Dockerfile.android

# webshark for Android
ARG DEBIAN=bookworm

ARG NDK=r27c
ARG API=28
ARG TRIPLE=aarch64-linux-android
ARG WIRESHARK=master

# Pinned because a cross build has no distribution to track: each of these is
# read from its own upstream tarball and built here.
ARG ZLIB=1.3.1
ARG FFI=3.4.6
ARG PCRE2=10.44
ARG GLIB=2.82.5
ARG GPGERROR=1.50
ARG GCRYPT=1.11.0
ARG CARES=1.34.5
ARG XML2=2.13.5
ARG SPEEXDSP=1.2.1
ARG LUA=5.4.7

# ------------------------------------------------------------------ ndk ------
FROM debian:${DEBIAN}-slim AS ndk
ARG NDK
ARG API
ARG TRIPLE

# Host tools only - nothing here is linked into anything. `lemon` is the one that
# is not obvious: Wireshark's display-filter parser is generated by it, and
# cmake/modules/UseLemon.cmake looks for a system lemon when cross-compiling
# rather than building one it could not then run. Debian's package is where the
# /usr/share/lemon/lempar.c it tests for comes from.
#
# meson comes from pip and not from apt: bookworm ships 1.0.1 and glib wants
# 1.2 or newer. --break-system-packages is PEP 668 being told that this image
# is the environment, which it is.
RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential cmake ninja-build python3 python3-pip \
        flex bison lemon perl \
        autoconf automake libtool pkg-config gettext \
        curl unzip xz-utils git ca-certificates file \
    && rm -rf /var/lib/apt/lists/* \
    && pip3 install --break-system-packages --no-cache-dir 'meson>=1.4'

RUN curl -fsSL -o /tmp/ndk.zip \
        https://dl.google.com/android/repository/android-ndk-${NDK}-linux.zip \
    && unzip -q /tmp/ndk.zip -d /opt \
    && mv /opt/android-ndk-${NDK} /opt/ndk \
    && rm /tmp/ndk.zip

ENV NDK=/opt/ndk
ENV TOOLCHAIN=/opt/ndk/toolchains/llvm/prebuilt/linux-x86_64
ENV SYSROOT=/opt/sysroot
ENV TRIPLE=${TRIPLE} API=${API}
ENV PATH=${TOOLCHAIN}/bin:${PATH}

# The NDK's clang is one binary for every target; the target and the API level
# are in the name of the wrapper, which is what --host= in an autotools build has
# to be given. llvm-ar and llvm-ranlib rather than the triple-prefixed ones,
# which the NDK dropped.
ENV CC=${TOOLCHAIN}/bin/${TRIPLE}${API}-clang \
    CXX=${TOOLCHAIN}/bin/${TRIPLE}${API}-clang++ \
    AR=${TOOLCHAIN}/bin/llvm-ar \
    RANLIB=${TOOLCHAIN}/bin/llvm-ranlib \
    STRIP=${TOOLCHAIN}/bin/llvm-strip \
    NM=${TOOLCHAIN}/bin/llvm-nm \
    LD=${TOOLCHAIN}/bin/ld

# Everything cross-built installs here, and nothing outside it is ever found:
# PKG_CONFIG_LIBDIR replaces the default search path rather than adding to it, so
# a host glib cannot be picked up by mistake.
ENV PKG_CONFIG_LIBDIR=${SYSROOT}/lib/pkgconfig \
    PKG_CONFIG_SYSROOT_DIR= \
    CFLAGS="-Os -fPIC" \
    CPPFLAGS="-I/opt/sysroot/include" \
    LDFLAGS="-L/opt/sysroot/lib"

# Every library here is static, so a .pc file's Libs alone is not enough to link
# against it - the transitive Libs.private are needed too, and that is what
# --static means. A wrapper rather than $PKG_CONFIG, because cmake and meson both
# look pkg-config up as a program and neither takes one with an argument in it.
RUN printf '#!/bin/sh\nexec /usr/bin/pkg-config --static "$@"\n' \
        > /usr/local/bin/pkg-config \
    && chmod +x /usr/local/bin/pkg-config

