From a9b1dc8bd9354973eabd72f56d82b2eab6f48d56 Mon Sep 17 00:00:00 2001 From: cirakg Date: Sun, 18 Oct 2026 20:28:09 +0200 Subject: build: add Docker-only Makefile, SDK setup and product manifest - Makefile: every target runs in a container as your UID/GID, with no capabilities, a read-only root filesystem, only the project folder mounted and no network except for image builds and `make sdk`. Serial even under `make -j`. `make nuke` removes containers, images, the dedicated buildx builder and .cache/ after confirmation. - sdk-setup.sh: agreement acceptance pinned to the hash you read, password login (never stored), SDK 9.2.0 and device download, and the login token deleted afterwards. - gen-key.sh: RSA-4096 developer key into .cache/keys, never overwritten, with backup instructions. - manifest.xml: watch-app, minApiLevel 5.0.0, no permissions, and the 72 watches with API 5.0+ and at least 512 KB for apps. - .gitignore, lint configs and CHANGELOG. Co-Authored-By: Claude Opus 5.5 --- docker/scripts/sdk-setup.sh | 88 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100755 docker/scripts/sdk-setup.sh (limited to 'docker/scripts/sdk-setup.sh') diff --git a/docker/scripts/sdk-setup.sh b/docker/scripts/sdk-setup.sh new file mode 100755 index 0000000..278b060 --- /dev/null +++ b/docker/scripts/sdk-setup.sh @@ -0,0 +1,88 @@ +#!/usr/bin/env bash +# Interactive first-time setup behind `make sdk` (README section 15.3). +# +# 1. Garmin's agreements: you read them in your browser and accept them here. +# 2. Login with your Garmin account. Email and password are typed here and +# passed only to the SDK manager CLI, which sends them to Garmin's sign-in +# page. Neither is written to disk; the CLI stores an access token. +# 3. Download Connect IQ SDK ${SDK_VERSION} and make it the current SDK. +# 4. Download the device files and simulator fonts for every product listed +# in manifest.xml. +# 5. Log out: delete the access token (set KEEP_LOGIN=1 to keep it). +# +# Why email and password instead of the CLI's browser login: that flow waits +# for a redirect to a random localhost port inside the container, which your +# browser can't reach without host networking (not allowed by the sandbox +# rules). Password login doesn't support Garmin two-step verification; README +# section 15.3 describes the fallback for such accounts. +set -euo pipefail +# shellcheck source=ciq-env.sh +source "$(dirname "${BASH_SOURCE[0]}")/ciq-env.sh" + +readonly SDKMGR=connect-iq-sdk-manager +readonly MANIFEST=/work/manifest.xml +readonly TOKEN="${CIQ_HOME}/token.json" + +[[ -t 0 ]] || die "'make sdk' is interactive; run it from a terminal." +[[ -f "${MANIFEST}" ]] || die "manifest.xml not found in the project folder." +: "${SDK_VERSION:?SDK_VERSION is not set (the Makefile passes it)}" + +echo +echo "Step 1/5: Garmin's agreements" +view="$(${SDKMGR} agreement view 2>&1)" || die "Could not fetch the agreement from Garmin: ${view}" +url="$(sed -n 's/^Agreement: //p' <<<"${view}")" +hash="$(sed -n 's/^Current Hash: //p' <<<"${view}")" +[[ -n "${url}" && -n "${hash}" ]] || die "Unexpected output from 'agreement view': ${view}" +cat </dev/null +echo " Accepted (version ${hash})." + +echo +echo "Step 2/5: Garmin login" +if [[ -f "${TOKEN}" ]]; then + echo " Reusing the login token kept from an earlier run (KEEP_LOGIN=1)." +else + echo " Email and password go only to Garmin's sign-in page and are not stored." + echo " Accounts with two-step verification can't log in this way (see README 15.3)." + read -r -p " Garmin account email: " GARMIN_USERNAME + read -r -s -p " Password (not shown): " GARMIN_PASSWORD + echo + export GARMIN_USERNAME GARMIN_PASSWORD + if ! ${SDKMGR} login; then + unset GARMIN_USERNAME GARMIN_PASSWORD + die "Login failed. Check email and password. Two-step verification isn't supported here; see README 15.3." + fi + unset GARMIN_USERNAME GARMIN_PASSWORD + echo " Logged in." +fi + +echo +echo "Step 3/5: Connect IQ SDK ${SDK_VERSION}" +${SDKMGR} sdk set "${SDK_VERSION}" +echo " Current SDK: $(${SDKMGR} sdk current-path)" + +echo +echo "Step 4/5: device files and fonts for the products in manifest.xml" +${SDKMGR} device download --manifest "${MANIFEST}" --include-fonts + +echo +echo "Step 5/5: log out" +if [[ "${KEEP_LOGIN:-0}" == 1 ]]; then + echo " KEEP_LOGIN=1: keeping the token at .cache/home/.Garmin/ConnectIQ/token.json" +else + rm -f "${TOKEN}" + echo " Login token deleted. Run 'make sdk' again whenever new device files are needed." +fi + +device_count="$(find "${CIQ_HOME}/Devices" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | wc -l)" +echo +echo "Done: SDK ${SDK_VERSION}, ${device_count} device folders, $(du -sh "${CIQ_HOME}" | cut -f1) in .cache/home." +echo "Next: 'make key' (if you have no developer key yet), then 'make test'." -- cgit v1.2.3