app reads to pick a viewer per device. pdf.js is pure JS (Apache-2.0) -> ABI-agnostic |
| 4 | +# (one set of files serves ARM 32 and 64). Run at rootfs-build time on a networked host. |
| 5 | +# |
| 6 | +# WHY TWO VERSIONS: the Android System WebView is whatever the device has (we never touch |
| 7 | +# the ROM). A modern WebView runs the latest pdf.js; a frozen/old one does not. So we ship |
| 8 | +# a newer build AND an older build, and the app routes by the device's WebView major: |
| 9 | +# - v6 -> needs Chromium/WebView >= 118 (latest; receives upstream security fixes) |
| 10 | +# - v4 -> needs Chromium/WebView >= 88 (best-effort for old/frozen devices; TENTATIVE) |
| 11 | +# The app is data-driven off manifest.json, so REMOVING a build is just deleting its row |
| 12 | +# from VERSIONS below: it won't be fetched, won't be in the manifest, and the app ignores |
| 13 | +# it — no dead code, no stale files (the installer wipes the web dir before redeploying). |
| 14 | +# |
| 15 | +# To drop v4 later (e.g. policy: maintained software only): delete its VERSIONS line. Done. |
6 | 16 | set -euo pipefail |
7 | 17 |
|
8 | | -# Pinned pdf.js version. pdf.js ships a stable dist ~monthly and uses semver, so a MAJOR |
9 | | -# bump can break the viewer API. Keep this pinned and bump it DELIBERATELY — primarily when |
10 | | -# a pdf.js security advisory lands (it has had RCE CVEs), not on every release. Also confirm |
11 | | -# the pin runs on the oldest Android System WebView we target (app minSdk = 24 / Android 7; |
12 | | -# recent pdf.js majors need a modern Chromium WebView). Use the newest STABLE that is still |
13 | | -# compatible — never a nightly/beta. |
14 | | -# TODO(Luis): confirm the version to ship (marker below is a placeholder, not verified). |
15 | | -PDFJS_VERSION="${PDFJS_VERSION:-4.10.38}" |
16 | | -# Optional integrity check: set PDFJS_SHA256 to the expected zip checksum to enforce it. |
17 | | -PDFJS_SHA256="${PDFJS_SHA256:-}" |
| 18 | +# id : version : minWebViewMajor : [flags] |
| 19 | +# - id = served subdir and manifest id (/pdfjs/<id>/web/viewer.html) |
| 20 | +# - version = pinned pdf.js release (CONFIRM before shipping) |
| 21 | +# - minWebViewMajor = minimum Chromium/WebView major that build supports |
| 22 | +# - flags = optional, comma-separated (e.g. "tentative") |
| 23 | +VERSIONS=( |
| 24 | + "6:6.1.200:118:" |
| 25 | + "4:4.10.38:88:tentative" |
| 26 | +) |
18 | 27 |
|
19 | 28 | HERE="$(cd "$(dirname "$0")" && pwd)" |
20 | 29 | DIST_DIR="${HERE}/dist" |
21 | | -ZIP_URL="https://github.com/mozilla/pdf.js/releases/download/v${PDFJS_VERSION}/pdfjs-${PDFJS_VERSION}-dist.zip" |
22 | | -TMP_ZIP="$(mktemp -t pdfjs-XXXXXX.zip)" |
23 | | -trap 'rm -f "$TMP_ZIP"' EXIT |
| 30 | +rm -rf "$DIST_DIR" |
| 31 | +mkdir -p "$DIST_DIR" |
24 | 32 |
|
25 | | -echo "Fetching pdf.js v${PDFJS_VERSION} ..." |
26 | | -curl -fSL "$ZIP_URL" -o "$TMP_ZIP" |
| 33 | +manifest_rows=() |
| 34 | +for row in "${VERSIONS[@]}"; do |
| 35 | + IFS=':' read -r id version minmajor flags <<< "$row" |
| 36 | + zip_url="https://github.com/mozilla/pdf.js/releases/download/v${version}/pdfjs-${version}-dist.zip" |
| 37 | + tmp_zip="$(mktemp -t "pdfjs-${id}-XXXXXX.zip")" |
| 38 | + echo "Fetching pdf.js v${version} (build '${id}', min WebView ${minmajor}) ..." |
| 39 | + curl -fSL "$zip_url" -o "$tmp_zip" |
| 40 | + mkdir -p "${DIST_DIR}/${id}" |
| 41 | + unzip -q "$tmp_zip" -d "${DIST_DIR}/${id}" |
| 42 | + rm -f "$tmp_zip" |
| 43 | + test -f "${DIST_DIR}/${id}/web/viewer.html" \ |
| 44 | + || { echo "ERROR: web/viewer.html missing for build '${id}'"; exit 1; } |
| 45 | + tentative="false"; [ "${flags:-}" = "tentative" ] && tentative="true" |
| 46 | + manifest_rows+=(" {\"id\":\"${id}\",\"viewerPath\":\"/pdfjs/${id}/web/viewer.html\",\"minWebViewMajor\":${minmajor},\"version\":\"${version}\",\"tentative\":${tentative}}") |
| 47 | +done |
27 | 48 |
|
28 | | -if [ -n "$PDFJS_SHA256" ]; then |
29 | | - echo "${PDFJS_SHA256} ${TMP_ZIP}" | sha256sum -c - |
30 | | -fi |
| 49 | +# Emit manifest.json from exactly what was fetched. |
| 50 | +{ |
| 51 | + echo '{' |
| 52 | + echo ' "schema": "pdfjs-viewers-v1",' |
| 53 | + echo ' "builds": [' |
| 54 | + n=${#manifest_rows[@]} |
| 55 | + for i in "${!manifest_rows[@]}"; do |
| 56 | + sep=","; [ "$i" -eq "$((n-1))" ] && sep="" |
| 57 | + echo "${manifest_rows[$i]}${sep}" |
| 58 | + done |
| 59 | + echo ' ]' |
| 60 | + echo '}' |
| 61 | +} > "${DIST_DIR}/manifest.json" |
31 | 62 |
|
32 | | -rm -rf "$DIST_DIR" |
33 | | -mkdir -p "$DIST_DIR" |
34 | | -unzip -q "$TMP_ZIP" -d "$DIST_DIR" |
35 | | -# Sanity: the viewer the app points to must exist. |
36 | | -test -f "${DIST_DIR}/web/viewer.html" || { echo "ERROR: web/viewer.html missing from dist"; exit 1; } |
37 | | -echo "pdf.js dist ready at ${DIST_DIR} (web/viewer.html present)." |
| 63 | +echo "pdf.js dist ready:" |
| 64 | +ls -1 "$DIST_DIR" |
| 65 | +echo "--- manifest.json ---" |
| 66 | +cat "${DIST_DIR}/manifest.json" |
0 commit comments