RUN mkdir -p ${SYSROOT}

# The two cross descriptions the build systems want: meson reads an ini file,
# cmake gets the NDK's own toolchain file with arguments.
RUN printf '%s\n' \
    '[binaries]' \
    "c = '${TOOLCHAIN}/bin/${TRIPLE}${API}-clang'" \
    "cpp = '${TOOLCHAIN}/bin/${TRIPLE}${API}-clang++'" \
    "ar = '${TOOLCHAIN}/bin/llvm-ar'" \
    "ranlib = '${TOOLCHAIN}/bin/llvm-ranlib'" \
    "strip = '${TOOLCHAIN}/bin/llvm-strip'" \
    "pkg-config = 'pkg-config'" \
    '' \
    '[properties]' \
    'needs_exe_wrapper = true' \
    '' \
    '[host_machine]' \
    "system = 'android'" \
    "cpu_family = 'aarch64'" \
    "cpu = 'aarch64'" \
    "endian = 'little'" \
    > /opt/cross.ini

WORKDIR /build

# ----------------------------------------------------------------- deps ------
FROM ndk AS deps
ARG ZLIB
ARG FFI
ARG PCRE2
ARG GLIB
ARG GPGERROR
ARG GCRYPT
ARG CARES
ARG XML2
ARG SPEEXDSP
ARG LUA

# zlib: its configure is not autoconf and takes the target from $CHOST.
RUN curl -fsSL https://zlib.net/fossils/zlib-${ZLIB}.tar.gz | tar xz \
    && cd zlib-${ZLIB} \
    && CHOST=${TRIPLE} ./configure --prefix=${SYSROOT} --static \
    && make -j$(nproc) && make install

# libffi, which is gobject's, not ours.
RUN curl -fsSL https://github.com/libffi/libffi/releases/download/v${FFI}/libffi-${FFI}.tar.gz | tar xz \
    && cd libffi-${FFI} \
    && ./configure --host=${TRIPLE} --prefix=${SYSROOT} \
        --disable-shared --enable-static --disable-docs \
    && make -j$(nproc) && make install

# pcre2 is glib's regex engine and Wireshark looks for it in its own right.
RUN curl -fsSL https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${PCRE2}/pcre2-${PCRE2}.tar.gz | tar xz \
    && cmake -S pcre2-${PCRE2} -B b-pcre2 -G Ninja \
        -D CMAKE_TOOLCHAIN_FILE=${NDK}/build/cmake/android.toolchain.cmake \
        -D ANDROID_ABI=arm64-v8a -D ANDROID_PLATFORM=android-${API} \
        -D CMAKE_INSTALL_PREFIX=${SYSROOT} -D CMAKE_BUILD_TYPE=Release \
        -D BUILD_SHARED_LIBS=OFF -D PCRE2_BUILD_TESTS=OFF \
        -D PCRE2_BUILD_PCRE2GREP=OFF \
    && cmake --build b-pcre2 --parallel $(nproc) && cmake --install b-pcre2

# glib. Everything optional is off: nls wants libintl, libmount and selinux are
# not on Android at all, and the tests would have to run on the target to be
# worth building. API 28 is the floor this image builds against because that is
# where bionic grew iconv, which glib requires and would otherwise need a
# libiconv of its own.
RUN curl -fsSL https://download.gnome.org/sources/glib/$(echo ${GLIB} | cut -d. -f1,2)/glib-${GLIB}.tar.xz | tar xJ \
    && meson setup b-glib glib-${GLIB} \
        --cross-file /opt/cross.ini \
        --prefix ${SYSROOT} --buildtype release --default-library static \
        -D tests=false -D installed_tests=false \
        -D nls=disabled -D libmount=disabled -D selinux=disabled -D xattr=false \
        -D introspection=disabled -D man-pages=disabled -D documentation=false \
        -D glib_debug=disabled -D sysprof=disabled \
    && meson compile -C b-glib -j $(nproc) && meson install -C b-glib

# libgpg-error keeps a per-target header of lock object sizes and has none for
# an Android triple; the sizes are the Linux ones, bionic's pthread types being
# no larger, so the gnu file stands in for it. Without this its configure stops
# and asks to be regenerated.
RUN curl -fsSL https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-${GPGERROR}.tar.bz2 | tar xj \
    && cd libgpg-error-${GPGERROR} \
    && cp -n src/syscfg/lock-obj-pub.aarch64-unknown-linux-gnu.h \
            src/syscfg/lock-obj-pub.linux-android.h || true \
    && ./configure --host=${TRIPLE} --prefix=${SYSROOT} \
        --disable-shared --enable-static --disable-doc --disable-tests \
        --disable-nls \
    && make -j$(nproc) && make install

# libgcrypt, which is what decrypts ESP.
RUN curl -fsSL https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-${GCRYPT}.tar.bz2 | tar xj \
    && cd libgcrypt-${GCRYPT} \
    && ./configure --host=${TRIPLE} --prefix=${SYSROOT} \
        --with-libgpg-error-prefix=${SYSROOT} \
        --disable-shared --enable-static --disable-doc --disable-tests \
    && make -j$(nproc) && make install

# c-ares and libxml2 are both `REQUIRED` in Wireshark's CMakeLists whatever is
# being built, so they are here to satisfy it rather than to be used: nothing in
# this image resolves a name, and iconv is off because what libxml2 wants of it
# is more than bionic's.
RUN curl -fsSL https://github.com/c-ares/c-ares/releases/download/v${CARES}/c-ares-${CARES}.tar.gz | tar xz \
    && cmake -S c-ares-${CARES} -B b-cares -G Ninja \
        -D CMAKE_TOOLCHAIN_FILE=${NDK}/build/cmake/android.toolchain.cmake \
        -D ANDROID_ABI=arm64-v8a -D ANDROID_PLATFORM=android-${API} \
        -D CMAKE_INSTALL_PREFIX=${SYSROOT} -D CMAKE_BUILD_TYPE=Release \
        -D CARES_STATIC=ON -D CARES_SHARED=OFF -D CARES_BUILD_TOOLS=OFF \
    && cmake --build b-cares --parallel $(nproc) && cmake --install b-cares

RUN curl -fsSL https://download.gnome.org/sources/libxml2/$(echo ${XML2} | cut -d. -f1,2)/libxml2-${XML2}.tar.xz | tar xJ \
    && cmake -S libxml2-${XML2} -B b-xml2 -G Ninja \
        -D CMAKE_TOOLCHAIN_FILE=${NDK}/build/cmake/android.toolchain.cmake \
        -D ANDROID_ABI=arm64-v8a -D ANDROID_PLATFORM=android-${API} \
        -D CMAKE_INSTALL_PREFIX=${SYSROOT} -D CMAKE_BUILD_TYPE=Release \
        -D BUILD_SHARED_LIBS=OFF \
        -D LIBXML2_WITH_PYTHON=OFF -D LIBXML2_WITH_ICONV=OFF \
        -D LIBXML2_WITH_LZMA=OFF -D LIBXML2_WITH_TESTS=OFF \
        -D LIBXML2_WITH_PROGRAMS=OFF \
    && cmake --build b-xml2 --parallel $(nproc) && cmake --install b-xml2

# SpeexDSP is required *because* this builds sharkd - it is the resampler behind
# sharkd's RTP taps, and Wireshark's CMakeLists makes it unconditional there.
RUN curl -fsSL https://downloads.xiph.org/releases/speex/speexdsp-${SPEEXDSP}.tar.gz | tar xz \
    && cd speexdsp-${SPEEXDSP} \
    && ./configure --host=${TRIPLE} --prefix=${SYSROOT} \
        --disable-shared --enable-static \
    && make -j$(nproc) && make install

# Lua, for plugins/ims.lua. Its makefile is not generated, so the toolchain goes
# in as variables and the result is installed by hand.
RUN curl -fsSL https://www.lua.org/ftp/lua-${LUA}.tar.gz | tar xz \
    && make -C lua-${LUA}/src -j$(nproc) liblua.a \
        CC="${CC}" AR="${AR} rcu" RANLIB="${RANLIB}" \
        MYCFLAGS="-fPIC -DLUA_USE_POSIX" \
    && mkdir -p ${SYSROOT}/include/lua5.4 \
    && cp lua-${LUA}/src/liblua.a ${SYSROOT}/lib/liblua5.4.a \
    && cp lua-${LUA}/src/lua.h lua-${LUA}/src/luaconf.h \
          lua-${LUA}/src/lualib.h lua-${LUA}/src/lauxlib.h \
          ${SYSROOT}/include/lua5.4/

# --------------------------------------------------------------- sharkd ------
FROM deps AS sharkd
ARG WIRESHARK
ARG API

RUN git clone --depth=1 --branch ${WIRESHARK} \
        https://gitlab.com/wireshark/wireshark.git /src

# The same feature set as the main Dockerfile - see the comment there for why
# each of these is off - with two differences that are only about the target:
#
#   BUILD_SHARED_LIBS=OFF   one file to package instead of libwireshark.so and
#                           its friends, and no SONAMEs for an APK to choke on.
#   CMAKE_FIND_ROOT_PATH    the NDK toolchain file confines find_package to the
#                           sysroot, so the libraries built above have to be
#                           named as part of it or nothing sees them.
#   CMAKE_C_STANDARD_LIBRARIES
#                           glib built without native-language support still
#                           calls g_dgettext, and the stubs it resolves to are in
#                           the libintl glib builds alongside itself. glib-2.0.pc
#                           says so - `Libs: ... -lglib-2.0 -lintl` - but
#                           FindGLIB2.cmake finds each library by name instead of
#                           taking that line, so the stubs go unmentioned and
#                           unlinked. This variable rather than a linker flag
#                           because it is appended after every other library,
#                           which is where an archive satisfying glib has to be.
RUN cmake -S /src -B /wsbuild -G Ninja \
        -D CMAKE_TOOLCHAIN_FILE=${NDK}/build/cmake/android.toolchain.cmake \
        -D ANDROID_ABI=arm64-v8a -D ANDROID_PLATFORM=android-${API} \
        -D CMAKE_FIND_ROOT_PATH="${SYSROOT}" \
        -D CMAKE_PREFIX_PATH="${SYSROOT}" \
        -D CMAKE_C_STANDARD_LIBRARIES=${SYSROOT}/lib/libintl.a \
        -D CMAKE_BUILD_TYPE=Release \
        -D BUILD_SHARED_LIBS=OFF \
        -D BUILD_sharkd=ON -D BUILD_tshark=OFF -D BUILD_dftest=OFF \
        -D BUILD_wireshark=OFF -D BUILD_rawshark=OFF -D BUILD_dumpcap=OFF \
        -D BUILD_capinfos=OFF -D BUILD_captype=OFF -D BUILD_editcap=OFF \
        -D BUILD_mergecap=OFF -D BUILD_reordercap=OFF -D BUILD_text2pcap=OFF \
        -D BUILD_randpkt=OFF -D BUILD_dcerpcidl2wrs=OFF -D BUILD_mmdbresolve=OFF \
        -D BUILD_androiddump=OFF -D BUILD_sshdump=OFF -D BUILD_ciscodump=OFF \
        -D BUILD_dpauxmon=OFF -D BUILD_randpktdump=OFF -D BUILD_wifidump=OFF \
        -D BUILD_udpdump=OFF \
        -D ENABLE_LUA=ON \
        -D LUA_INCLUDE_DIR=${SYSROOT}/include/lua5.4 \
        -D LUA_LIBRARIES=${SYSROOT}/lib/liblua5.4.a \
        -D ENABLE_PCAP=OFF \
        -D ENABLE_PLUGINS=OFF \
        -D ENABLE_WERROR=OFF \
    && cmake --build /wsbuild --parallel $(nproc) --target sharkd

# The ESP plugin - plugins/ims_esp, the same source the main image builds - is
# compiled *into* this sharkd rather than loaded by it. ENABLE_PLUGINS stays off
# above because a plugin is a shared module and this is a static build: there is
# no libwireshark for one to resolve against, and an APK is not somewhere a
# process dlopens from anyway. CUSTOM_DISSECTOR_SRC is upstream's hook for a
# dissector held outside the tree - the file joins the built-in set, and the
# generated registration calls its proto_register_/proto_reg_handoff_ pair the
# same way the generated plugin.c does in the other build. Nothing in the file
# knows the difference.
#
# Its own layer, and a second cmake rather than the one above, so that editing
# the plugin costs one compile and a relink instead of an hour of Wireshark.
COPY plugins/ims_esp /src/plugins/epan/ims_esp
RUN cmake -S /src -B /wsbuild \
        -D CUSTOM_DISSECTOR_SRC=/src/plugins/epan/ims_esp/packet-ims-esp.c \
    && cmake --build /wsbuild --parallel $(nproc) --target sharkd

# Named as a library because that is the only kind of file an APK unpacks
# somewhere an app may execute from.
RUN mkdir -p /out/jniLibs/arm64-v8a \
    && cp /wsbuild/run/sharkd /out/jniLibs/arm64-v8a/libsharkd.so \
    && ${STRIP} /out/jniLibs/arm64-v8a/libsharkd.so \
    && file /out/jniLibs/arm64-v8a/libsharkd.so \
    && ${TOOLCHAIN}/bin/llvm-readelf -d /out/jniLibs/arm64-v8a/libsharkd.so | grep NEEDED

# Wireshark's data directory, which is not one file of preferences and one of
# coloring rules: the Diameter dictionaries, the DTDs the XML dissector builds
# `reginfo.registration.aor` and its like out of, RADIUS, protobuf, the JSON
# dictionary and the rest are all *files*, read out of WIRESHARK_DATA_DIR as the
# dissectors register. A field that comes from one of them does not exist
# without it - and plugins/ims.lua names several, `diameter.User-Name` and
# `reginfo.registration.aor` among them. `Field.new` raises on a field that was
# never registered, which aborts the script at its first line and takes every
# ims.* field with it, so shipping the two files alone left the plugin loaded by
# name and dead in fact.
#
# `copy_data_files` is upstream's own target for this: it fills DATAFILE_DIR,
# which is the data directory Wireshark reads when it is run out of its build
# tree - the same set an install puts in ${CMAKE_INSTALL_DATADIR}/wireshark, plus
# the few documentation files that share the directory and are inert here.
# DATAFILE_DIR is /wsbuild/run, where the build also leaves sharkd and the static
# libraries, hence naming those to leave out rather than naming the data to take:
# a list of what to take would silently miss whatever upstream adds next.
RUN cmake --build /wsbuild --parallel $(nproc) --target copy_data_files \
    && mkdir -p /out/share \
    && find /wsbuild/run -maxdepth 1 -mindepth 1 \
        ! -name '*.a' ! -name sharkd -exec cp -r {} /out/share/ \;

# ------------------------------------------------------------------ api ------
FROM golang:alpine AS api
COPY src /src
# GOOS=android, which with cgo off wants no NDK and produces the same code a
# linux/arm64 build does - there is nothing of libc in either to be bionic's or
# glibc's, and DT_NEEDED is empty in both. What differs is the ELF around it, in
# the two things bionic looks at before it will run a file at all:
#
#   PT_TLS       a linux/arm64 build carries one - 16 bytes of .tbss, aligned to
#                8, which is the register size the linker uses - and bionic
#                refuses an executable whose TLS segment is aligned to less than
#                64: "executable's TLS segment is underaligned". Nothing in the
#                binary reads it, g living in R28 on arm64 unless cgo is on, and
#                for GOOS=android the linker emits no such segment.
#   PT_INTERP    Go names /lib/ld-linux-aarch64.so.1 for linux/arm64, which is
#                not on a phone; for android it names /system/bin/linker64. PIE,
#                which Android has required since API 29, is the default there
#                rather than something to ask for.
RUN cd /src && CGO_ENABLED=0 GOOS=android GOARCH=arm64 \
        go build -trimpath -ldflags='-s -w' -o /libwebshark.so .

# ----------------------------------------------------------------- tree ------
# Nothing but the files the app needs, so `--output type=local` writes exactly
# them and disturbs nothing else in android/app/src/main.
FROM scratch AS tree
COPY --from=sharkd /out/jniLibs/arm64-v8a/libsharkd.so jniLibs/arm64-v8a/
COPY --from=api    /libwebshark.so                     jniLibs/arm64-v8a/
# The data directory sharkd is pointed at with WIRESHARK_DATA_DIR: Wireshark's
# own, as staged above, and then the two files webshark replaces in it - the
# same thing the main image does to /usr/local/share/wireshark. The order is the
# point: ours land on top of the colorfilters upstream ships.
COPY --from=sharkd /out/share assets/share/
COPY preferences  assets/share/
COPY colorfilters assets/share/
COPY plugins/*.lua assets/plugins/

# ------------------------------------------------------------------ sdk ------
# The Android half of the build: a JDK, Gradle and the SDK, so an APK needs
# nothing on the host either. Gradle 8.10.2 is the one version both plugins in
# android/build.gradle.kts agree on - AGP 8.7 wants 8.9 or newer, Kotlin 2.0.21
# supports up to 8.10.
FROM gradle:8.10.2-jdk17 AS sdk

# compileSdk, and the build-tools AGP 8.7.3 defaults to - not the newest, and it
# matters: name a different one and Gradle stops in the middle of the build to
# fetch the one it wanted. platform-tools comes along for the same reason. The
# command-line tools have no version but the build id Google publishes them under.
ARG CMDLINE_TOOLS=11076708
ARG COMPILE_SDK=35
ARG BUILD_TOOLS=34.0.0

ENV ANDROID_HOME=/opt/android-sdk

# sdkmanager insists on living at cmdline-tools/latest and the zip unpacks to
# cmdline-tools/, hence the move. `yes` answers the licence prompts and then
# loses its pipe when sdkmanager exits, which is what the `|| true` is for.
RUN apt-get update && apt-get install -y --no-install-recommends curl unzip \
    && rm -rf /var/lib/apt/lists/* \
    && curl -fsSL -o /tmp/tools.zip \
        https://dl.google.com/android/repository/commandlinetools-linux-${CMDLINE_TOOLS}_latest.zip \
    && mkdir -p ${ANDROID_HOME}/cmdline-tools \
    && unzip -q /tmp/tools.zip -d ${ANDROID_HOME}/cmdline-tools \
    && mv ${ANDROID_HOME}/cmdline-tools/cmdline-tools \
          ${ANDROID_HOME}/cmdline-tools/latest \
    && rm /tmp/tools.zip \
    && (yes | ${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager --licenses \
          > /dev/null || true) \
    && ${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager \
        "platforms;android-${COMPILE_SDK}" "build-tools;${BUILD_TOOLS}" \
        "platform-tools" > /dev/null

# ------------------------------------------------------------- assemble ------
FROM sdk AS assemble

COPY android /app
# The tree above is exactly what android/.gitignore leaves out of the project,
# so this is the app with its two programs and its data files in place.
COPY --from=tree / /app/app/src/main/

WORKDIR /app
# assembleDebug because there is no signing config - see android/README.md. The
# daemon would outlive nothing here, and --console=plain keeps the log readable
# when CI is the one reading it.
RUN gradle --no-daemon --console=plain assembleDebug

# ------------------------------------------------------------------ apk ------
FROM scratch AS apk
COPY --from=assemble /app/app/build/outputs/apk/debug/app-debug.apk \
     webshark-arm64.apk